1. Scope and controller
This policy applies to Born by Firelight on the web, the Telegram Mini App and the native Android application, including the common game backend used by those clients.
The data controller is Teimuraz Melikadze, NIF 3474585K, Columbretes 11 8B, Castellón de la Plana, Spain. Privacy enquiries and rights requests may be sent to contact@bornbyfirelight.com.
2. Data we process
Account and recovery data
- Player identifier, nickname, account creation and last activity dates.
- Optional email address, verification state and the technical records needed to link, access or recover an account.
- Session, verification and recovery credentials. Where the service stores reusable verification or recovery tokens, they are stored in protected or hashed form rather than as the original secret.
Game and progression data
- Points, inventory, cards, decks, wildcards, offerings, loadout and game preferences.
- Matchmaking state, matches, turns, actions, results, replays and connection or heartbeat status.
- Wishing Well and Fortune Card activity, rewards, limits, cooldowns and records needed to prevent duplicate or fraudulent claims.
Technical and security data
- IP address, user agent, device or app version, language, timestamps, request identifiers, diagnostic logs and error information.
- Security and anti-abuse signals used to protect accounts, matchmaking, rewards, the API and WebSocket connections.
Platform and advertising data
- When the Telegram Mini App is used, Telegram may provide the user identifier and profile fields included in its signed authentication data.
- On Android, Google Mobile Ads and its consent tools may process advertising identifiers, ad interactions, consent choices, approximate location inferred from the IP address, device information and diagnostics in accordance with Google's own policies and the user's choices.
- On the web and in Telegram, Monetag or the advertising destination opened for a chosen placement may process browser/device identifiers, IP-derived location, ad interactions and technical data under the provider's own policies and the consent rules applicable to the user.
The current Android client does not request access to contacts, precise GPS location, microphone, camera, photos or personal files for gameplay.
3. Why we use the data
- To create and operate player accounts and keep progression synchronised between authorised clients.
- To provide matchmaking, matches, replays, collections, rewards and other requested game functions.
- To verify email addresses and provide account access or recovery.
- To maintain availability, diagnose faults, secure the service and prevent cheating, automated abuse, fraud and duplicate rewards.
- To show rewarded advertising when the player expressly chooses that option and to record whether the associated reward may be granted.
- To meet legal obligations and establish, exercise or defend legal claims.
4. Legal bases
Depending on the feature and the user's location, processing is based on performance of the service requested by the user, legitimate interests in operating and securing the game, consent for advertising or similar technologies where required, and compliance with legal obligations.
Where consent is the legal basis, it may be withdrawn at any time through the available consent controls. Withdrawal does not affect processing already carried out lawfully.
5. Recipients and service providers
Data may be processed by providers that support hosting, databases, email delivery, security, diagnostics and other infrastructure strictly needed to operate the service. Depending on the client and feature, the following third parties may also receive data:
- Google, for Google Mobile Ads and consent management on Android.
- Telegram, when the Telegram Mini App and Telegram authentication are used.
- Monetag and advertising partners, for configured web or Telegram advertising placements.
- Public authorities, courts or other competent bodies where disclosure is required by law or necessary to protect legal rights.
Born by Firelight does not sell player account or gameplay data. Provider processing may involve international transfers subject to the safeguards made available by the relevant provider and applicable law.
6. Retention and deletion
Account and progression data is generally retained while the account remains active. Technical logs, reward claims and security records are retained only for as long as reasonably needed to operate the service, investigate faults, prevent fraud or meet legal obligations.
When an account deletion request is completed, associated personal data is deleted or irreversibly anonymised unless limited retention is required for security, fraud prevention, legal compliance or the defence of claims. Residual copies may remain in protected backups until their normal rotation.
See Delete your account and data for the available request methods.
7. Security
Reasonable technical and organisational measures are used to protect accounts and service data, including access controls, transport encryption, limited logging and protected verification credentials. No online system can be guaranteed to be completely secure.
Do not send session tokens, recovery keys or other authentication secrets by email.
8. Your rights
Depending on applicable law, you may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent where processing relies on it. You may also lodge a complaint with the Spanish Data Protection Agency or the competent supervisory authority in your country.
Send requests to contact@bornbyfirelight.com. Reasonable verification may be required to protect the account from unauthorised requests.
9. Children
Born by Firelight is not directed to children under 13. Where local law requires parental or guardian authorisation for a minor to use an online service or consent to data processing, that authorisation must be obtained.
10. Changes
This policy may be updated when features, providers or legal requirements change. The current version and its update date will remain available at this URL.