FORGE ARSENAL1. Who we are
Forge Arsenal is developed and published by an independent developer based in the European Union ("we", "us"). We are the data controller for the personal data described here. You can reach us at [email protected].
This policy covers the Forge Arsenal app distributed on Google Play and this website. It does not cover Google Play itself, YouTube (which hosts our trailer) or any third-party site we link to; each of those has its own policy.
2. What we collect
2.1 Account and game data (our servers)
The game needs a server account to save your progress, restore it after a reinstall and keep the Arena and leaderboards fair. That account holds:
- A device identifier: a random UUID generated when the app is first installed. It is not your Android ID or advertising ID.
- A display name: "Guest N" by default, or the name you choose in Settings. Names are checked against a profanity filter and a length limit.
- Your Google account identifier (optional): if you sign in with Google to link devices, we store the numeric account ID Google gives us. We do not store your email address, your name or your profile picture.
- Your game save: progress, equipment, pets, kingdom, research, currencies, settings, and the timestamps of your saves and claims.
- Purchase records: the product ID, order ID and purchase token Google Play sends us when you buy something, so we can grant it and restore it. We never see your payment details.
- Technical data: app version, request timestamps and, in server logs, the IP address of each request. Logs are used to run the service, block abuse and investigate bugs.
2.2 Analytics and crash reports (Google Firebase)
The app includes Google Analytics for Firebase and Firebase Crashlytics. Firebase collects an app-instance ID, device model and OS version, coarse location derived from the IP address (country or region), session and engagement data, and the gameplay events we log (for example tutorial steps, crafts, era transitions, ad views and purchases). We also send your account ID as the analytics user ID and a few gameplay properties such as forge level and VIP status, so we can see how progression works for real players. Crashlytics collects stack traces and device state when the app crashes.
2.3 Advertising (Google AdMob and mediation partners)
Forge Arsenal shows rewarded video ads only: an ad plays only when you tap a button that offers you a bonus for watching it. Ads are served by Google AdMob, which may hand the request to mediation partners, including Unity Ads and Liftoff Monetize (Vungle), and the demand sources listed in our app-ads.txt file. Ad SDKs may collect your advertising ID, IP address, device and network information, and information about the ads you view and tap. Where you have consented, this can be used to personalise ads; otherwise, ads are non-personalised. See section 6 for how consent works.
2.4 Purchases (Google Play Billing)
In-app purchases are handled by Google Play. Google processes your payment and shares with us only what is needed to deliver the item: the product, an order ID and a purchase token that we verify with Google before granting anything.
2.5 Notifications
Reminders such as "your offline vault is full" are local notifications scheduled on your own device. We do not run a push notification server and never send notifications from outside the app. You can turn them off in the game's settings or in Android's notification settings.
2.6 This website
This website is a static page. It sets no cookies of its own and runs no analytics. Fonts are loaded from Google Fonts and the trailer is embedded from YouTube's privacy-enhanced domain only after you press play; those requests are subject to Google's privacy policy.
2.7 What we do not collect
We do not collect precise location, contacts, photos, microphone or camera data, and we never ask for a password. We do not receive your email address unless you write to us.
3. How we use it
- To run the game: save and restore your progress, sync it across devices, run the Arena, seasons and leaderboards, and deliver what you buy.
- To keep it fair: validate progress server-side, detect modified clients and abuse, and rate-limit requests. Cheated progress hurts every honest player on the leaderboard.
- To improve the game: understand where players get stuck, tune the economy and fix crashes using aggregated analytics and crash reports.
- To show the ads you ask for: serve a rewarded video when you request one and verify that you watched it before granting the reward.
- To support you: answer your emails and investigate the problems you report.
We do not use your data for automated decisions with legal effects, and we do not sell it.
4. Legal bases (EEA and UK)
| Purpose | Basis |
|---|---|
| Running the game, saving progress, delivering purchases | Performance of a contract (the game's terms of use) |
| Anti-cheat, security, abuse prevention, server logs | Legitimate interest in a fair and secure service |
| Analytics and crash reporting | Legitimate interest in improving the game |
| Personalised advertising | Your consent, which you can withdraw at any time |
| Non-personalised advertising | Legitimate interest in funding a free game; only shown when you request a rewarded ad |
| Answering your requests | Legitimate interest, or a legal obligation where one applies |
6. Advertising and consent
If you are in the European Economic Area, the United Kingdom or Switzerland, the app shows Google's consent form (the User Messaging Platform) before any ad is loaded. Your choice decides whether ads may be personalised. If you decline, you still get rewarded ads, just non-personalised ones.
To change your choice later, you can reset your advertising ID or opt out of ads personalisation in your device's settings (Android: Settings → Google → Ads), or email us and we will help. Under US state privacy laws, personalised advertising through ad SDKs may count as "sharing" or "targeted advertising"; the same controls let you opt out.
7. What other players can see
Forge Arsenal has leaderboards and an asynchronous Arena. Other players can see your display name, your avatar and avatar frame, your hero power, your rank and season score, and, in Arena replays, the equipment, pets, mounts and skills your build fields. Pick a name you are comfortable with; you can change it in Settings at any time. Nothing else about you is shown to other players.
8. How long we keep it
- Account and game data: for as long as you play. If you ask us to delete your account, it is removed from our production database within 30 days and from backups on their normal rotation.
- Purchase records: as long as needed to restore your purchases and to meet our accounting obligations.
- Server logs: a short rolling window, typically no more than 30 days, unless a specific incident is under investigation.
- Analytics and crash data: kept by Google according to the retention settings of Firebase; user-level data expires automatically after Google's default period.
9. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it, restrict or object to how we process it, and withdraw consent where consent is the basis. Residents of California and other US states with privacy laws may also have the right to know what we collect, to delete it, and to opt out of "sale" or "sharing" (we do not sell data; see section 6 for ad personalisation). We will never treat you differently for exercising a right.
To exercise any of these, email [email protected] from the device you play on and include your display name; we will verify that the request comes from the account holder and answer within 30 days. Because a guest account is tied only to a random identifier on your device, we may ask you to confirm the request from inside the app.
If you are in the EEA or UK and believe we have not handled your data properly, you can complain to your local data protection authority.
10. Children
Forge Arsenal is not directed to children under 13 (or the higher age your country sets for consent to data processing) and we do not knowingly collect personal data from them. If you believe a child has created an account, email us and we will delete it.
11. Security and international transfers
All traffic between the app and our servers is encrypted with TLS. Progress is validated server-side, access to production systems is restricted to the developer, and secrets are never stored in the app. No system is perfectly secure, so we cannot promise absolute security, but we take incidents seriously and will notify you and the relevant authority where the law requires it.
Our servers and the providers listed in section 5 may process data outside your country, including in the United States. Where data leaves the EEA or UK, the transfer relies on the provider's Standard Contractual Clauses or an adequacy decision.
12. Changes and contact
When this policy changes we update the effective date at the top of this page and, for material changes, tell you inside the app. Questions, requests and complaints: [email protected].