1. Who this applies to

The online version of Godsiege for Android. It applies from the first time you open the game and choose to play online, until you delete your account and the retention periods in section 4 end.

The offline PC playtest creates no account and sends nothing to us.

2. What we collect

We keep an anonymous account. We do not ask for your real name, email address or phone number in the game. If you email us for support or deletion, we receive your email address and what you write.

Account id

A random id made by our server. It is not your Google or Play Games id.

Why: keep your village, purchases and settings together. Required.

Device id and device signal (hashed)

A random id made by the game, stored only as a SHA-256 hash. The app may also send a salted SHA-256 fingerprint of the phone's device id; we hash it again with a server secret (HMAC-SHA256) and keep only that hash, plus the date it was last seen. One row for each device that signed in.

Why: one anonymous account per device; sign-in; spotting one person on several accounts in clan war. Required.

Network signal (keyed hash)

At sign-in we take the IPv4 /24 network (the first three parts, for example 203.0.113.x) or the IPv6 /48 prefix, mix it with a secret key only our server knows (HMAC-SHA256) and keep only the result and the date last seen. The raw IP is never written to the game database. One row for each network you sign in from. The alt guard compares only rows seen in the last 7 days.

Why: clan war and island fairness. Two accounts on one network are flagged for a human to review, never banned automatically. Required.

Country

The store/billing country the app reports (Google Play Billing country code), or a store-signed proof when one exists. We do not use your IP to decide it, and it is not your exact location.

Why: open the game only in supported countries; local law. Required.

Age band

From the age screen: "13-13", "14-15", "16-17" or "18+", plus the date checked. A separate chat band ("13+" or "16+") is stored when you open chat. We do not store your birth year or month.

Why: age rules; world chat is 16+. Required.

Sign-in sessions

A hash of the session token, its expiry and the account it belongs to. Each token lasts 30 days; we keep your newest 10.

Why: keep you signed in; end a session on log out. Required.

Game records

Village, buildings, troops, resources, battles, battle commands, trophies and the resource/purchase ledger.

Why: run the game, settle battles on the server, stop cheating, show rankings. Required.

Purchases (only if you buy)

Google Play order id, product id, offer id, the price in US cents, the gems credited, a hash of the purchase token, refund/consumed/test state, pass start/end/daily-gem values, and the purchase, credit and refund times. We never see your card or Google account.

Why: credit what you paid for once; handle refunds; tax. Only if you buy.

Account tag (only if you buy)

A one-way hash of your account id, the same value for every purchase from that account, passed to Google Play as the obfuscated account id.

Why: tie a purchase to the right account without giving Google your game id. Only if you buy.

Unity IAP purchase telemetry (only if you start a purchase)

When you start a purchase, the Unity In-App Purchasing package (5.4.3) sends purchase start/paid/failed/fulfilled events to Unity Technologies at https://prd.insights.analytics.unity3d.com. Every event carries the product/SKU, price and currency, quantity, the device model, OS version, system language and locale list, boot time, total cache space, app bundle id and version, Unity and IAP versions, install time and install mode, a random Unity installation id and a session id. The paid/fulfilled event also carries the Google order id, the purchase token, and the Google order JSON (which can include the account tag) and signature; a failed event carries the failure reason and message. It is the SDK's own telemetry, not our game analytics. No advertising id is sent (this build has no ads consent).

Why: operate the purchase SDK, fraud prevention and product analytics. Only if you start a purchase. There is no in-app switch; the project-level Unity Developer Data setting can stop it.

Clan and world chat

Message text, sender account and Nakama user id, channel, time, a filtered/normalised copy, the masked original, severity, filter version and delivery status. Kept 30 days, then deleted. A reported message and up to five lines before it are frozen until a moderator closes the case, then deleted within 30 days after closing.

Why: clan and world talk; safety and moderation. Optional.

Chat reports

The message or player reported, the category, your comment (up to 300 characters), the message text and up to five lines of context, severity and the report status.

Why: safety and moderation. Optional.

Block list

The Nakama user ids you blocked (max 500) and when you blocked them.

Why: hide those players. Optional.

Social profile (Nakama)

Made only the first time you open clans or chat. Nakama is the open-source social server we run ourselves, on our own game server. It holds: a random user id and a random username nobody sees, an internal key that only our server can compute from your account (it contains nothing from your phone), your display name if you set one, your clan (name, description — empty in this build — and settings), your rank, join requests and membership history (join, leave, kick and role changes), your clan and world chat lines, your trophy count on the ranking, and the war-notice inbox messages sent to you. The app never talks to Nakama and never receives a Nakama login: every clan and chat action goes through our game server.

Why: clans, clan chat, rankings, war notices. Optional — nothing is made until you open clans or chat.

Push token (only if notifications are enabled and you allow them)

The FCM registration token of your phone (max 3 devices), the platform, the game language, your time-zone offset in minutes from UTC, the session that registered it, your 4 switches (war, defense, islands, clan) and when the token was created or updated. The token is made by Google Firebase Cloud Messaging for your phone and app. Notification records in the push queue: text keys and numbers, a link id such as a war or battle id, no names.

Why: send you the war, defense, island and clan notifications you chose — at most 5 a day, none from 22:00 to 08:00 in your time zone except the "1 hour left in the war" warning. Optional — nothing is stored until you allow notifications.

Usage events (analytics)

Event name, event version, a session id, your account id, the hash of your device id (the same hash as the account's device hash) and props that are numbers, booleans and short code words. The full list is in section 3.

Why: fix bugs, balance the game and measure features. Server facts are required; client usage events can be switched off.

Technical logs

Error codes, routes, HTTP status, account id, and for purchases the order id and a short token-hash prefix. App version and platform only when the client sends them. No raw IP is written by the game server; the front proxy keeps no access log.

Why: keep the service safe and running. Required.

Ban record and device block

The banned account id, the date, the end date (if any), a short reason code, the admin who set or lifted it, and the dates of a lift. A device is blocked only after 3 of the accounts that used it were banned; to do that we compare the keyed device-fingerprint hash, never the raw device id.

Why: keep bad actors out; a single ban never blocks a shared phone. Only after a ban.

Recovery code, device-moved note and Play Games link (hashes)

If you press "Create recovery code", the game shows you a code once; we store only a one-way hash and the date it was made. Using the code on a new phone moves your account there, ends your old sessions and uses the code up. A note ("this old device id: its account moved") is kept so the old phone is told instead of silently starting a new account. If the phone you move to already had a village, that old village is left behind under a dead device identity and is not deleted; delete that account separately if you can still access it. If you link Google Play Games, the app sends Google's serverAuthCode to our server; we exchange it with Google for your Play Games player id and keep only a one-way hash of it and the link date. We never receive your name, email or friends.

Why: get your village back on a new phone. Only if you create a code or link.

Display name

The name you type (filtered). The current build has no name screen and does not send one; this row applies only if a later version adds it. Clanmates would also see your Town Hall level and trophies next to it.

Why: clans, clan lists, rankings. Optional.

The game does not ask for your real name, email address, phone number, contacts, precise location, photos, microphone, advertising id or date of birth. We do not store a raw IP address in the game database, and we do not run ads. The age screen sends your birth year (and optional month) only to check your age; we keep the age band and the check date, not your date of birth.

3. Why we use it

Our own database; the game itself has no third-party analytics SDK. The purchase flow is the exception: Unity IAP sends its own purchase events to Unity Technologies (section 2); we do not receive that copy. Events: account created (country, age band); session start (created flag, and platform/app version only if the app sends them); tutorial step (step id, skipped yes/no); battles (type, stars, destruction, loot, trophies, duration); building and Town Hall upgrades; currency earned/spent (currency, source, amount); shop purchase start/complete/fail/refund (offer, price, gems, test flag); clan create/join/leave/transfer; war signup/attack/result/chest claim; island release/fresh claim; account ban/unban and account recovered; error codes and latency buckets. There is no session-end or shop-view event.

Events carry no IP, display name, birth date or chat text, but they do carry the account id, the device hash and a session id. Raw events are kept 13 months, then only daily totals without identifiers remain. Server facts (battles, purchases, clan/war/island actions, errors) are written to the same table and are not stopped by the usage switch.

Usage switch: Settings → Account → Privacy → "Send gameplay statistics" (on by default). Off stops the client usage events (tutorial steps and latency buckets) and stops the local anonymous telemetry log. Server facts such as battles, purchases, clan/war actions and errors continue; they are part of your account's game records.

4. How long we keep it

Account and game records

While the account exists. We never delete an account for being inactive: it is removed only when you delete it in game or ask us by email. On deletion, see section 8.

Clan and world chat, chat reports, ended mutes

Chat and ended mutes: 30 days. An open report is kept until a moderator closes it (then 30 days); a report can therefore be kept longer than 30 days.

Raw usage events

13 months, then daily totals without identifiers.

Purchase records

iap_purchases: while the account exists; after deletion, under a random tombstone for 5 years (default 1825 days), then a daily job deletes them. transaction_log and lucbao_ledger money rows are also kept indefinitely under the tombstone for accounting and are not removed by that job.

Unity IAP purchase telemetry

Not stored by us. Unity Technologies receives it when you start a purchase and keeps it under its Developer Data terms. We can forward a deletion request; the project-level Unity Developer Data setting can stop collection.

Network and device rows, sign-in sessions

One row per network/device seen, with the last-seen date, while the account exists; the alt guard compares only rows seen in the last 7 days. Sessions: 30 days each, newest 10. All deleted with the account.

Ban record and device block

Ban record: while the account exists; deleted with the account. The keyed device hash count of a banned account stays after deletion under a random tombstone id, so a banned person cannot reset a device block by deleting the account; a lifted ban removes its count. The device block row itself stays until an admin clears it.

Social profile (Nakama)

While the account exists; the Nakama user is deleted with the account (you leave your clan first and its leadership passes on). Chat lines in Nakama: 30 days (a daily job deletes older lines; a disbanded clan's chat is deleted at once; a large backlog may take a later run). War-notice inbox messages are stored in Nakama; there is no separate clean-up job for them.

Push token and notification switches

Until you log out of that device, are banned, delete the account, or turn all four switches off (all four off deletes the token). A token Google says is no longer valid is deleted by the server. Push queue records: 2 days; war-notice outbox: 3 days.

Recovery code hash, device-moved note, Play Games link hash

While the account exists; deleted with the account. A code is also deleted the moment it is used or replaced.

Request counters

In memory only, gone at restart.

Deletion request log

A SHA-256 hash of the account id, a SHA-256 hash of the request ticket, the request/grace/done dates, the status and the tombstone id: kept indefinitely as proof of the request; not used for gameplay.

Operator audit log

Admin name, action, tombstone id/ticket hash, old and new values: kept indefinitely for legal and audit purposes.

Job history

Job kind/scope, tombstone ref, status and last error: kept indefinitely for operations and debugging.

Anti-cheat review rows

Kind, war/island reference, clan ids, detail with tombstone ids: kept indefinitely for anti-cheat review.

Battle replays

Battle id, replay/offense text, content version and created date: kept indefinitely for game history. Replays contain layout, troops and commands, no account id or name.

Technical logs

A short operational period, rotated on the host. They are not used for advertising.

Offsite backups

14 daily + 2 weekly copies, so at most 30 days, when offsite storage is configured.

Local server dumps

7 nightly copies.

5. Who processes it

• Us, the individual developer who publishes Godsiege, for support, safety, moderation and bug fixing. Admin access is only through a private tunnel with a key.
• Our processors: the server host in Singapore, Cloudflare (traffic protection) and our offsite backup storage. They act on our instructions.
• Google Play Billing for purchases, under Google's own policy. We receive the order data and verify the purchase token with Google; we never see your card.
• Unity Technologies for the purchase events the Unity IAP package sends when you start a purchase (product, price, order id/purchase token, device and app info), under Unity's Developer Data framework. We do not receive this copy.
• Google Play Games, only if you link it: it receives the serverAuthCode and returns your player id; we keep only its hash.
• Google Firebase Cloud Messaging, only if push is on and you allow it: it receives your push token and the notification text to deliver it to your phone, as our service provider, under Google's own policy.
• Nakama runs on our own server, not at a third party. It is the social server for clans, chat, trophies and war notices.
• Other players see: your display name (if set), trophies, clan name/description, clan role and member list, battle results, your base layout when they attack you in PvP or clan war, your battle replays to your clan/opponents, your clan and world chat lines, and notes/flags you post.
• Authorities, if the law requires it.

We do not sell your data and do not share it for advertising.

6. Your rights

You can ask us to:

• Access a copy of the data we hold about you.
• Correct data that is wrong (for example your country or age band).
• Delete your account and data, as described in section 8.
• Restrict or object to a use, and withdraw consent for optional things (usage events, notifications, Play Games link).
• Port your account and game data in a machine-readable file.
• Complain to your data protection authority.

Ask by email at godsiege.support@gmail.com. We answer within 30 days (45 days in California). We will not treat you worse for using these rights.

Legal bases: contract (run your game), legitimate interest (safety, anti-cheat, analytics with identifiers), legal duty (tax), consent (optional usage events, notifications, Play Games link).

• EU / EEA / UK (GDPR / UK GDPR): the rights above, plus a complaint to your national authority. Our server is in Singapore; we collect your data directly from you in the game and process it there.
• California (CCPA/CPRA) and other US states: right to know, delete and correct. We do not sell or share personal data for ads, so no "do not sell" opt-out is needed.
• Brazil, South Korea, Japan, Canada, Australia, others: the same access, correction and deletion by email, and a complaint to your local authority.
• Vietnam: online play is not open there yet; this text will be updated before it opens.

7. Children and age

• 13+ in most countries.
• 16+ in the EU/EEA, the UK and Switzerland.
• 14+ in South Korea.
• World chat is 16+.

The age screen runs before an account is created. The server checks your country and age; if you are too young it refuses and no account is created and no age band is stored for you (a short technical log of the refusal may keep the error code and country, never your birth year). Online play is not open in every country; if your country is not open, the game says so and you can still play offline.

We do not knowingly keep data about children below these ages. If you think a child has an account, write to godsiege.support@gmail.com and we delete it. The game sells real-money items; parents can use Google Play parental controls.

8. Deleting your account

In the game (7-day grace):

1. Open Settings.
2. Open Account.
3. Press Open next to Privacy.
4. Press Delete account.
5. On the confirmation page, hold Hold to delete for 2 seconds. Let go to stop.

The request waits 7 days. During those days the panel shows "Deletion pending: N days left" and a Cancel deletion button; signing in again also cancels the deletion. After 7 days the purge runs. You must be signed in to online play to use this button.

By email (no 7-day wait): write to godsiege.support@gmail.com with the subject "Account deletion". Give your recovery code (the best identifier) or your player name, the country you played from, and roughly when you started. Do not send a password (there is none) or payment details. We may ask for proof only the account owner has. We answer within 30 days and start the same purge as soon as we can identify the account; an email request does not wait 7 days.

What is deleted after the grace period:

• the account row and its random id;
• the village and its save;
• sessions;
• country and age band;
• the chat profile;
• notes you posted on clan-war or island marks;
• all your chat lines in our database and in Nakama;
• chat reports about you; in reports you filed, the evidence about the other player stays but your comment and id are removed;
• mutes and blocks;
• analytics events and the server-side analytics switch;
• network and device link rows;
• push tokens and switches;
• the recovery code hash and the Play Games link hash;
• your clan membership (you leave your clan; the clan stays and its leadership passes to another member);
• the Nakama user.

The deletion request log keeps the account id and request ticket only as SHA-256 hashes, plus the dates, status and a random tombstone id.

What is kept, and why:

• Purchases: iap_purchases under a random tombstone id for 5 years (1825 days), then a daily job deletes them. Reason: tax, refunds and accounting.
• Unity IAP purchase telemetry: not held by us. Unity Technologies' copy is not deleted by our purge; see section 4.
• Money ledger: transaction_log and lucbao_ledger rows under the tombstone, for accounting. They are kept indefinitely; the purchase-retention job does not remove these rows today.
• War and island history: war members, attacks, results, chest claims, island battles and weekly clan points stay under the tombstone. The village save copy is cleared, and the battle army/result and island snapshot/command/stream fields are cleared where the purge can; war-member base snapshots and war-attack command/stream rows can remain. These rows carry a random tombstone, not your account id. Reason: game history and fairness for the other clan.
• Battle replays: battle id, replay/offense text, content version and date. Replays contain layout, troops and commands, no account id or name. Reason: game history.
• Deletion request log: a SHA-256 hash of the account id, a SHA-256 hash of the ticket, the dates, the status and the tombstone id. Reason: proof that we carried out the request and to avoid repeat requests.
• Operator audit log: admin name, action, tombstone id/ticket hash and old/new values. Reason: legal and audit.
• Job history: job kind/scope, tombstone ref, status and last error. Reason: operations and debugging.
• Anti-cheat review rows: kind, war/island reference, clan ids and detail with tombstone ids. Reason: anti-cheat review.
• Banned device: the keyed device-fingerprint hash and the device-block row stay after account deletion. A device is blocked only after 3 banned accounts used it. Reason: a banned person cannot reset a device block by deleting the account.
• Backups: copies made before the deletion expire on their own within 30 days. If a backup is ever restored, the operator must re-apply the deletion before the game reopens; this is a manual step, not automated code.
• Technical logs: kept until the host rotates them.

Deleting the app does not delete your account. The offline save on your PC is separate and is not affected by deleting the online account.

Step-by-step deletion page: Delete your account.

9. Local files on your device

The online Android build keeps these files in the app's private data folder:

• server-session.json: your account id, the session token, its expiry and country.
• device-id.txt: the random device id.
• analytics-switch.json: account ids whose usage switch is off, and whether the change reached the server.
• push-permission.json: whether the notification permission was asked, consented and granted.
• recovery-created.txt: when a recovery code was made.
• online.flag: whether online play is on (development and playtest builds).
• telemetry/: an anonymous local log (at most 7 days and 5 MB) with a random install id, a session id, event names, game parameters, device model, RAM, OS, screen size/dpi, language, app version and filtered error records (exception type, a one-way fingerprint and up to five stack frames). It is never uploaded. The same switch as the usage switch turns it off; off also deletes the folder.
• Unity PlayerPrefs: the telemetry install id, first-seen time, opt-in flag and first-time event flags, plus the Unity Services installation id and session id (unity_connect.installation_id, unity_connect.session_id) used by the IAP package. The game does not read these two ids.

The PC build's local files are listed in the offline policy.

Deleting your online account does not delete these files. Clear the app's data or uninstall the game to remove them.

10. Security

HTTPS only. The server decides every game result; the app cannot write your village. Session, purchase and recovery tokens are stored only as hashes. The FCM registration token is stored as given because Google needs it to deliver your notifications. Secrets stay outside the code. No public database ports. Nightly checked backups. No system is perfect: tell us if you find a problem.

11. Contact and changes

Operator: the individual developer of Godsiege (Viet Nam).
Privacy contact: godsiege.support@gmail.com.
Deletion page: https://godsiege.io.vn/delete-account/.
EU/UK representative: none appointed at this time; please write to us by email.

For a change that matters we show a notice in the game before it applies. This version is dated 31 October 2026.