Privacy Policy

Kingdom Forge: Build & Battle · Last updated: 13 October 2026

This policy explains which personal data is processed when you play the mobile game Kingdom Forge: Build & Battle (the "Game"), why, who it is shared with, how long it is kept and how you can exercise your rights. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Controller

The controller is the Game's developer CONAK SOFT LLC ("we", "us"). For any privacy question or request: (contact email coming soon)

2. How accounts work

When you open the Game it creates a random device identifier on your device, and our server creates an anonymous player account for it. We do not ask for your name, email or phone number. Optionally, you can link your account to a Google or Apple account to keep your progress across devices.

3. Data we process

Data	Examples / content	Purpose	Legal basis
Device identifier and sessions	Random ID generated by the Game; only a keyed hash of your session token; session dates	Recognising your account, signing in, preventing abuse	Performance of a contract (GDPR Art. 6(1)(b))
Player profile	Player name (chosen or generated), friend code, level, stars, power, trophies, profile card choices	Game features, leaderboards, friends and clans	Contract
Game save and in-game activity	Server copy of your kingdom save (buildings, resources, army, quests), battle/raid/exploration results, clan and league records, reward and event claims, daily session counts	Backing up and moving your save, cheat detection, game balance and aggregated statistics	Contract; legitimate interests (Art. 6(1)(f))
Linked account (optional)	Google/Apple user ID (subject); your email address is not stored in plain text — only a keyed hash (HMAC) and a masked form (e.g. k\\\@g\\\.com)	Moving your progress to another device	Your request / contract
Purchase records	Product, price, currency, store order number, a hash of the purchase token, status. We never receive your card details — Google Play / the App Store handle payment	Delivering what you bought, verification, refunds and fraud prevention, accounting	Contract; legal obligation (Art. 6(1)(c))
User content	Player name, clan name and description, preset phrases on the clan board (there is no free chat)	Social features, moderation	Contract; legitimate interests
Technical data	IP address (only in short-lived rate-limit counters and server access logs), client version	Security, abuse prevention, compatibility	Legitimate interests
Advertising data	Advertising ID (Android Advertising ID / iOS IDFA if you allow it), device and app information, approximate location (from IP) — collected by the ad SDKs	Showing rewarded ads, ad measurement and fraud prevention	Consent (consent form); without it, non-personalised ads
Install source	Google Play install referrer (e.g. which campaign you came from)	Campaign rewards and measurement with marketing partners	Legitimate interests

We do not collect special-category data, precise location, contacts, photos, files or messages.

4. Third parties and transfers

We do not sell your data. It is shared only with these providers, for the stated purpose:

Google AdMob and the mediation networks Pangle and Liftoff (Vungle) — rewarded ads. These SDKs process the advertising ID and device data under their own policies: Google, Pangle, Liftoff.
Google Play Billing / Apple App Store — payments and purchase verification.
Sign in with Google / Sign in with Apple — only if you choose to link your account.
Our hosting provider — servers and backups (as a processor).
Marketing / referral partners — if you installed the Game through a partner campaign, the referral ID provided by the campaign and progress information such as the game level reached and the number/revenue of ads watched are sent to that partner so the campaign reward can be granted.
Competent authorities where required by law.

Some providers are located outside your country (e.g. the USA, the EU), so data may be transferred internationally under appropriate safeguards (e.g. Standard Contractual Clauses) or your consent, as required by GDPR and KVKK Art. 9.

In the EEA, the UK and some US states the Game shows Google's consent form (UMP) on first launch. You can change your choice at any time in Settings → Privacy Options. You can reset your advertising ID or opt out of personalised ads in your device settings, and deny tracking on iOS. Ads are rewarded only and always optional.

6. Retention

Account and game data: as long as your account exists. We may delete or anonymise accounts unused for more than 24 months.
Sessions: expire and are deleted after 90 days without use.
Rate-limit counters with IP addresses: at most 2 days; server access logs: at most 30 days.
Purchase records: for the period required by tax and accounting law (in Türkiye generally 10 years); if you delete your account they are kept without any link to you (anonymised).
Backups: rotated and deleted within 30 days.

7. Deleting your account and data

In the Game: Settings → Delete account → confirm by typing your friend code. Your account and server data are deleted immediately and the save on your device is wiped.
Without the Game: at https://api.playkingdomforge.com/account/delete you can sign in with your linked Google account and delete it, or send a deletion request (processed within 30 days).

Deleted: profile, device identifier, sessions, linked identities, save, friendships, clan/league/raid/exploration records, statistics. Purchase records are kept anonymised as described above; contribution points you gave your clan stay in the clan's totals. The audit log of administrator actions is kept for security purposes.

You have the right to access, receive a copy of, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time. Send requests to (contact email coming soon) with your friend code; we answer free of charge within 30 days. You may also lodge a complaint with your data protection authority (in Türkiye the Personal Data Protection Board).

9. Children

The Game is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe this has happened, contact us and we will delete the account.

10. Security

Communication with our server is encrypted with HTTPS. Session tokens and email addresses are stored only as keyed hashes (HMAC), and access to the admin area is protected by two-factor authentication and an audit log. No system is perfectly secure; if a breach occurs we will notify you and the authorities as required by law.

11. Changes

We may update this policy. We announce significant changes in the Game; the current version is always on this page.