01Who we are
Legion Roads is made and published by an independent developer, reachable at [email protected]. The game is distributed through Google Play. Our servers run in Germany, in the European Union, behind Cloudflare. Throughout this page, “we” means the developer of Legion Roads, and “the game” means the Legion Roads app and the services at legionroads.com that it talks to.
02What we collect
We collect what the game needs to run and to keep the ladder honest. We never see your real name, e-mail address or payment card through the game; the stores hold those. Here is what does reach us.
- Profile
- On first launch the game creates a guest profile on our server: a random public id, a display name (“Player” and a random code until you choose one) and sign-in tokens, which the server keeps only as hashes. No e-mail or password is asked.
- Google Play Games
- If you link Google Play Games, we receive the player identifier Google issues for this game and your Play Games display name, which we offer as your name when you sign in on a new phone.
- Progress
- Tutorial and provinces finished and on which difficulty, your armory (spell cards and levels), gold and gem balances with a record of each change, chests, and daily and weekly orders.
- Matches
- For each campaign attempt and every ranked match: the map, the random seed, the commands both sides sent, spell levels, the tick the match ended on, a hash of the final state and the result. The server replays these to verify the result. Ranked matches also produce your rating, rank and win/loss record.
- Purchases
- Google Play processes the payment. We receive the order id, product and time so we can grant the goods and check the receipt, and we give Google Play a one-way hash of your public id to tie the purchase to your profile. We never receive card numbers.
- Ads
- The daily tribute chest opens after a rewarded ad served by Google AdMob. AdMob receives your device’s advertising id and the usual ad-request data, together with your public id. Google then tells our server the ad was watched; we store its transaction id with your profile so the reward is paid exactly once.
- Network
- Every request carries your IP address, which Cloudflare and our server see. We use it in memory for rate limiting and do not store it in our database.
- Crash statistics
- The game sends no crash reports or diagnostics of its own. Google Play may show us aggregated crash and freeze statistics (Android vitals) from players who opted in on their device.
- If you write to us, we keep your address and message to answer you, and delete them when you ask.
03Why we use it
Profile and progress data keep your game where you left it, and on a new phone once you link Google Play Games. Match data verifies results and moves ratings. Purchase records grant what you paid for and let us honour refunds. Ad records pay the tribute reward exactly once. Your display name, rank and rating appear to your ranked opponents and on the leaderboard. Nothing is used to build an advertising profile of you, and we do not sell data to anyone.
04Legal bases
Where the GDPR or UK GDPR applies, we rely on performance of a contract for profile, progress, match and purchase data (we cannot run the game without them); on legitimate interest for fair-play verification and rate limiting; and on consent for personalised advertising, which AdMob asks for through Google’s consent form in the EEA, the UK and Switzerland. The tribute chest works with non-personalised ads if you decline. You can change or withdraw that choice at any time from Ad privacy on the game’s Settings screen.
06How long we keep it
Profile, progress, armory, rating and match data stay as long as your profile exists; match records then stay without anything that identifies you (see Deleting your data). Purchase and ad-reward records are kept for the period tax and store rules require. Nightly database backups are kept for fourteen days, so deleted data leaves them within that time. E-mail is deleted when you ask.
07Deleting your data
You can delete your profile yourself in the game: Settings → Account → Delete account, then confirm. It takes effect at once. Your display name becomes “Deleted player”, the link to your Google Play Games account and your sign-in tokens are removed, your public id is replaced, and your progress, armory, gold and gem balances, chests, orders and ladder rating are erased. Unspent gold and gems are lost and are not refunded. The game then starts over as a new guest.
If you can no longer open the game, write to [email protected] with the subject “Delete my Legion Roads account” and tell us the display name you play under and, if you linked it, your Google Play Games name. We confirm and delete within thirty days.
A few records stay after deletion, tied to an account that no longer identifies you: purchase and currency records and ad-reward records, which tax and fraud rules require us to keep, and match records, which are also your opponents’ history.
You may also ask for a copy of the data we hold about you, or ask us to correct it, at the same address. If you are in the EEA or UK you may complain to your data-protection authority.
08Children
Legion Roads is intended for players aged thirteen and over, and we do not knowingly collect personal data from younger children. If you believe a child has given us personal data, write to us and we will delete it.
09Security
All traffic between the game and our servers is encrypted. Access tokens last fifteen minutes; refresh tokens are replaced on every use and stored only as hashes, and reusing an old one signs out every session on the profile. Access to the production database is limited to the developer. No system is perfectly secure; if we learn of a breach affecting you, we will tell you through the game or the store as the law requires.
10Changes and contact
When this policy changes we update the effective date at the top and, for material changes, say so in the game before the change takes effect. Questions, requests and complaints go to [email protected].