Privacy policy

This policy explains what information Realms of Kaira handles, why, and what you can do about it. It covers the game on the web at realms-of-kaira.pages.dev and the Android app (com.realmsofkaira.game), which opens the same game in Chrome. “We” and “us” mean Dream River Games, who make the game and are responsible for this information.

What is saved on your device

To remember your progress, the game stores in your browser (or, in the Android app, in the storage for this site of the browser the app opens the game in: your default browser, or Chrome once you have moved the game there to buy):

• Your progress: the achievements you have earned, the totals they count (such as bosses and champions defeated, crystals destroyed and lore read), the heroes and areas you have unlocked, which of the game’s tips you have already been shown and the last version whose “What’s new” notes you saw, and your settings (music on or off, sound volumes, camera zoom, screen shake, whether tips are shown, which of the gear panel and minimap are folded away, whether auto-target is on, difficulty, your chosen hero and appearance).
• An unfinished run, so you can carry on later: the level you reached, your hero, gear and upgrades, your health at the start of that level, and your play time.
• A finished run waiting to be submitted, only if you finish a run while signed out and choose to sign in to put it on the leaderboard: its kills, damage, time, hero and difficulty, kept while you sign in so you can submit it when you return. It is removed when you submit or discard it, and after two hours at most.
• Where the Android app opened the game: which browser, and whether Chrome is installed, so the game can tell you where Void Cataclysm can be bought. It is about the app, not you.
• A copy of the game’s own files, so it can start without a connection.

None of this leaves your device unless you sign in. To remove it, use CLEAR SAVED DATA under OPTIONS on the title screen, or clear this site’s data in your browser. In the Android app, Settings › Apps › Realms of Kaira › Storage opens the game’s data in the browser the app uses, where you can clear it.

If you sign in with Google

Signing in is optional. Its only purpose is to let the same progress follow you between devices.

What we receive

Sign-in takes place on Google’s own pages. Google then tells us a unique identifier for your Google account (the OpenID Connect “subject”). We request only the openid scope, so Google does not give us your name, email address, profile picture or contacts — we never see them.

What we keep with that identifier

• your progress and your unfinished run, as described above;
• when your account was first seen, and when each record was last updated.

This lives in our database (see who processes it) until you erase it.

Cookies

We use two cookies, both needed for sign-in, and no others:

• __Host-kaira_session keeps you signed in for up to 8 hours. It holds your account identifier and an expiry time, is signed so it cannot be forged, cannot be read by scripts, and is only ever sent to this site.
• __Host-kaira_oauth_state protects the hand-off to and from Google while you sign in. It lasts up to 10 minutes and is deleted as soon as sign-in finishes.

Leaderboards (optional)

Nothing appears on a leaderboard unless you are signed in, choose a name, and then submit a run.

• Public: the name you chose and, for each difficulty, hero and month, your rank, best kill count, best damage, fastest completion time, and which hero set them.
• Kept but not shown: how many runs you have submitted, and when your entries last changed.
• Please don’t use your real name, or anything that identifies you, as your leaderboard name.
• Scores are reported by your own device; they are not independently verified.
• Past months’ boards are kept, so they stay viewable.

REMOVE FROM BOARDS, behind the cog on your card at the foot of the leaderboard, takes your name and entries off every board at once. Your best scores are kept, so choosing a name again brings them back. To delete them as well, use erase everything.

Purchases in the Android app (optional)

Void Cataclysm is an optional purchase, sold only in the Android app through Google Play. Google takes the payment; we never see your card or other payment details.

• Each time the app starts, the game asks Google Play, on your device, which of its items you own. Nothing about that answer is saved.
• Google gives each purchase a purchase token. The game sends it to our server, which passes it to Google to confirm the purchase and to acknowledge it (Google refunds a purchase that is never acknowledged). A leaderboard run played as Vyrian is sent with the token too, so the server can check the purchase with Google before accepting the run.
• We don’t store purchase tokens, orders or anything else about a purchase, so nothing we keep ties a purchase to you or to your sign-in.

What we don’t collect

We don’t collect your name, email address, phone number, contacts, photos, location, advertising identifiers or device identifiers. The game has no advertising, analytics, crash-reporting or tracking code, and it loads nothing from other websites. The Android app adds none of these: it opens the game in Chrome, and adds only Google Play’s own purchase service.

Feedback and sharing are things you send yourself. “Send feedback” opens your own email app with a message to us already started, including the game’s version, the screen you were on and your device and browser as your browser reports them; you can change or delete any of it, and nothing reaches us unless you send it. If you do, we receive your email address and what you wrote, and use them only to read and answer it. “Share” hands a link, and for a finished run a picture of it, to your device’s own share sheet; the game sends nothing to us or to anyone else.

Who processes it

• Cloudflare, Inc. hosts the game, runs its server code and stores the sign-in database. Like any web host, Cloudflare handles your IP address and standard request details (such as your browser type) to deliver the site and protect it from abuse. We don’t store IP addresses in our database or use them to identify you. Cloudflare’s privacy policy.
• Google LLC provides sign-in, if you use it, distributes the Android app through Google Play, and handles any purchase made in it. Google’s own terms apply to your Google account and to Google Play. Google’s privacy policy.

We don’t share your information with anyone else, except where the law requires it.

Why we use it

Where data-protection law such as the UK or EU GDPR applies, our legal bases are:

• saving and syncing your progress and keeping you signed in — providing the service you asked for;
• confirming a purchase with Google — providing what you bought;
• leaderboards — your consent, given by choosing a name and submitting a run, which you can withdraw at any time;
• keeping sign-in and the service secure — our legitimate interest in protecting the game and its players.

How long we keep it

• On your device: until you clear it.
• Your account’s progress, leaderboard name and scores: until you erase them. Erasing takes effect immediately. We don’t currently delete inactive accounts on our own.
• An unfinished run: until you finish it, start again or erase it.
• Cookies: up to 8 hours and 10 minutes respectively, as described above.
• Cloudflare’s request logs: for the periods Cloudflare’s own policy sets.

Deleting your account and data

On the website or in the Android app:

• Everything we hold: sign in, open LEADERBOARD, press the cog on your card at the foot of it (or CHOOSE NAME, if you have no leaderboard name), choose ERASE MY CLOUD DATA, then ERASE EVERYTHING. This immediately and permanently deletes your progress, unfinished run, leaderboard name and every score from our servers, and signs you out.
• Just your saved progress: CLEAR SAVED DATA under OPTIONS on the title screen erases it on your device and, if you are signed in, from our servers too. Leaderboard entries are not affected.
• Just your leaderboard presence: REMOVE FROM BOARDS, behind the same cog.

Uninstalling the Android app does not delete anything held on our servers. Your Google account itself is Google’s to manage; we cannot delete it. Because we never learn your name or email address, we can’t look your account up from an email — the in-game control is the way to erase it. If you can’t use it, email us (including your leaderboard name, if you have one) and we’ll help.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to how we use it, and to withdraw consent. To use any of these, email us and we’ll reply within one month. You can also complain to your local data-protection authority.

Children

Realms of Kaira is not directed at children under 13. We don’t knowingly collect personal information from children, and signing in requires a Google account, which has its own minimum age. If you believe a child has signed in or joined a leaderboard, contact us and we will delete it.

Security

Everything travels over HTTPS. Sign-in cookies are signed and hidden from scripts, we never handle a password (Google does the signing in), and our database can only be reached through the game’s own server code.

International transfers

Cloudflare and Google run their services worldwide, so your information may be processed outside your country, under the safeguards those companies apply.

Changes to this policy

If this policy changes, we’ll update this page and its date. For significant changes, we’ll also say so in the game.

Contact

Dream River Games
dreamrivergamedev@gmail.com