Privacy Policy

This Privacy Policy explains how Titli Ventures ("Titli Ventures", "we", "us", "our") collects, uses, discloses and retains personal data in connection with the mobile game Forsaken Kingdoms, this website, and every related service (together, the "Service"). It forms part of, and is incorporated into, our Terms of Service.

For the purposes of the EU and UK General Data Protection Regulation, Titli Ventures is the controller of the personal data described in this Policy. For the purposes of India's Digital Personal Data Protection Act, 2023, Titli Ventures is the Data Fiduciary.

Scope

1.1 This Policy applies to personal data we process about players of the Service and visitors to this website. It does not apply to the practices of any third party we do not control, including the Apple App Store, Google Play, or any site linked from the Service, each of which has its own privacy policy.

1.2 In this Policy, "personal data" means information relating to an identified or identifiable individual, and includes "personal information" and "digital personal data" as those terms are used in the laws referred to in Sections 14 to 16.

Personal data we collect

(a) Data you give us

Category	Detail
Account identifiers	Where you link a Google account: Google's stable account identifier for you (the "subject" identifier) and your verified email address. Where you link an Apple account using Sign in with Apple: Apple's stable identifier for you and, only on the very first authorisation and never afterwards, an email address — which will be an @privaterelay.appleid.com relay address if you chose to hide your real one, in which case we never see your real address at all. Where you create a Forsaken ID: the email address you supply.
Player profile	The player name you choose, your chosen avatar and citadel skins, and any profile text.
Communications	Messages you send through creed chat, in-game mail and profile walls; and the content of any support request you send us, including your email address and anything you choose to include in it.

(b) Data collected automatically

Category	Detail
Device identifier	An identifier generated when you first open the game, used to create and restore your account without requiring registration.
Gameplay data	Your progress and state, resources, buildings, gear, pets, allies, creed membership, battle and raid history, leaderboard standing, onboarding progress, session timing and activity.
Transaction data	The product purchased, the store transaction identifier, the purchase token, the package name and the time of purchase, as supplied to us by the Platform for verification.
Technical and log data	IP address, request timing, error and diagnostic traces, and coarse device and operating-system information incidental to serving your requests.
Anti-abuse data	Signals used to detect cheating, automation, multi-accounting and rate-limit evasion. These include associations between accounts seen on the same device and accounts seen on the same network. Network associations are stored only as a keyed one-way hash of the address, we do not retain the address itself, and the hash cannot be reversed to recover it, and they are deleted after ninety (90) days.
Device integrity signals	On Android, a verdict from Google Play about whether the app and the device it is running on are genuine, and whether apps able to capture, overlay or control the screen are present. The verdict reports categories of such apps; it does not tell us what is installed on your device, and we do not receive a list of your apps.
Step data (optional, Voyage feature)	If you choose to connect the Voyage feature, we read one value from your device's health service (Health Connect on Android, Apple Health on iOS): your current day's total step count. Only that single daily number is sent to our servers, where it is stored on your player record to unlock capped daily in-game rewards. We do not read, receive or store any other health or fitness data, no raw records, sources, timestamps, locations or history, and your step count is never used for advertising, never shared with third parties, and never sold. The feature is off by default. You can disconnect it in the game at any time, and revoke the underlying permission in your device's health settings; either stops all collection immediately.

(c) Data we receive from third parties

2.1 Where you sign in with Google, Google provides us with your account identifier and, if verified, your email address. Where you use Sign in with Apple, Apple provides us with a signed token containing your Apple identifier, and an email address on the first authorisation only. We receive neither your Google password nor your Apple password. Where you make a purchase, the Platform provides us with a signed receipt containing the transaction details listed above.

What we do not collect

• Payment card details. Purchases are processed entirely by the Apple App Store or Google Play. No card number, expiry date, security code or bank detail reaches our servers at any point.
• Precise or coarse location. The app requests no location permission and we do not derive location from your IP address for any purpose other than the security and fraud-prevention purposes described in Section 4.
• Contacts, photos, files, microphone or camera. None of these permissions is requested by the app.
• Advertising identifiers. The Service contains no advertising, no advertising SDK and no third-party analytics or tracking SDK. We do not build advertising profiles and we do not permit anyone else to do so through the Service.
• Special category data. We do not knowingly collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Do not include such information in messages or profile text. The one exception is narrow and entirely optional: if you connect the Voyage feature, we receive your current day's total step count and nothing else, with your explicit consent, as described in Section 3(b). A bare daily step count reveals nothing about any medical condition, and we collect no other fitness or health information of any kind.

How and why we use personal data

1. To provide the Service, to create and authenticate your account, save and restore your progress, run the shared game world, deliver your messages, and operate creeds, alliances, leaderboards and events.
2. To process and verify purchases, to validate a store receipt with the Platform, credit the correct Virtual Currency exactly once, prevent duplicate crediting, and investigate disputed or failed transactions.
3. To keep the Service safe and fair, to detect and act on cheating, automation, exploitation, multi-accounting, real-money trading, fraud, chargeback abuse and unauthorised access, and to enforce our Terms of Service.
4. To moderate content, to filter and, where reported or detected, review messages and names, and to act on breaches of our rules of conduct.
5. To support you, to answer your questions, investigate faults you report, and restore progress where appropriate.
6. To maintain and improve the Service, to diagnose errors, monitor capacity and stability, and understand in aggregate how features are used so that we can balance and improve the game.
7. To communicate with you, to send service messages such as security notices, confirmation codes, changes to these documents, and notices about the Service. We do not send marketing email without your consent.
8. To comply with law, to meet our tax, accounting and other legal obligations, to respond to lawful requests from authorities, and to establish, exercise or defend legal claims.

Legal bases for processing

5.1 Where the GDPR applies, we rely on the following legal bases:

Purpose	Legal basis
Providing the Service and your account; processing purchases	Performance of a contract with you (Article 6(1)(b))
Anti-cheat, anti-fraud, security, moderation, enforcement of our Terms	Our legitimate interests in protecting the Service, our players and our business (Article 6(1)(f))
Diagnostics, stability and aggregate product improvement	Our legitimate interests in operating and improving the Service (Article 6(1)(f))
Linking a Google or Apple account; optional communications	Your consent (Article 6(1)(a)), which you may withdraw at any time
The optional Voyage step-rewards feature	Your explicit consent (Article 6(1)(a)), given twice, once in the game and once in your device's health permission dialog, and withdrawable at any time in either place
Tax, accounting, and responses to lawful requests	Compliance with a legal obligation (Article 6(1)(c))
Establishing, exercising or defending legal claims	Our legitimate interests, and Article 9(2)(f) where relevant

5.2 Where we rely on legitimate interests we have considered whether those interests are overridden by your interests or fundamental rights. You may object to that processing as described in Section 11, and we will stop unless we have compelling legitimate grounds or the processing is needed for legal claims.

Information visible to other players

6.1 The Service is a multiplayer game and some information is public within it by design. The following are visible to other players: your player name, your kingdom's public statistics and rank, your creed and role within it, your avatar and citadel appearance, your battle and raid history against them, and anything you post in creed chat, in-game mail or on a profile wall.

6.2 Your email address is never shown to other players, and neither is your device identifier, your transaction history or your IP address.

6.3 Do not post anything in a public or private channel that you would not want another player to keep, screenshot or republish. Once a message has been sent to another player we cannot recall it from their device, and deletion of your account does not retrieve it.

Disclosure to third parties

7.1 We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only as follows.

Recipient	Purpose
Railway (hosting and database infrastructure)	Hosting the game servers and storing player data. Acts as our processor.
Google LLC, Google Play Billing and the Play Developer API	Processing purchases and allowing us to verify a receipt before crediting currency.
Google LLC, Google Sign-In	Authenticating you, where you choose to link a Google account.
Google LLC, Play Integrity API	Confirming that the app and device are genuine. The app obtains a signed token from Google Play and our server sends it back to Google to be decoded. No account information is sent with it, and Google receives nothing about you that it did not itself issue.
Apple Inc., Sign in with Apple	Authenticating you, where you choose to link an Apple account. Where you choose to hide your email address, Apple issues a relay address and forwards mail to your real one without disclosing it to us.
Apple Inc., App Store and StoreKit	Processing purchases on iOS and allowing us to verify a signed transaction.
Professional advisers, insurers and auditors	Where reasonably required, under duties of confidentiality.
Law enforcement, regulators and courts	Where required by law, or where necessary to investigate fraud or abuse, enforce our Terms, or protect the rights, property or safety of any person.
An acquirer or successor	In connection with a merger, acquisition, reorganisation or sale of assets, subject to this Policy continuing to apply to the transferred data.

7.2 Where a recipient acts as our processor, it is engaged under a written agreement that restricts it to processing on our instructions and requires appropriate security measures.

International transfers

8.1 We are established in India. Our infrastructure providers operate globally, and your personal data may be stored or processed in countries other than your own, including in countries that have not been the subject of an adequacy decision by the European Commission or the UK Government.

8.2 Where personal data is transferred out of the EEA or the UK, we rely on an adequacy decision where one applies, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), together with any supplementary measures identified as necessary. You may request a copy of the relevant safeguards by contacting us under Section 20.

Retention

9.1 We keep personal data only for as long as we need it for the purposes set out in this Policy, and then delete it or irreversibly anonymise it.

Data	Retention
Account and gameplay data	For as long as the account exists. On deletion, erased after the 30-day grace period described in Section 12.
Messages sent to other players	Retained on the recipient's side and subject to the message cap applied by the Service; not recoverable by deleting your account.
Transaction records	Up to eight (8) years, as required for tax and accounting purposes, held separately from any live account.
Enforcement and anti-abuse records	For as long as necessary to prevent a banned player from returning and to defend any challenge to the enforcement action, and no longer than is proportionate to that purpose.
Server and diagnostic logs	A short operational period, typically not exceeding ninety (90) days, save where a log is preserved for a specific security investigation.
Network associations (anti-abuse)	Ninety (90) days from the last time an account was seen on that network, after which the association is deleted automatically. Associations between accounts on the same device are kept while the accounts exist and are removed when an account is deleted.
Support correspondence	Up to twenty-four (24) months after the matter is closed.
Step data (Voyage)	The current day's total, plus which daily reward tiers you have claimed, kept as part of your player record. Deleted with your account; disconnecting the feature stops any further collection immediately.

Security

10.1 We implement technical and organisational measures appropriate to the risk, including: encryption of traffic between the app and our servers; a server-authoritative architecture in which the client cannot alter balances or progress and can only request that the server do so; verification of every purchase directly with the store before any currency is granted; per-transaction idempotency so that a replayed receipt cannot be credited twice; rate limiting; restricted administrative access; and storage of secrets outside the application code and outside the client.

10.2 We do not store payment card details, and we do not store passwords for linked Google or Apple accounts, which removes the two most damaging categories of data an attacker could obtain.

10.3 No system is completely secure. We cannot guarantee the security of personal data transmitted to or from the Service, and any transmission is at your own risk. You are responsible for keeping your own credentials and device secure. Where a personal data breach is likely to result in a risk to your rights and freedoms we will notify the relevant supervisory authority and, where required, you, within the timeframes set by applicable law.

Your rights

11.1 Subject to the conditions and exceptions in the law that applies to you, you have the right to:

1. access the personal data we hold about you and receive a copy of it;
2. rectify personal data that is inaccurate or incomplete;
3. erase your personal data, see Section 12, which you can exercise immediately in the app;
4. restrict processing in certain circumstances;
5. object to processing carried out on the basis of legitimate interests;
6. data portability, receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
7. withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
8. nominate another individual to exercise your rights in the event of your death or incapacity, where the law applicable to you provides for this; and
9. complain to a supervisory authority, see Sections 14 to 16.

11.2 To exercise a right, contact us at the address in Section 20 from the email address linked to your account, or from the account itself where the Service provides a means to do so. We will respond within one (1) month, or within any shorter period required by the law applicable to you. We may extend that period by two (2) further months where the request is complex, and will tell you if we do.

11.3 We may ask for information reasonably necessary to confirm your identity before acting on a request. We will not charge a fee unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and will explain why.

11.4 We will not discriminate against you for exercising any right under this Policy.

Deleting your account

12.1 Two things survive deletion, and you should know about them. Messages you sent to other players remain in those players' inboxes and creed histories. Transaction records are retained for the period stated in Section 9 because tax law requires it; they are held apart from any live account.

Children

13.1 The Service is not directed at children under thirteen (13) and we do not knowingly collect personal data from them. If we learn that we hold personal data of a child under thirteen (13) we will delete it and terminate the account.

13.2 The Service includes player-to-player communication and competitive raiding between players. Parents and guardians should consider this before permitting a child to play.

13.3 Where the law applicable to you sets a higher age for consent to the processing of a child's data, including under India's Digital Personal Data Protection Act, 2023, which treats a person under eighteen (18) as a child and requires verifiable consent from a parent or lawful guardian, a person below that age may use the Service only with that consent, and we do not undertake behavioural tracking or targeted advertising directed at children in any event.

13.4 A parent or guardian who believes their child has provided personal data to us should contact us at the address in Section 20 and we will act on it.

Additional information for India

14.1 Titli Ventures is the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This Policy, together with the consent presented to you in the Service, constitutes the notice required under Section 5 of the DPDP Act.

14.2 You have the right to access a summary of your personal data and of our processing, to correction and erasure, to grievance redressal, and to nominate another individual to exercise your rights in the event of your death or incapacity. You may withdraw consent at any time with the same ease with which it was given; withdrawal does not affect the lawfulness of processing before it, and may mean parts of the Service can no longer be provided to you.

14.3 Grievance Officer. Any grievance concerning the processing of your personal data may be sent to our Grievance Officer at altairsky@forsakenkingdoms.com with the subject line "DPDP Grievance". We will acknowledge your grievance promptly and aim to resolve it within seven (7) working days, and in any event within the period prescribed by the DPDP Rules.

14.4 If your grievance is not resolved to your satisfaction you may complain to the Data Protection Board of India.

14.5 You are required to provide accurate information and not to impersonate another person when exercising a right under the DPDP Act.

Additional information for the EEA and UK

15.1 If you are in the European Economic Area or the United Kingdom, you have the rights set out in Section 11 under the GDPR or UK GDPR as applicable.

15.2 You have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement, or with the Information Commissioner's Office in the United Kingdom. We would ask that you raise the matter with us first so that we have an opportunity to resolve it.

15.3 Providing personal data is necessary to enter into and perform the contract constituted by our Terms of Service. If you do not provide it, we cannot provide you with an account or with the Service.

Additional information for California

16.1 If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you rights to know, delete, correct, and to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information.

16.2 In the twelve months preceding the date of this Policy we have collected the following categories of personal information: identifiers (device identifier, account identifier, email address, IP address); commercial information (purchase records); internet or other electronic network activity information (gameplay and log data); and, where you choose to provide it in a message, other information you supply. The sources, purposes and recipients are those set out in Sections 2, 4 and 7.

16.3 We do not sell personal information and we do not share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit.

16.4 To exercise a right, contact us under Section 20. You may use an authorised agent, in which case we may require written proof of authorisation and verification of your identity.

Cookies and similar technologies

17.1 The game app does not use cookies and contains no analytics or advertising SDK. It stores data locally on your device, your session token, cached assets and downloaded 3D models, so that the game can start and run. This is necessary for the Service to function and is removed when you uninstall the app.

17.2 This website uses no analytics or advertising cookies. It loads a web font from Google Fonts, which involves a request to Google's servers that necessarily discloses your IP address to Google; that is the only third-party request the site makes.

Automated decision-making

18.1 We use automated systems to filter messages for prohibited content, to apply rate limits, and to flag accounts for suspected cheating, automation or fraud.

18.2 Automated filtering and rate limiting operate without human review. Where an automated system flags an account, a permanent termination is not applied solely on the basis of that automated processing where doing so would produce a legal or similarly significant effect on you and the law applicable to you gives you the right to human involvement. You may contest any enforcement decision, obtain human review, and express your point of view by contacting us under Section 20.

18.3 We do not carry out profiling for marketing purposes.

Changes to this Policy

19.1 We may update this Policy. The version number and effective date at the top will change. Where a change materially affects how we use your personal data or your rights, we will give notice within the Service or by email before it takes effect, and where the law requires your consent we will obtain it.

19.2 Previous versions are available on request.

How to contact us

Titli Ventures
General and privacy enquiries, and Grievance Officer: altairsky@forsakenkingdoms.com

To help us act on your request quickly, please tell us your player name, the platform you play on, and write from the email address linked to your account.