Privacy Policy
This policy explains what data the game Última Muralha (Android and iOS app and the ultimamuralha.com.br website) collects, how we use it, who we share it with and how you can exercise your rights under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Brazilian General Data Protection Law (LGPD).
Data controller: the Última Muralha team. Data protection contact: contato@ultimamuralha.com.br
1. Summary
- You can play as a guest identified by a random code, or choose to sign in with Google.
- With Google sign-in, we receive basic profile information and store your Google account identifier and verified email to recover your progress. Your email stays private and never appears on leaderboards. We do not store your Google password or use your real name as your nickname.
- We do not ask for your phone number, precise location, contacts, photos or file access.
- Your nickname, country and score appear in public rankings.
- Ads are served by Google AdMob, with a consent request where required by law.
- You can delete your account and data at any time (see how).
2. Data we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Device identifier: a random UUID generated by the app at install time. It is not the IMEI, serial number or advertising ID. | Signing you in without a password. | Performance of contract |
| Nickname (auto-generated, you can change it), country (taken from the device's region settings, you can change it) and language. | Profile, world and country rankings, texts in your language. | Performance of contract |
| Gameplay data: cloud-saved progress (stars, upgrades, settings), matches submitted to rankings (map seed, list of in-match commands, score, waves and duration), season score and position, titles, crystals and their history, cosmetics and pass. | Saving your progress, validating matches against cheating, rankings, rewards. | Performance of contract; legitimate interest (fraud prevention) |
| Purchase records: product, Google Play purchase token and order number, date and status. | Delivering what you bought, preventing double delivery, handling refunds and tax obligations. | Performance of contract; legal obligation |
| Advertising (via Google AdMob): device advertising ID, IP address, device model and OS, ad interactions and your consent choices (Google User Messaging Platform — UMP). | Showing ads (including optional rewarded ads), measuring and capping frequency; personalized ads only with your consent where required. | Consent (personalized ads); legitimate interest (non-personalized ads) |
| Google sign-in (optional): email and Google account identifier, kept private. | Link and recover your account and progress on other devices. Your email is not displayed on leaderboards. | Performance of a contract |
| Usage metrics (since version 1.1.0): a random install code (not the advertising or device ID), day, app version and game events such as opening the app, finishing the tutorial, starting and ending stages (result, stars and duration), using challenges and choosing rewarded ads. When signed in, events are associated with the player ID so they can be deleted. These data use pseudonymous identifiers; events do not include email, name, location or contacts. | Understanding where the game is too hard or too long, measuring return visits and improving stage balance. | Legitimate interest |
| Basic server logs: IP address, date and time, requested route, response code and error messages. | Security, abuse prevention and fixing bugs. | Legitimate interest |
The Google ads SDK may also infer approximate location from IP addresses and collect app interactions and diagnostics for advertising, measurement and fraud prevention. We use no other analytics or crash-reporting SDK. Payments are processed by Google Play: we never receive your card details.
3. What is public
Your nickname, country, equipped frame, score and position appear in rankings and in the hall of champions, visible to other players. Choose a nickname that does not identify you if you prefer.
4. Who we share data with
- Google — Google Play (purchases and subscriptions) and Google AdMob (ads). See Google's privacy policy and how Google uses data from partner apps.
- Amazon Web Services (AWS) — server and database hosting in the São Paulo region (Brazil).
- Authorities, only when required by law or court order.
We do not sell your data. Your data is stored in Brazil; some providers (such as Google) may process data in other countries, with the safeguards required by the GDPR (such as Standard Contractual Clauses) and the LGPD.
5. Ads and consent
Where required by law (for example in the European Economic Area and the United Kingdom), the app shows Google's consent form (UMP) before personalized ads. You can change your choice in the game settings and reset or delete your advertising ID in Android settings (Google → Ads). Rewarded ads are always optional.
6. How long we keep data
- Account and gameplay data: as long as the account exists. When you delete the account, it is erased immediately.
- Purchase records: kept in anonymized form (not linked to the player) for up to 5 years for tax and fraud-prevention obligations.
- Server logs: 90 days at most.
- Usage metrics: up to 13 months. Those linked to your account are erased with it; other metrics use the random install code.
- Hall of champions: the historical result stays, but the nickname is replaced by "—" when the account is deleted.
7. Your rights
You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time (without affecting prior processing). Under the LGPD you may also request confirmation of processing, anonymization and information about sharing.
To exercise any right, email contato@ultimamuralha.com.br with your nickname and player ID (found in the game Settings). We reply within 15 days (GDPR: within one month). You may also lodge a complaint with your local supervisory authority or with Brazil's ANPD.
8. Security
We use encrypted connections (HTTPS/TLS), access control to servers and databases, and keep only what is necessary. No system is 100% secure; if a relevant incident happens, we will notify affected users and authorities as required by law.
9. Children
The game is for a general audience and does not ask for direct personal data. We do not knowingly collect data from children beyond what is described here. If you are a parent or guardian and believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy. The date at the top shows the current version; important changes will be announced in the game.