Privacy Policy
Kingdom Ascend: Build & Battle · Last updated: 17 October 2026
This policy explains which personal data is processed when you play the mobile game Kingdom Ascend: Build & Battle (the "Game"), why, who it is shared with, how long it is kept and how you can exercise your rights. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Controller
The controller is the Game's developer CONAK SOFT LLC ("we", "us"). For any privacy question or request: destek@kingdomascend.com
2. How accounts work
When you open the Game it creates a random device identifier on your device, and our server creates an anonymous player account for it. We do not ask for your name, email or phone number. Optionally, you can link your account to a Google or Apple account to keep your progress across devices.
3. Data we process
| Data | Examples / content | Purpose | Legal basis |
|---|---|---|---|
| Device identifier and sessions | Random ID generated by the Game; only a keyed hash of your session token; session dates | Recognising your account, signing in, preventing abuse | Performance of a contract (GDPR Art. 6(1)(b)) |
| Player profile | Player name (chosen or generated), friend code, level, stars, power, trophies, profile card choices | Game features, leaderboards, friends and clans | Contract |
| Game save and in-game activity | Server copy of your kingdom save (buildings, resources, army, quests), battle/raid/exploration results, clan and league records, reward and event claims, daily session counts | Backing up and moving your save, cheat detection, game balance and aggregated statistics | Contract; legitimate interests (Art. 6(1)(f)) |
| Linked account (optional) | Google/Apple user ID (subject); your email address is not stored in plain text — only a keyed hash (HMAC) and a masked form (e.g. k\\\@g\\\.com) | Moving your progress to another device | Your request / contract |
| Purchase records | Product, price, currency, store order number, a hash of the purchase token, status. We never receive your card details — Google Play / the App Store handle payment | Delivering what you bought, verification, refunds and fraud prevention, accounting | Contract; legal obligation (Art. 6(1)(c)) |
| User content | Player name, clan name and description, preset phrases on the clan board, clan chat messages (up to 200 characters; visible to clan members only; profanity filter, links / e-mail addresses / phone numbers blocked; reported messages and their authors are reviewed by our moderation team) | Social features, moderation, abuse prevention | Contract; legitimate interests |
| Technical data | IP address (only in short-lived rate-limit counters and server access logs), client version | Security, abuse prevention, compatibility | Legitimate interests |
| Advertising data | Advertising ID (Android Advertising ID / iOS IDFA if you allow it), device and app information, approximate location (from IP) — collected by the ad SDKs | Showing rewarded ads, ad measurement and fraud prevention | Consent (consent form); without it, non-personalised ads |
| Analytics data | Google Analytics for Firebase: app instance ID, advertising ID (if you allow it), device model and operating system, in-game events (e.g. tutorial step, battle result, level, the ID of a purchased product). Events never contain your name, player ID, friend code, email or anything you type | Improving the Game, aggregated statistics, measuring ad campaigns (Google Ads conversions) | Consent (consent form); legitimate interests where consent is not required |
| Install source | Google Play install referrer (e.g. which campaign you came from) | Campaign rewards and measurement with marketing partners | Legitimate interests |
| Moderation records | Players / clans / chat messages you reported or that reported you, the report reason (fixed list), players you blocked, mute and ban records | Protecting the community, complying with store rules | Legitimate interests; legal obligation |
What other players can see: your player name, level, profile card, how your kingdom looks (visits and likes), your leaderboard positions, raid records and replays; clan chat messages are visible to clan members only.
We do not collect special-category data, precise location, contacts, photos, files, microphone/camera data or the SMS/email content on your device. The Game uses no push notification token; reminders are scheduled as local notifications on your device.
4. Third parties and transfers
We do not sell your data. It is shared only with these providers, for the stated purpose:
- Google Analytics for Firebase (Google) — analytics and ad campaign measurement; it only runs according to your choice in the consent form (Google).
- Google AdMob and the mediation networks Pangle and Liftoff (Vungle) — rewarded ads. These SDKs process the advertising ID and device data under their own policies: Google, Pangle, Liftoff.
- Google Play Billing / Apple App Store — payments and purchase verification.
- Sign in with Google / Sign in with Apple — only if you choose to link your account.
- Our hosting provider — servers and backups (as a processor).
- Marketing / referral partners — if you installed the Game through a partner campaign, the referral ID provided by the campaign and progress information such as the game level reached and the number/revenue of ads watched are sent to that partner so the campaign reward can be granted.
- Competent authorities where required by law.
Some providers are located outside your country (e.g. the USA, the EU), so data may be transferred internationally under appropriate safeguards (e.g. Standard Contractual Clauses) or your consent, as required by GDPR and KVKK Art. 9.
5. Ad consent and your choices
In the EEA, the UK and some US states the Game shows Google's consent form (UMP) on first launch. You can change your choice at any time in Settings → Privacy Options. The same choice controls data collection by Google Analytics for Firebase (no analytics data is sent before consent). You can reset your advertising ID or opt out of personalised ads in your device settings, and deny tracking on iOS. Ads are rewarded only and always optional.
6. Retention
- Account and game data: as long as your account exists. We may delete or anonymise accounts unused for more than 24 months.
- Sessions: expire and are deleted after 90 days without use.
- Clan chat messages: at most 30 days; each clan also keeps only its last 200 messages. The text of a reported message is kept with the report until the review is done (at most 90 days).
- Raid replays ("Watch": the battle seed, armies and commands): with the raid record; deleted with your account.
- Rate-limit counters with IP addresses: at most 2 days; server access logs: at most 30 days; security / anti-cheat logs (may contain an IP address and player number): at most 60 days.
- Analytics data (Google Analytics for Firebase): at most 14 months at Google; never linked to your player ID.
- Purchase records: for the period required by tax and accounting law (in Türkiye generally 10 years); if you delete your account they are kept without any link to you (anonymised).
- Backups: rotated and deleted within 30 days.
7. Deleting your account and data
- In the Game: Settings → Delete account → confirm by typing your friend code. Your account and server data are deleted immediately and the save on your device is wiped.
- Without the Game: at https://api.kingdomascend.com/account/delete you can sign in with your linked Google account and delete it, or send a deletion request (processed within 30 days).
Deleted: profile, device identifier, sessions, linked identities, save, friendships, clan/league/raid/exploration records, statistics, your clan chat messages, likes and visits, report and block records. Purchase records are kept anonymised as described above; contribution points you gave your clan stay in the clan's totals. The audit log of administrator actions is kept for security purposes.
8. Your rights (GDPR Art. 15–22, KVKK Art. 11)
You have the right to access, receive a copy of, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time. Send requests to destek@kingdomascend.com with your friend code; we answer free of charge within 30 days. You may also lodge a complaint with your data protection authority (in Türkiye the Personal Data Protection Board).
9. Children
The Game is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe this has happened, contact us and we will delete the account.
10. Security
Communication with our server is encrypted with HTTPS. Session tokens and email addresses are stored only as keyed hashes (HMAC), and access to the admin area is protected by two-factor authentication and an audit log. No system is perfectly secure; if a breach occurs we will notify you and the authorities as required by law.
11. Changes
We may update this policy. We announce significant changes in the Game; the current version is always on this page.