Legal document

Privacy Policy

Effective date: 25 October 2026 · Wersja polska

Translations (the English version prevails): Deutsch · Español · Français · 한국어 · Português (Brasil)

Glowkyn is a game for Android, currently in testing. Below we describe the data processed when you use the game, including its test features.

What data we process

• Account: the Firebase account identifier and authentication data. You can start with an anonymous account; if you choose Google sign-in or link your account to Google, the basic data shared by that service, such as your e-mail address and account name, is processed as well.
• Age: on first launch the game asks for your birth month and year; we store them on the device and with your account. Where Google Play provides an age signal, we also receive the age range of the Google Play account. They are used only to suit the game to your age: the kind of ads, access to community features, Google sign-in and purchases.
• Country: the country of your Google Play account, which the game reads at launch from the Google Play billing service — without access to the device location — or, if Google Play does not provide it, the region set on your device. We store it with your account. It is used to follow the rules of your country. When a purchase is verified, Google Play also tells us the billing country of that purchase. In Profile you can choose a different game country (at most once every 28 days); the game country — or, without a choice, the account country — is stored with your season points and counted in the Country Cup, which shows only combined results of countries (the average points and the number of players, for a country only from 30 players in a season), never the result of a single person. The game country does not change which purchases are available. By default we do not show it to other players. A teen or an adult can turn on “Show my country” in Profile: friends then see a flag next to the nickname, players with the same game country see your result on the “My country” list in rankings (under the in-game name, or under your nickname if they are your friends), people who receive your gifts see a stamp of your country, and players who can invite you from a ranking list or see your card in Meet players see a flag with the country name. You can turn the switch off at any time, and the country disappears from these places at once. We do not pass the country to Firebase Analytics.
• Time zone: the name of the time zone set on your device (such as Europe/Warsaw), which the game reads at launch and when you change the game country — without access to the device location. We store it with your account when the account is created or, if the account does not have it yet, at the first launch after a game update, and we change it only together with the game country in Profile (at most once every 28 days). It is used only so that a new day in the game starts at 4 a.m. and a new week on Monday at 4 a.m. in your time. We do not show it to other players, and we delete it together with your account.
• Game progress: your profile and chosen portrait, owned creatures and cosmetics, coins, history of calls in the Portal, daily pools, progress in tasks, expeditions, events and the Realm Trial, and the data needed to confirm rewards and synchronise your collection.
• Community: if you publish a player card, we process your nickname, chosen portrait, active title and invite code, as well as your friends and invitations, the number of days you played together with each friend (friendship level), your contributions to shared builds, your companion for friends, sanctuary reactions, the list of people you block, and reports you send or that concern you. Your nickname is visible to the people you invite, and your card with the portrait to your friends. Before publishing you accept the community rules; we store their version and the time.
• Wishlist: if you pick a shopping goal in the Shop, you can show it to your friends on your player card as your wishlist (the thumbnail and name of a cosmetic you don't own yet) — then they can give it to you as a gift; once you receive it, the goal is cleared. This is the “Show the wishlist to friends” switch in “Card style”: on by default for teens and adults, and off for children and players of unknown age. The wishlist is not on the shareable player card image or on your card in Meet players.
• Meeting players: a teen or an adult with a published player card can turn on “Invites from rankings” in Friends (on by default for adults, off for teens) and “Show me in Meet players” (off by default). When both people have invites from rankings on, they see an “Invite” button next to each other in the Lantern Ranking and in the Trial: the invite sheet shows the in-game name from the ranking, the place, the Lantern level and — if the person shows their country — a flag with the country name, and the invite itself shows the recipient only the sender's nickname. If you turn on “Show me in Meet players”, players in your age group see your card on that list: nickname, portrait, active title, Lantern level, number of forms, Collection Power and — if you show your country — a flag with the country name; we do not show when you last played. Adults see and invite only adults this way, and teens only teens. There is no chat and there are no messages. You can report or block every card and every invite from a list. You can turn both settings off at any time, and your card leaves the list at once. For this we keep a copy of your card data on the server, which we delete when you turn the switch off, withdraw your card or delete your account.
• Notifications: if you turn them on, we process the Firebase Cloud Messaging device token, the game language, your time zone offset and the notification types you chose. They are used to send at most one notification a day, never at night. You can turn notifications off in the Profile or in the system settings. The Live expedition — a silent notification with a countdown to the return of a running expedition, for teens and adults — is created on the phone from game data: we do not send it through the server and collect no extra data for it. You can turn it off in the game's notification settings.
• Purchases: if you buy cosmetic packs or the Season Pass on Google Play, we process the product identifier, the state and the transaction identifier needed to verify a purchase, deliver its contents and avoid granting them twice; for the Keepers' Circle subscription (adults only) also its state, its renewal or end date and a hash of the purchase token, kept up to date by Google Play notifications. Payment card data is handled by Google Play, not by the game. Real-money purchases are off by default on every account; a grown-up turns them on in Settings. The draw packs the game offered during testing are no longer sold. A purchase of such a pack still pending on Google Play is verified under the previous rules: it is not granted when the billing country of the purchase (or, if Google Play does not provide it, the account country) is one where we did not offer paid draws, or when the pack exceeds the former weekly limit of paid draws — Google Play then refunds it; otherwise it is granted.
• Google Play Games: when the feature is available in the game, a teen or an adult can connect the game to Google Play Games Services — automatically when the phone already has a Google Play Games profile, or with the “Connect” button in Settings. Once connected, the game sends achievement progress to Google (which feat thresholds from the Feat Album have been reached), and the Google Play Games profile and its data are covered by the Google Privacy Policy. The game does not receive Google Play Games profile data (such as the player name or ID) and does not link the profile to the game account. Google Play Games rewards (cosmetics granted by Google) reach the game through Google Play like a purchase: we process the product and transaction identifiers to grant the cosmetic only once; you pay nothing for them. For children and players of unknown age, the game does not start Google Play Games Services and sends them nothing.
• Rewarded ads: if they are available and you decide to watch a Google AdMob ad, the event data and identifiers needed to verify the reward are passed to the advertising services and the game server. Where the law requires it, the Google consent platform asks before the first ad for your consent to use data for advertising purposes; you can change your choice in the Profile, in the “Ad privacy” row. Watching ads is never required to use the free calls in the Portal. Players under 18 see ads without personalisation, and children under 13 see only ads intended for children, without the advertising ID. When the game loads or shows an ad, the Google Mobile Ads SDK on the phone — at every age, including with ads for children — collects and passes to Google the device's IP address (which can be used to estimate approximate location), the App Set ID (an identifier for one publisher's apps on this device), information about interactions with the ad (such as a view or a tap) and diagnostic data of the ads SDK. Google uses them to show ads, for measurement and to prevent fraud. Each time you enter the game, the Google consent platform checks whether consent is needed — at every age, even when no ad is loaded — and receives the device's IP address in doing so.
• News and codes: when you claim a treat from the “Glade news” or enter a treat code, we store on your account which treat was claimed and when (with the in-game card or a code), and for wrong codes the number of failed attempts on that day, to limit guessing. We store codes only as a hash (SHA-256), never in plain form; for a one-time code we also store a hash of the identifier of the account that used it. Claims and the attempt counter are deleted together with the account, and the account identifier hash is then removed from a used one-time code. News and treats are the same for everyone and never require following or liking the game’s social media profiles; the game does not connect to these services and sends them nothing.
• Tester feedback: during the game's test before it is available to everyone, an adult can send a note with the “Send feedback” button (up to 1,000 characters and 10 notes a day). We store the text of the note, the game version number, the screen name (without identifiers), the game language and the day of the tester week — without any account or device identifier. For the limit we store on the account only the number of notes sent in the last day and the time of the first one; it is deleted together with the account. Please do not include names or email addresses in notes. Only the game team reads the notes, and they are deleted automatically after 180 days.
• Technical data and measurement: app or device identifiers, App Check signals, diagnostic data and error reports serve security and stability. Firebase Analytics records game events (such as a call in the Portal, a completed collection or a purchase) and their parameters, and Firebase Crashlytics helps diagnose crashes. Where the law requires consent, Analytics does not use data for advertising purposes until you give it. Analytics does not collect the advertising ID, collects nothing before you enter your age, and collects no data at all from children under 13. App Check uses the Google Play Integrity service: when the game starts and when the protection is renewed, Google Play checks that this is the unmodified app from Google Play on a genuine device. For this it processes the app's package name, version and signing certificate, the Google Play licence status and device attestation data, and the game server receives only an App Check token with the result of the check. This happens at every age and protects the game and accounts against abuse.

Why we use the data

We use this data to run your account, save and synchronise progress, verify Portal calls, rewarded ads and purchases on the server, provide and moderate community features, send notifications, protect against abuse, measure how the game works and fix errors. We do not sell personal data.

Third-party services

Glowkyn uses Google services: Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Cloud Messaging, App Check (with Google Play Integrity), Analytics and Crashlytics, as well as Google Sign-In, Google Play Billing, Google Play Games Services, Google AdMob and the Google User Messaging Platform consent platform. The providers of these services may process data under their own terms. More information: Google Privacy Policy and Privacy and Security in Firebase.

Retention and deletion

Account data and progress are kept while you use the account. You can delete your account and the player data linked to it from the Profile in the app; this cannot be undone. Deleting the account also removes your player card and your Meet players card, friendships, blocks, notification tokens and reports that concern your account, and removes your identifier from the reports you sent. Independent Google Play purchase verification records may remain as a billing trail after the account is deleted, and technical records of ad confirmations expire after 7 days. Data processed by third-party services is also subject to the terms of those services.

Your rights

You can ask for access to your data, for its correction or deletion. If you cannot use the account deletion option in the Profile, contact us through the Help and contact page. This also applies to an anonymous account.

Children

Glowkyn is for everyone, children included. When the age screen or the Google Play age signal shows that a player is under 13, we show only ads intended for children, without the advertising ID and without personalisation, and Firebase Analytics collects no data. Publishing a player card with a nickname visible to friends, Google sign-in and account linking, and purchases on Google Play need a grown-up's permission in the game, and before a card is published we remind the player not to share their full name, address, school or phone number. Real-money purchases are off by default, and a child's wishlist is hidden from friends by default. We do not show a child's country to other players — not next to the nickname, not on “My country” lists and not on gift stamps — and it counts only in the combined results of the Country Cup. Children and accounts without a known age never appear on ranking invite lists or in Meet players and do not invite from lists — they add friends with an invite code. Children and accounts without a known age do not connect to Google Play Games and do not get the Live expedition. A parent or guardian can delete the child's account in the Profile or ask for access to the child's data, its correction or deletion through the Help and contact page. Sharing a picture from the game (for example a postcard or a discovery) through the phone’s system share sheet requires an adult’s consent in the game for children and when the age is unknown; previewing the picture does not, and the game never sends anything by itself. If the game shows its social media profiles, a child opens them only after an adult’s consent.

Changes

We publish the current text and the effective date of this policy on this page.