Effective Date: March 31, 2026
"Apex & Abyss" (the "Game") is a free-to-play tactical dungeon roguelike available on iOS and Android platforms, as well as as a Progressive Web App. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your personal information when you access and play our Game.
This Privacy Policy applies to:
Apex & Abyss is currently operated as an independent developer operation. Future formal business entity arrangements may apply. This Policy will be updated accordingly should ownership or operational structure change.
Please read this Privacy Policy carefully. By downloading, installing, or accessing Apex & Abyss, you acknowledge that you have read and understood this Policy and agree to be bound by its terms. If you do not agree with this Policy, please do not use the Game.
We collect information in several categories to provide, improve, and optimize your gaming experience:
When you create an account to sync your game progress across devices or enable cloud saves, we collect:
Authentication is optional. You may play the Game without creating an account, though cloud save functionality will not be available.
To enable cloud saves, progression synchronization, and provide gameplay features, we collect:
When you make in-app purchases, we collect transaction-related information:
To optimize performance and ensure compatibility, we collect:
To understand how players interact with the Game and improve design, we collect:
When the Game crashes or encounters errors, we automatically collect:
This information helps us identify and fix bugs quickly. Crash reports typically do not contain personal information but may include device identifiers for tracking crash patterns across devices.
If you access Apex & Abyss as a Progressive Web App, we may collect:
Additional information you may voluntarily provide:
Firebase and related services may collect additional data. See Section 5 for details on third-party data collection.
| Data Category | Collection Method | Required for Gameplay |
|---|---|---|
| Account Information | User-provided or Firebase | Only if cloud saves enabled |
| Game Progress | Automatic tracking | Yes (local or cloud) |
| Device Information | Automatic detection | Yes (for optimization) |
| Analytics Data | Automatic tracking | No (can be disabled) |
| Crash Reports | Automatic on error | No (can be disabled) |
| Purchase Data | App Store / Google Play | Only if purchasing |
We use the information collected for the following purposes:
For users in the European Union and countries with similar data protection laws, we process personal information only under the following lawful bases:
Data processed: Account information, game progress, purchase data
We process this data because it is necessary to perform our contract with you—specifically, to provide the Game and enable cloud save functionality. Without this data, we cannot deliver the service you have agreed to use.
Data processed: Analytics data, device information, gameplay patterns, crash reports
We process this data because we have legitimate business interests in:
We have carefully balanced our interests against your privacy rights and concluded that our processing is proportionate and does not unduly intrude on your privacy.
Data processed: Optional analytics, promotional emails, certain types of marketing communications
Where consent is required (e.g., for marketing emails), we will obtain your explicit prior consent and provide you with a clear mechanism to withdraw consent at any time.
Data processed: Purchase records, account information, crash logs
We may process personal data where required by law, including:
We may process data where necessary for public interest purposes, such as protecting against fraud or ensuring the integrity of online gaming.
We do not sell, rent, or lease your personal information. However, we may share data with third-party service providers who assist in operating the Game. All third parties are bound by confidentiality agreements and data protection standards.
What is shared: Account credentials, game progress data, player ID, email address (if provided)
Purpose: Cloud data storage, account authentication, real-time database synchronization, crash reporting
Data Processing Agreement: Google is a data processor under our Firebase agreements. Their processing complies with GDPR and other applicable standards.
Google's Privacy Practices: https://policies.google.com/privacy
Firebase Specific Terms: https://firebase.google.com/support/privacy
By default, Firebase stores data in the United States (us-central1). If you are in the EU and concerned about data location, you may contact us. Some Firebase features may store data in regional locations.
What is shared: Purchase transaction ID, receipt validation, Apple Developer ID
Purpose: Processing in-app purchases, validating receipts, preventing purchase fraud
Data Processing: Apple processes payment information directly. We only receive confirmation of successful transactions and do not access payment methods.
Apple's Privacy Practices: https://www.apple.com/privacy/
What is shared: Purchase transaction ID, receipt validation, Google Account ID
Purpose: Processing in-app purchases, validating receipts, preventing purchase fraud
Data Processing: Google processes payment information directly. We only receive confirmation of successful transactions and do not access payment methods.
Google Play's Privacy Practices: https://policies.google.com/privacy
What is shared: Gameplay metrics, session data, crash reports, device information
Purpose: Performance monitoring, error tracking, usage analytics
Optional: You may disable some analytics features in the Game settings. However, basic technical logs may still be collected for critical error reporting.
What is shared: Account information, support ticket details, communication history
Purpose: Responding to your support requests and resolving issues
Sharing Model: Support tickets may be accessed by authorized support team members who are bound by confidentiality agreements.
We may disclose personal information without your consent if required by law, including:
Where legally permitted, we will attempt to notify you of such requests before disclosure, unless doing so would be illegal or interfere with an investigation.
If Apex & Abyss is acquired, merged, restructured, or sold, personal information may be transferred as part of that transaction. You will be notified of any such change and any choices you may have regarding your personal data.
We may share aggregated and anonymized data that cannot identify you personally with:
This data does not contain personal information and cannot be used to identify you individually.
We explicitly do not sell, rent, lease, or share personal information with unaffiliated third parties for their direct marketing purposes. Your email address, account information, and gameplay data will not be sold to advertisers or data brokers.
The Game may contain links to external websites (e.g., our website, social media). We are not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies independently.
We retain personal information for as long as necessary to provide the Game and fulfill the purposes outlined in this Policy. Retention periods vary by data type:
Retention Period: As long as your account is active
If you delete your account, we will delete or anonymize this data within 30 days, except where retention is required by law.
Retention Period: 90 days from collection
Crash data is retained for debugging purposes. After 90 days, logs are automatically deleted unless an ongoing investigation requires longer retention.
Retention Period: 24 months from collection
Aggregated analytics data is retained for trend analysis and long-term development insights. Individual identifiers are removed after 12 months.
Retention Period: 7 years (tax and accounting compliance)
Purchase records are retained in accordance with tax law and financial reporting requirements. After the retention period, records are securely destroyed.
Retention Period: 12 months from last login
Device information and login history are retained for security and fraud prevention. If your account is inactive for 12 months, this data may be deleted.
Retention Period: 2 years from last interaction
Support tickets and communications are retained for future reference and dispute resolution. After 2 years, archived tickets are securely deleted.
If we receive a legal request or become aware of pending litigation, we will preserve relevant data for as long as required by law, regardless of normal retention schedules.
You may request deletion of your personal data under applicable privacy laws (see Section 8). We will comply with deletion requests within the legal timeframe, except where:
We implement comprehensive technical, organizational, and administrative measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.
In the event of a data breach affecting personal information, we will:
While we implement robust security measures, no system is completely secure. You use the Game at your own risk. We cannot guarantee absolute security of personal information transmitted over the internet.
Under the General Data Protection Regulation (GDPR) and similar privacy laws, you have the following rights regarding your personal information:
You have the right to obtain a copy of the personal information we hold about you. We will provide this information in a structured, commonly-used, and machine-readable format within 30 days of your request.
If your personal information is inaccurate or incomplete, you have the right to request correction or completion. You can often update information directly in your account settings.
Under certain circumstances, you may request deletion of your personal data. We will delete your information within 30 days unless:
You have the right to request that we limit how we process your personal information. For example, you may request that we process data only for specific purposes without using it for marketing or analytics.
You have the right to receive a copy of your personal information in a structured, commonly-used, and machine-readable format (e.g., JSON, CSV) and to transmit that data to another service. We will provide this information within 30 days of your request.
You have the right to object to processing of your personal information for certain purposes, including:
If we process your data based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
You have the right not to be subject to decisions based solely on automated processing that produces legal or similarly significant effects. We do not use automated decision-making for purposes like credit assessment or eligibility determination.
To exercise any of these rights, please contact us at [CONTACT EMAIL]. We will verify your identity and respond to your request within 30 days. If your request is complex or requires extensive information gathering, we may extend the timeframe to 90 days, which we will communicate to you.
You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights. Contact details for your data protection authority are available through the European Data Protection Board.
If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
You have the right to request what personal information we have collected, the categories of sources, the purpose of collection, and the categories of third parties with whom it is shared.
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, comply with law, or detect fraud).
You have the right to request correction of inaccurate personal information.
We do not sell or share your personal information as defined by the CCPA or CPRA. We do not exchange personal information for monetary or other valuable consideration. However, we do share certain information with service providers as permitted by law (see Section 5).
You have the right to limit our use and disclosure of your "sensitive personal information" (as defined by the CPRA), which includes:
We do not collect most of this sensitive information. Where we do, we will honor requests to limit our use to purposes necessary to provide the Game.
We will not discriminate against you for exercising your CCPA or CPRA rights, including by:
To submit a CCPA or CPRA request, contact us at [CONTACT EMAIL] and specify your request clearly (Know, Delete, Correct, Limit, or Opt-Out). We will verify your identity and respond within 45 days.
You may authorize another person or organization to make requests on your behalf. We will require the authorized agent to provide proof of authorization and verify their identity.
Under the CCPA, we collect the following categories of personal information:
Apex & Abyss is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will delete such information promptly and terminate the child's account.
This Game does not implement collection practices specifically designed for children. We do not:
We rely on user attestation regarding age. By creating an account, you represent that you are at least 13 years old (or the equivalent minimum age in your jurisdiction).
If you are a parent or guardian and believe a child under 13 has been registered on Apex & Abyss, please contact us immediately at [CONTACT EMAIL]. We will investigate and remove the child's account and personal information.
For users ages 13-18, we limit collection to information necessary for account and gameplay functionality. We recommend parents review this Privacy Policy and discuss privacy and online safety with their teens.
The Game does not contain direct parental control features beyond standard account security. Parents can:
If you are located in the European Union or European Economic Area, your personal information will be transferred to and processed in the United States (where Google Firebase is based) or other countries. The United States has not been determined to have an "adequate" level of data protection under GDPR.
We rely on the following mechanisms to ensure adequate protection of personal information transferred internationally:
We use Standard Contractual Clauses approved by the European Commission with our third-party processors (such as Google Firebase) to establish appropriate safeguards for international data transfers.
Google has implemented Standard Contractual Clauses and other mechanisms to protect personal data transferred from the EU. For details, see https://cloud.google.com/terms/data-processing-terms
You have the right to:
If you are not in the EU, data transfer mechanisms like SCCs still apply, as they reflect industry best practices for international data protection.
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Any updates will be effective when posted.
If we make material changes to this Policy that affect how we use your personal information, we will notify you by:
Your continued use of the Game following notification of changes constitutes your acceptance of the updated Policy. If you do not agree with changes, you should stop using the Game.
We maintain a record of previous versions of this Privacy Policy. If you would like to review prior versions, please contact us at [CONTACT EMAIL].
If we make changes that materially increase our collection, use, or sharing of personal information, we will obtain your explicit consent before implementing those changes, where required by law.