Privacy Policy
In short: Ironvein collects what the game needs to run, to stay fair, and to get better. There are no ads, no ad tracking and no third-party analytics, and we never sell your data. You can export everything we hold about you, or delete it, from the game's Settings.
Who we are
Ironvein is made and operated by Kindlyf, a software studio in the Philippines ("we", "us"). We are responsible for your personal data under the Data Privacy Act of 2012 (Republic Act No. 10173). Questions and requests go to support@kindlyf.com.
What we collect
Your account
- A random account ID and a sign-in token. We store only a hash of the token.
- If you link a login: a username, and your password stored only as a one-way hash (Argon2). We cannot read your password.
- We do not ask for your real name, email address, phone number, birthday, photos or location.
Your character and progress
- Your character's name (generated for you unless you choose one), nation, weapon, level, items, currency, quests, achievements, settings and position in the world.
- Your guild and party, market listings, in-game mail, and a record of currency changes. We keep that record so the economy stays fair and we can fix mistakes.
What you send
- Chat is passed to other players as it happens. It is not stored on our servers. A short word filter runs on it first.
- Feedback you send from the game is stored with your character name, level, nation, weapon and where you were, so we can understand it. Player reports are stored so we can act on them.
Play statistics (you can turn these off)
To find out where new players get stuck, we record which steps of the game players reach and how long they play. Examples: seeing the front page, tapping Play, choosing a nation, entering the world, the first kill, levelling up, coming back the next day, and how long a session lasts. Before an account exists, these steps are tied only to a random ID that the game keeps on your device, plus whether the device is a phone, tablet or computer.
These statistics contain no names, contact details, IP addresses, browser details or device fingerprints. They are kept for 180 days. You can turn them off in Settings → Advanced → Share anonymous play statistics, which also deletes the device ID. If your browser sends a Global Privacy Control or Do Not Track signal, statistics start turned off.
War reminders (only if you turn them on)
If you turn on war reminders, your browser gives us a push address and keys from its push service (Google, Apple or Mozilla). We use them only to send reminders. They are deleted when you turn reminders off or delete your account.
Technical data
- Our servers see your IP address when you connect, as every website does. We use it only for a short time, in memory, to stop abuse such as too many requests, and we do not store it. Our hosting provider may keep standard network logs for a short period.
- On your device, the game stores your sign-in token, settings, HUD layout and the statistics ID (if statistics are on). It also keeps a cache of game files so it loads faster. We do not use advertising or tracking cookies.
Why we use it
| Purpose | What it uses | Basis |
|---|---|---|
| Running the game, saving your progress, multiplayer, guilds and the market | Account, character and progress | Providing the service you asked for |
| Keeping play fair and safe: stopping cheating, abuse and spam, handling reports | Progress, currency record, reports, IP (in memory only) | Legitimate interest |
| Improving the game: finding where players get stuck | Play statistics | Legitimate interest. You can turn it off at any time. |
| War reminders | Push address | Your consent, which you can withdraw |
| Answering feedback and support requests | Feedback and your messages to us | Legitimate interest |
Who sees it
- Other players see what a multiplayer game shows: your character's name, nation, level, look, guild, chat, market listings and places in the rankings.
- Railway (railway.com) hosts our servers and database and processes data only on our behalf. Your data may be stored and processed outside the Philippines, for example in Singapore or the United States, under safeguards that protect it.
- Push services (Google, Apple or Mozilla, depending on your browser) deliver war reminders if you turned them on.
- We share data with authorities only where the law requires it.
- We do not sell personal data. We do not share it for advertising, and Ironvein shows no ads.
Ironvein does not sell anything yet. When purchases arrive, payments will be handled by Google Play or a payment provider, and we will update this policy before then.
How long we keep it
- Your account, character and progress: until you delete your account.
- Play statistics: 180 days.
- Feedback and reports: kept with your account, and deleted with it.
- When you delete your account, we remove it from the live game straight away. That includes your character, currency record, mail, statistics, feedback, market listings and guild seat. Realm First records keep the deed but replace your name with "A former player". Copies in our hosting provider's backups disappear as those backups expire.
Your rights and choices
- See and download your data: Settings → Advanced → Export my data.
- Correct it: rename your character from the character screen, or write to us.
- Delete it: Settings → Advanced → Delete account, or email us from any address with your character name. See how to delete your account.
- Object to statistics: turn off "Share anonymous play statistics".
- Withdraw consent: turn war reminders off at any time.
- You can also complain to the National Privacy Commission (privacy.gov.ph). If you live in the EU or UK, you have similar rights under the GDPR, and you can contact your local authority.
We answer requests within 30 days, usually much sooner.
Children
Ironvein is not meant for children under 13, and we do not knowingly collect their data. Players can chat with people they do not know, so players under 18 should have a parent's or guardian's permission. If you believe a child under 13 has an account, email us and we will delete it.
Security
Connections use HTTPS. Sign-in tokens and passwords are stored only as hashes. Access to the database is limited to the developer, and the owner pages are protected by a secret key. No system is perfect: if a breach ever affects your data, we will tell you and the National Privacy Commission as the law requires.
Changes
If we change this policy, we will update the date above. If a change matters, for example new data or a new partner, we will say so in the game before it takes effect.
Contact
Kindlyf, Philippines. Email support@kindlyf.com.