Privacy
Privacy policy
In short: we keep a game account under a random id: a player name, a collection, decks, match history and your settings. We never read or keep your email address or real name from the service you sign in with; we keep a one-way hash of its identifier and nothing else. There are no ads, no analytics, no tracking, no cookies on this website, and nothing is sold to anyone. You can delete your account from the Profile page in the game, and you can write to support@ironember.net to see, export or delete what we hold.
Who we are
Iron & Ember is developed and operated by Christopher Quenneville (“we”, “us”), who is also the person responsible for protecting your personal information. For anything about your data, write to support@ironember.net.
What we collect, and why
The game needs an account so that your name, your collection and your decks follow you between devices and so that a match can be recorded fairly for both players. Everything below is kept on our own server, under a random account id that is derived from nothing about you.
| What | Why |
|---|---|
| A sign-in identity: Google, Apple or a personal Microsoft account, on any device, and on a computer that has signed in with none of them a random key the game makes for that installation; Steam when it is offered | To find your account again. A provider gives the game a signed token; our server verifies it, keeps a one-way hash of its subject identifier, and discards the token. A computer's key stays on that computer, and the server keeps only a one-way hash of it. We never store a provider's token, and we neither read nor keep your email address, your real name or your picture, whether or not the provider puts them in it. |
| Your player name, title, picture and favourite factions | Your name is public: opponents see it across the table, in lobbies and in their match history. It has to be unique, and it goes through a word filter. The picture is a card from the game. |
| Play data: matches played and won, and a history list of your last 50 matches showing your opponent’s name and whether the opponent was a bot. Each match also has a record of its own with the play-by-play, which is what the history list opens. A record holds the two players’ names and account ids, the decks they played and every move, and nothing else about either player | So you can read your own matches back, so that a result is paid out from the server’s record rather than from anything a device claims, and so that a disputed result or the balance of a card can be checked against what actually happened. |
| Your collection: Ember Stones, the cards you have forged, unopened card packs and the decks you built | It is the game. It is kept on the server so it cannot be lost with a device or edited on one. |
| Settings per kind of device: graphics, sound, language, which music tracks you skip | So a reinstall or a new phone gets them back. Stored as the plain key-value text the game sends; we do not read them for any other purpose. |
| When the account was created and last seen | Housekeeping. |
| Technical logs on the server | To keep the service running and to find faults. They are kept for up to 30 days and are not used to profile anyone. |
| Your age: the month and year you were born, asked before you sign in | To check you are old enough to play where you are: 13, or 14 in Quebec, Peru and South Korea. Your answer is kept on your device and sent with each connection; our server compares it with the minimum where your connection comes from and keeps nothing of it, except that for a player under 18 it keeps the year they turn 18 (and treats them as under 18 until that year ends), so that the game keeps a younger player’s defaults (it never pairs them by where they are). If you are under the minimum, the game tells you so and sends nothing at all. On a phone, the store's age range: where Google Play or the App Store shares one (for example 13 to 15), the game asks for it and sends it with each connection too, and our server holds you to the younger of the range and your own answer, keeping nothing of the range either. Where the law has the store confirm ages, as in Texas and Brazil, you can play once the store has confirmed yours. |
| Reports you make about other players, and the players you block | When you report a player, we keep who made the report, the name and account reported, the reason you chose, the match it was about and when. A person reads it to decide whether a name or a player breaks the rules. Reports are kept for one year, including after an account is deleted. The players you block are kept with your account, so that the game keeps you apart, until you unblock them or delete your account. |
| A moderator’s change to your name | If a moderator changes a name that breaks the rules, your account keeps why and when, the old name stays reserved so nobody else can take it, and the game tells you why. You can appeal by writing to support@ironember.net. |
| Problems you report from the game | When you use Report a problem, we keep what you wrote with your account’s id, the match you were in if you were in one, the game’s version and build, and your device’s operating system. We read it to look into the problem. It is kept for one year, including after your account is deleted; write to us if you want it removed sooner. |
| Crash and fault reports from the game | When the game stops on an error, the next time it connects it sends a short report: what failed, where in the game’s own code, the game’s version and build, and your device’s operating system and its version. It also sends counts of things that went wrong since it last connected, such as a board that would not update or an update that failed. Neither names you, and neither is kept with your account. They are kept for up to three months, to find and fix faults. |
What we do not collect
- No email address, real name, full date of birth, contacts, photos, precise location or advertising identifier, from you or from the service you sign in with. The month and year the game asks you for stay on your device; the server keeps only, for a player under 18, the year they turn 18.
- No analytics or tracking software in the game or on this website, and no advertising of any kind. The crash and fault reports above are the game’s own, sent to our own server, and are used for nothing but fixing the game.
- No cookies of our own on ironember.net. The website is static pages. It keeps two things in your own browser, and neither is ever sent to us: the language you picked in its menu, so it opens in that language next time, and any decks you make in its deck builder.
- No payment details. The game currently has no real-money purchases at all: Ember Stones are earned by playing, and they are spent inside the game on card packs, on forging cards and on how a player looks at the table.
Where it lives
Your connection to the game goes to Cloudflare, at the Cloudflare location nearest you, and a match is held on Cloudflare’s network, near its players, while it is being played; the game’s rules work out its moves there too. What your account asks of the game, such as signing in, opening card packs and saving decks, is answered on Cloudflare’s network in eastern North America, and the database that keeps your account and your match history is there too, and your account is also copied to Cloudflare’s network in western North America so that you can still sign in and play if eastern North America cannot be reached. This website and its pictures are served by Cloudflare. Cloudflare handles your connection and therefore processes your IP address to deliver the service and to protect it from attacks; we do not keep IP addresses ourselves beyond the technical logs above. A backup copy of the accounts is also kept outside Cloudflare, by Backblaze in Canada, so that the game can be restored if Cloudflare cannot be used: it is made every night and as each account changes, each copy is locked so that nobody can delete or change it early, and every copy is deleted within 30 days. Backblaze also keeps a copy of the match records, for as long as the game runs as they are here, and of the problems and player reports you send, for up to a year.
To pair you with an opponent near you, which makes a match quicker to answer for both players, the game uses the rough area your connection comes from, as Cloudflare estimates it from your IP address, rounded to about a hundred kilometres. It is held only while you are connected and waiting for a match, it is used for nothing else, and it is never stored with your account. For a player under 18 it is not used at all.
If you are in the European Economic Area, the United Kingdom or Switzerland, using the game means your data is transferred to North America. That transfer is covered by the Standard Contractual Clauses in the data processing terms of Cloudflare, Backblaze, Microsoft and OVH, which we are a party to as their customer.
Why we are allowed to
If you are in a place whose law asks us to name a legal basis, these are ours. We keep your account, your collection, your decks, your settings and your match history because that is the service you asked for: it is our contract with you, and the game cannot do any of it without them. We keep the name filter, the technical logs and the checks that stop a client forging its own rewards on the legitimate interest of keeping the game fair and the server standing. We keep match records after they leave your list on the legitimate interest of keeping an accurate record of games that two people played, for settling a disputed result and for balancing the cards. We do not process anything for advertising, profiling or any purpose you have not asked for, so there is nothing here that rests on consent.
Who else is involved
- Sign in with Google, Apple and Microsoft (and Steam when it is offered): the provider’s own privacy policy governs what it does when you sign in with it. We receive a token and keep only a hash of its identifier, as described above. Microsoft is asked only to sign you in, so its token carries no name and no email address.
- Google Play and the App Store distribute the phone builds under their own terms, and may tell us aggregate figures about installs; they do not tell us who you are.
- Cloudflare carries every connection to the game, holds matches and plays their moves while they are played, runs the rest of the game’s rules, keeps the accounts’ database, the crash and fault reports and the problems you report, and serves this website.
- Backblaze keeps the backup copy outside Cloudflare, in Canada: the accounts’ database as it stood each night, and each change to an account as it is made, each copy locked against deletion for 26 days and deleted within 30; and the match records, for as long as the game runs, and the problems and player reports, deleted within a year.
- OVH hosts the computer, in Canada, that we run the game’s operating tools from. When we look into a report or a problem, or restore an account from a backup, the data passes through it while we work.
- Microsoft hosts our email: what you write to support@ironember.net, and the copy of a problem you report that the game emails to us, are kept in that mailbox.
We do not sell, rent or share your data with anyone else, and nothing here is used for advertising.
How long we keep it
Your account is kept for as long as you have it. Your own history lists your last 50 matches, and older entries drop off that list on their own. The record of a match, with its play-by-play, is kept for as long as the game runs: it belongs to both players rather than to one account, it stays readable from each player’s history while it is listed there, and it stays on the server after it has left both lists. Technical logs expire within 30 days, crash and fault reports within three months, and reports about players and problems you report within one year; the copy of a problem that the game emails to us stays in our mailbox until we delete it, and we delete it on request. When you delete your account, the account, its sign-in links and sessions, profile, collection, decks, settings and history list are deleted, and any backup copies expire within 30 days. The records of matches you played remain, showing the player name you used at the time and nothing else about you.
Your rights
Wherever you live, you can ask us to show you what we hold about your account, to give you a copy of it, to correct it, to limit or object to how we use it, or to delete it. You can delete your account yourself from the Profile page in the game, and you can download a copy of what we hold for it, or delete it, on this page by signing in; for anything else, write to support@ironember.net, or follow the steps on deleting your account. Because we hold no email address for you, we will confirm that the account is yours before acting on an email, and we answer within 30 days. Depending on where you live (for example the EU, the UK, California, Canada or Peru) the law may give you further rights.
Complaints. If you are unhappy with how we have handled your data, write to support@ironember.net with “Complaint” in the subject. We acknowledge a complaint within 30 days and tell you what we did about it. You can also complain to your data-protection authority at any time, for example the ICO in the UK, your country’s authority in the EU, the Commission d’accès à l’information in Quebec, the Office of the Privacy Commissioner of Canada, or Peru’s Autoridad Nacional de Protección de Datos Personales.
Decisions made by software
Nothing about you is decided by software in a way that has a legal or similarly significant effect on you. The name filter refuses some names on its own; if it refuses yours and should not have, write to us. The age check refuses an account to a player under the minimum age where they are, from the month and year they gave and, on a phone, the age range their store shares.
Children
Iron & Ember is not for children under 13, or under 14 in Quebec, Peru and South Korea, and we do not knowingly collect personal data from them. Before anyone signs in, the game asks the month and year they were born, with nothing chosen for them; a player under the minimum is told so, nothing is sent and no account is made. On a phone, an age range the store shares counts too. Players aged 13 to 17 are never paired by where they are. If you believe a child has an account, write to us and we will delete it.
Security
Every connection to the server and to this website is encrypted. Sign-in identities are stored as one-way hashes, a sign-in session lasts 30 days and is renewed each time you play, for 90 days at most, and what an account holds is decided on the server.
If something goes wrong. If your data is ever read, changed, lost or deleted by someone who should not have been able to, we tell the authorities the law names within the time it sets (72 hours in the EU and the UK, 48 in Peru), and we tell you on this website, in the game’s release notes and, once it exists, in the game.
Changes
If this policy changes, the new version is published here with a new effective date. A change that matters to you will also be announced in the game.