POLIKRATOS LEGAL

Privacy Policy

Effective: 31 August 2026 · Last updated: 6 October 2026

This Privacy Policy explains how Georgios Koutoulas (“we”, “us” or “the Developer”) processes information when you use the POLIKRATOS mobile game, website and related online services (together, the “Services”). For privacy questions, contact info@polikratos.com.

1. Information we collect

Account and profile information

When you create or use an account, we may process your email address, authentication provider identifier, display name, account identifier, profile image URL, sign-in method and account creation/update timestamps. If you use Google or Apple sign-in, those providers authenticate you and may provide the account details you choose to share.

Gameplay and multiplayer information

We process room membership, player seat, match identifiers, turns, game actions, match state, winners, timeouts, forfeits, match history, Ranked rating (ELO), wins and games played. Display names, avatars and leaderboard statistics may be visible to other authenticated players.

Technical and security information

Our hosting and authentication provider may process IP addresses, timestamps, request metadata and diagnostic/security logs needed to deliver and protect online services. We do not request precise location, contacts, camera, microphone or files.

Information stored on your device

Music volume, mute status, selected cosmetic board and similar preferences are stored locally. Turn and match-start notifications are generated for gameplay reminders. Local-only data is not transmitted merely because it is stored on your device.

2. How we use information

• Provide account creation, authentication and account recovery.
• Operate Local, Private and Ranked gameplay, rooms, turns and leaderboards.
• Maintain fair play, validate game actions and prevent abuse or cheating.
• Send gameplay notifications you have permitted.
• Maintain, secure, troubleshoot and improve the Services.
• Respond to support, privacy and deletion requests.

3. Legal bases

Where the GDPR or similar law applies, processing is based on performance of our agreement with you, our legitimate interests in operating and securing the game, your consent where required (including notification permission), and compliance with legal obligations.

4. Service providers and sharing

We use Supabase for authentication, database, realtime multiplayer and server functions. Hostinger provides website and email hosting. Google and Apple process information when you choose their sign-in services. These providers process data under their own terms and privacy notices. We may disclose information where required by law, to protect users and the Services, or as part of a lawful business reorganisation. We do not sell personal information. Advertising-related processing by Google is described below and is subject to your privacy choices.

5. Advertising, analytics and payments

We use Google Firebase Analytics to understand how the game is used and improve its balance, reliability and user experience. Analytics may include app interactions and technical information such as selected game mode, tutorial progress, match duration and outcome, aggregated game-action and card categories, matchmaking activity, board previews and purchase-flow events, together with device or app-instance information automatically processed by Firebase. Our custom analytics events do not include names, email addresses, private room codes, card copy identifiers or match identifiers. Advertising ID collection by Firebase Analytics is disabled. You may disable anonymous analytics at any time in the app's Settings. We do not use analytics for cross-context behavioural advertising or sell analytics data. Purchases are processed by Google Play; payment-card details are not provided to us.

Optional rewarded ads and Drachma wallet

When available, Google AdMob provides optional rewarded ads after eligible completed games. You may continue without watching. Advertising privacy choices are available in Settings. Depending on your settings and choices, Google AdMob processes information such as IP addresses (which may be used to infer approximate location), device identifiers, ad interactions and diagnostics to deliver ads, measure performance and prevent fraud. See Google Privacy Policy. To verify a reward, we send an account identifier and a reward-session identifier to Google and receive signed confirmation containing the ad unit, transaction identifier and event timestamp. We keep account-linked balances, reward sessions, credit and redemption records, and unlocked access in Supabase. Drachma are separate from in-match money and cannot be transferred or exchanged for cash.

Drachma purchases

When enabled, optional Drachma packs are repeatable one-time purchases through Google Play. We send an obfuscated account identifier to Google to bind purchases to the correct game account. Our server verifies the purchase with Google and stores its product, transaction identifier, hashed purchase reference, credited amount and any refund adjustment. We use these records to deliver purchases, prevent duplicate credits and process refunds. Purchased Drachma do not expire. A refund of already-spent Drachma can leave a negative wallet balance, which later credits offset.

Crash diagnostics

We use Firebase Crashlytics to investigate crashes and errors. Reports can contain stack traces, app version, operating-system and device information, timestamps and installation identifiers. Crash reporting is enabled by default and can be disabled separately in the app's Settings. We do not intentionally attach names, email addresses, private room codes or card hands to crash reports.

Google Play Games

On Android, Google Play Games may authenticate your Play Games profile and process its player identifier and display name. If you choose to synchronise achievements or submit scores, achievement unlocks and leaderboard scores are sent to Google. Your Play Games profile can differ from your POLIKRATOS account. Google processes this information under its privacy policy and your Play Games profile visibility settings.

Password recovery

Our password recovery page sends your email address to Supabase to deliver a reset link. The page uses a temporary authentication session to update your password. It does not run advertising or analytics scripts, and does not store that session persistently in the browser. After changing your password, return to the game and sign in again.

6. Retention

Account and profile information is retained while your account is active. Gameplay, ranking and security records are retained for as long as reasonably necessary to provide multiplayer history, preserve leaderboard integrity, resolve disputes and prevent abuse. Wallet balances, sessions, purchase-credit records, redemption records and wallet access grants are linked to your account and deleted with it. Google retains its own purchase records under its policies. Local preferences remain until you clear app data or uninstall. We may retain limited records where required for security, fraud prevention or legal compliance.

7. Account and data deletion

You may request deletion at any time through our Delete Account page or by emailing info@polikratos.com. We may ask you to verify account ownership. Following verification, we will delete or irreversibly anonymise the account and associated personal data without undue delay, normally within 30 days, except information we must retain for legal, security or fraud-prevention reasons.

8. Security and international processing

We use access controls, authenticated connections, row-level database policies and encrypted network transport. No system is completely secure. Service providers may process information in countries other than yours, subject to applicable safeguards.

9. Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction, objection or portability, and may withdraw consent. You can disable analytics and crash reporting separately and adjust music preferences in the app's Settings, and disable notifications in device settings. EEA/UK users may also complain to their local data-protection authority.

10. Children

POLIKRATOS is not directed to children under 13, or below the minimum digital-consent age in their country. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided information improperly.

11. Changes

We may update this Policy as the Services evolve. The effective date above will change, and material changes may also be communicated in the app or through another appropriate channel.

12. Contact

Developer and data controller: Georgios Koutoulas
Application: POLIKRATOS
Email: info@polikratos.com