Privacy Policy

Who We Are

Alexandru Munteanu, trading as Nepherius, operates Casual RPG and is the controller responsible for the personal information described here. This policy covers the game, its online services and support communications. Contact help@nepherius.dev with privacy questions or requests.

Information We Process

• Account information: Firebase account identifiers, email addresses, sign-in provider details and available Google profile information. You can register with email and password or sign in with Google. Firebase Authentication handles your credentials; do not send passwords or sign-in tokens to support.
• Game and community data: Character names, class, progress, stats, inventory, equipment, achievements, guild membership and messages, mail, trades, market activity, rankings and online/last-seen status.
• Subscriptions: Account identifiers, store purchase and transaction information, VIP entitlement status and renewal information. RevenueCat is configured with your Firebase account identifier to manage and restore access. The app store handles payment details; we do not receive your full payment card number.
• Usage and diagnostics: Firebase Analytics records screen views and app activity. Firebase Crashlytics processes crash traces, error logs, installation identifiers and device/app information. Firebase In-App Messaging uses installation information to deliver in-app messages.
• Advertising: Google Mobile Ads and its consent tools may process advertising and installation identifiers, IP addresses, device information, ad interactions and privacy choices to deliver and measure ads, including optional rewarded ads.
• Security and support: Authentication tokens, app/device integrity information, technical request logs and information you include in support messages help us authenticate requests, prevent abuse and answer questions.

How and Why We Use Information

We use account and game data to provide login, save progress, run gameplay and community features, and deliver purchased VIP access. For these activities, our lawful basis is performance of our agreement with you. Account information is necessary to use the online game; subscription information is necessary to validate paid access.

Our legitimate interests include securing the service, preventing cheating and fraud, investigating errors, maintaining reliability and responding to support requests. We consider your rights when relying on these interests. We process records required by law on the basis of legal obligation.

Consent is the basis for personalized advertising and other tracking where consent is required by applicable law. Usage analytics helps us understand navigation and improve the game. Where consent is not required, our basis for usage measurement is our legitimate interest in improving the service, subject to your rights. Essential service diagnostics are separate. Agreement to the terms is not consent to optional tracking.

Providers, Storage and Visibility

We manage the game's databases and server functions using Google Firebase, including Authentication, Cloud Firestore, Realtime Database and Cloud Functions. Google hosts and processes this information for us; hosting with Google does not remove our responsibility for your game data.

Google/Firebase also provides Analytics, Crashlytics, In-App Messaging and app integrity services. Google Mobile Ads and the User Messaging Platform support advertising and ad privacy choices. RevenueCat processes account-linked subscription information on our behalf. App stores process purchases under their own terms.

Other players can see information used in multiplayer features, such as character names, rankings, online status, guild participation and messages you share. Mail and trading information is available to the relevant participants. Avoid including personal or sensitive information in public names or messages.

Read Firebase's privacy and security information, Google's privacy policy, Google's advertising information and RevenueCat's privacy information. RevenueCat's processing of app-user data is governed by its agreement with us, including its Data Processing Addendum.

Advertising and Analytics Choices

You can review advertising privacy choices through Settings > Ad Privacy and the consent management form when available for your region. Device advertising settings may also affect how ads are personalized. Withdrawing consent affects future consent-based processing and does not undo earlier processing.

The advertising consent form controls advertising choices. Firebase Analytics screen-view collection and Crashlytics error reporting are separate; the game currently has no separate in-app analytics toggle. Advertising choices do not automatically disable these services. Contact us about analytics information, objections or deletion requests. Non-personalized ads can still involve technical identifiers and processing; they are not necessarily anonymous.

Retention and Account Deletion

Account and character records are kept while your account remains available, until you delete the account or request erasure, subject to applicable legal requirements. This includes accounts you have stopped using; uninstalling the app or signing out does not delete server data.

To delete your account, log in and tap Delete Account on the Select Character screen, which appears after login. Confirm the request and sign in again if asked. Deletion permanently removes every character on that account and associated game data from our active databases, including progress, inventory, account records and related community records. It also deletes your Firebase sign-in identity. Shared records concerning other players may remain with your reference removed.

Deletion is processed on the server and may take time or be retried if a provider is unavailable. Once accepted, it continues even if you close the app. The deleted characters and progress cannot be restored. See the account deletion instructions.

Request deletion without the app: Email help@nepherius.dev with the subject “Casual RPG Account Deletion”, your account email and any character names that help identify the account. We may ask for proportionate verification of account ownership. You do not need to reinstall the app or have an active VIP subscription. Never send your password or authentication tokens.

Separate provider records: In-app deletion does not automatically erase historical analytics, crash reports, RevenueCat subscription records or app-store transactions. Contact us to request erasure of identifiable records we control, including information processed by our providers. Any necessary retention is limited to its purpose, such as processing refunds, resolving disputes or meeting legal obligations; we will explain applicable exceptions when responding.

Firebase states that authentication information is removed from live and backup systems within 180 days after user deletion is initiated; logged authentication IP addresses are kept for a few weeks. Crashlytics keeps crash traces and associated identifiers for 90 days before beginning removal. Analytics retention depends on the project's settings. Support records are kept for handling the request and any necessary follow-up or dispute; contact us for the retention details applicable to your information.

Deleting your account does not cancel your subscription. Manage or cancel recurring billing separately through Google Play. Deletion does not delete your Google account.

International Processing and Security

Our providers may process information outside the UK, including in the United States. Google's published transfer safeguards include the UK Extension to the EU–US Data Privacy Framework. RevenueCat's Data Processing Addendum describes contractual safeguards, including standard contractual clauses and UK transfer provisions. Contact us for information about safeguards applicable to your data.

We use encrypted connections, authentication, access rules and app integrity checks to protect information. No internet service can guarantee absolute security. Please report suspected account compromise to support promptly.

Children's Information

A PEGI rating describes game content; it does not determine whether collecting a child's information is appropriate. Account, gameplay and technical information is processed when someone uses the service, including where that person is a child. Parents or guardians can contact us about a child's account or request deletion. We will assess and respond to these requests under applicable law, including any necessary verification or parental authorization.

Your Rights and Contact

Depending on applicable law and the circumstances, you may request access, correction, erasure, restriction of processing or a portable copy of your personal information. You can withdraw consent to consent-based processing without affecting the lawfulness of earlier processing.

Right to object: You may object to processing based on legitimate interests for reasons relating to your circumstances, and to processing for direct marketing.

Send requests to help@nepherius.dev. We may need proportionate evidence of identity. We normally respond within one month and explain any lawful extension or exception. Exercising these rights does not require a paid subscription. You may complain to the UK Information Commissioner's Office or your local data protection authority.

We update this policy when our practices change and publish a fixed revision date. Material changes will be brought to your attention through the website or app as appropriate; any new consent required by law must be obtained separately.