Cyber Duels Privacy Policy
Effective date: 28 October 2026
Who we are: Cyber Duels is made by Jordan Armour, an individual developer based in Sydney, New South Wales, Australia ("we", "us", "our").
Contact: [email protected]
This policy explains what information the Cyber Duels game collects, why, who we share it with, how long we keep it, and what you can do about it. We've tried to write it in plain English. If anything is unclear, email us.
The short version
- You can play straight away as a guest. We don't ask for your real name, phone number, address or location.
- If you choose to link an email and password, we use them only for your account. We only ever send account emails, like a code or link to verify your email or reset your password. Never marketing or newsletters.
- We store your game data (player name, progress, cards, currencies, matches, friends) so the game works and your progress is saved.
- We collect crash reports and play stats to fix bugs and balance the game. They're labelled with a code instead of your account ID.
- No ads. No ad tracking. No tracking across other apps or websites. We don't sell your data.
- Purchases go through Apple. We get the transaction details (like product, price and date), never your card details.
- You can delete your account at any time, in the game or by emailing us.
1. Accounts
Guest accounts. When you first open Cyber Duels, the game automatically creates a guest account for you. Behind the scenes it has a random ID and a random internal sign-in that only your device knows. It isn't linked to your real identity.
Linking an email (optional). On the SETTINGS tab, in the ACCOUNT box, tap CREATE ACCOUNT to link an email address and password. This turns your guest account into a full account, so you can keep your progress and sign in on another phone. We use your email only for your account: to sign you in, and to help you get back in if you forget your password. When you link an email, we may send a verification email to check it's yours. We only send account emails like these (verification and password resets), never marketing. Your password is stored securely by our sign-in provider (hashed, not readable by us).
Forgot your password? Email [email protected] and we'll help you reset it once you've shown us the email address is yours (for example, by writing to us from that address). Where the game offers a "Forgot password" option on the sign-in screen, you can also use it to get a reset link by email.
2. What we collect and why
| What | Examples | Why we use it |
|---|---|---|
| Account details | Account ID, player #TAG, email address (only if you link one), sign-in information | To run your account, let you sign in, verify your email and help you reset your password |
| Public profile | Player name, level, trophies, arena, banner, title | Shown to other players on leaderboards, profiles, friends lists and in matches |
| Game progress and inventory | Cloud save, cards and card levels, credits (◆), crystals, chests, quest and Cyber Pass progress, plus a log of changes to your inventory and wallet | To save your progress, stop cheating and duplicate rewards, and fix problems |
| Match records and stats | Who you played (both player names), trophies, result, your game stats | Ranked results, leaderboards, fair play checks and match history |
| Friends and social features | Friends list, friend requests, friendly challenges, players you've blocked | To run friends, challenges and blocking |
| Player reports | When you report someone: your account ID, their account ID, their player name at the time, the reason you picked from a fixed list (such as Offensive name, Cheating, Quitting / AFK or Other), the match ID if you reported from the after-match screen, and the time. There's no free-text box. Reports are stored only on our server and only we can see them. The reported player never sees who reported them | To review reports and deal with offensive names, cheating and players who quit or go AFK |
| Online status | When you were last seen, and whether you're in the lobby or in a battle | So your friends can see if you're available to battle |
| Purchases | Apple transaction ID, product, price, date | To give you the crystals you bought, handle refunds, and keep tax records |
| Crash reports | Game version, error message, the file/line/stack where it happened, device type (iOS, Android or desktop, and whether it's the installed app), screen size and pixel ratio | To find and fix bugs |
| Play stats | Events such as session start, battle start/end, game mode, result, match length, cards used, quest/pass claims and in-game spending | To understand how the game is played and improve balance |
| Technical data for security | IP address (see section 4), server logs | To stop abuse (for example mass guest sign-ups) and keep the service running |
What we don't collect: your real name, phone number, home address, precise or approximate location, contacts, photos, microphone, camera, health data or browsing history. There's no free-text chat. Players can only send preset emotes.
Player names. Names are 3–14 letters, numbers or underscores, must be unique, and are screened by our server. Your player name is public. Please don't use your real name.
3. Crash reports and play stats — the honest details
Crash reports and play stats don't include your player name, email, account ID or IP address. Before anything is sent, the game also strips out things that look like emails, sign-in tokens, IDs, web addresses with query strings and long numbers. We don't store your device's full "user agent" text.
Instead of your account ID, each report carries a coded ID that changes every day. It's made by scrambling your account ID with a secret daily value (a "salted hash"). Reports from the same day can be grouped together, but the code on its own doesn't reveal who you are.
Because the secret values may be kept on our server, it can be technically possible for us to match a code back to an account. So we treat this data as linked to your account and protect it the same way. We don't use it to identify you.
Limits: each account can send at most 50 crash reports and 600 play events a day. Crash reports are kept for 60 days and play stats for 120 days.
4. Guest sign-up and IP addresses
To stop people creating huge numbers of fake guest accounts, we limit how many guest accounts can be created from one internet connection each day.
To do this, our server records the IP address used to create a guest account, together with a count of guest accounts created from it that day. We use these records only for this limit. We're changing this so that we store only a scrambled (hashed) version of the IP address and delete these records after 2 days. Until that change is in place, the records don't have a fixed deletion date, and you can ask us to delete yours at any time.
Our hosting providers' servers also record IP addresses in their normal logs (see section 6).
5. How we use information
We use the information above to: - run the game, your account, cloud saves, online matches, friends and leaderboards; - give you rewards and purchases, and handle refunds; - keep the game fair (for example, matches only count when both players' devices agree) and stop cheating, abuse and offensive names; - find and fix bugs and improve game balance; - keep records we're required to keep (for example, tax records for purchases); - send you account emails where the game offers them (such as email verification and password resets, never marketing); and - answer you when you contact us.
We don't use your information for advertising, we don't build advertising profiles, and we don't sell or rent your personal information to anyone.
6. Who we share it with
We only share information with the service providers we need to run the game:
- Supabase: our database, sign-in and server functions, including account emails (verification and password resets) where the game offers them. Your game data is stored in Supabase's Sydney, Australia region.
- Vercel: hosts the web version of the game. Vercel serves content from servers around the world, and its servers keep normal technical logs (such as IP addresses and the pages requested). These may be processed outside Australia, including in the United States.
- Cloudflare: hosts this website (cyberduels.app). Like any web host, it keeps normal technical logs (such as IP addresses and the pages requested) under its own privacy policy, and may process them outside Australia.
- Email services: if you email us at [email protected], your message and email address are forwarded by Cloudflare Email Routing to our email provider, Google (Gmail), where they're stored. Both may process them outside Australia.
- Apple: processes in-app purchases. Apple handles your payment under its own privacy policy. We receive the transaction details listed above, never your card or payment details.
Other players can see your public profile (player name, level, trophies, arena, banner, title), your match results against them, and, if you're friends, your online status.
We may also disclose information if the law requires it, or to protect players, the game or others from harm or fraud.
We don't use any advertising, analytics or tracking companies, and there are no third-party ad or analytics tools in the game.
Hosting logs. Supabase and Vercel keep normal technical logs that can include IP addresses. On our current plans, the logs available to us are kept for about 1 day (Supabase database and API logs; Supabase sign-in audit logs for about 1 hour) and about 1 hour (Vercel). The providers may keep some records for longer under their own privacy policies.
7. Overseas players and overseas storage
Your game data is stored in Australia (Supabase, Sydney). Some technical data handled by Vercel, Cloudflare and Apple, and emails you send us, may be processed overseas, including in the United States. Where that happens, we rely on these providers' contractual and security commitments to protect it.
8. How long we keep information
| Information | How long |
|---|---|
| Account, profile, cloud save, inventory and wallet, match records, stats, friends, blocks, quest/pass progress | Until you delete your account |
| Inventory and wallet change log | 180 days |
| Player reports | 180 days, then deleted automatically (sooner if the reported player deletes their account) |
| Crash reports | 60 days |
| Play stats | 120 days |
| Temporary game-service data (for example matchmaking and pending challenges) | 30 minutes to 30 days, depending on the feature |
| Guest sign-up records (IP address + daily count) | Moving to 2 days (hashed IP). Until then, no fixed deletion date; deleted on request (see section 4) |
| Purchase records (Apple transaction ID, product, price, date), with your account ID and player name removed | 5 years, for tax and refund purposes |
| Hosting providers' server logs (can include IP addresses) | About 1 day (Supabase) and about 1 hour (Vercel) on our current plans. The providers may keep some records longer under their own policies |
9. Deleting your account
You can delete your account inside the game where it offers this: open the SETTINGS tab, go to the ACCOUNT box and tap Delete Account, then confirm. You can also email [email protected] (from the email linked to your account, or with your player name and #TAG) and we'll delete it for you.
What's deleted: your account, sign-in details (including any linked email), profile, cloud save, inventory and wallet, inventory log, stats, friends, friend requests, challenges, blocks (both players you blocked and blocks other players made against you), online status and quest/pass progress. Reports about you are deleted straight away.
What stays: - Unspent purchased crystals are lost. The in-game delete screen warns you about this first. Deleting your account isn't a way to get a refund. Refunds are handled by Apple (see our Terms of Use). - Reports you made about other players stay until they're deleted at 180 days, but your account ID is removed from them. - Match records stay, so your opponents' match history still makes sense. They still show the player name you used in those matches. - Purchase records are kept for 5 years for tax and refunds, with your account ID and player name removed. - Crash reports and play stats already collected stay until they expire (60 and 120 days). They carry the daily code, not your account ID, but as explained in section 3 they may still be technically matchable to your account until they expire.
Remember: if you're playing as a guest and delete the app or lose your phone before linking an email, we may not be able to recover your account.
10. Your rights
Wherever you live, you can ask us to: - access the personal information we hold about you, and get a copy in a common format; - correct it if it's wrong (you can change most things, like your player name, in the game, and unblock players from the BLOCKED list on your Friends screen); - delete it (where the game offers it, you can also do this yourself in the game); - stop or limit certain uses, or object to them.
Email [email protected] from the email linked to your account, or include your player name and #TAG, so we can check it's really you. We'll reply within 30 days. We won't treat you differently for using your rights.
Australia. We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you're unhappy with how we've handled a privacy complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
European Economic Area, UK and Switzerland. We handle your data because we need to in order to provide the game you asked for (contract); for our legitimate interests in keeping the game secure, fair and working (crash reports, play stats, anti-abuse); and to meet legal obligations (such as tax records). You can also complain to your local data protection authority.
California and other US states. We don't sell or "share" personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer things about you. You have the right to know, delete and correct, as described above.
11. Children
Cyber Duels is for players aged 13 and over. On the App Store it's rated 13+ (16+ in Australia, because chests with random contents can be bought with crystals). You must be at least 13 to play (see our Terms of Use). We don't knowingly collect personal information from children under 13. If you're a parent or guardian and think your child under 13 has created an account, email [email protected] and we'll delete it.
If you're under 18, please get a parent or guardian's permission before making any purchase.
12. Ads and tracking
There are no ads in Cyber Duels. We don't track you across other companies' apps or websites, we don't use advertising identifiers, and we don't share data with data brokers.
13. Security
We protect your information with encrypted connections (HTTPS), per-player access rules in our database so each player can only read and change their own data, server-side checks on rewards and purchases, and hashed passwords. No system is perfectly secure, though. If a data breach is likely to cause you serious harm, we'll tell you and, where required, the OAIC.
14. Changes to this policy
We may update this policy as the game changes. We'll change the effective date at the top. If the change is important, we'll also tell you in the game before it takes effect.
15. Contact
Jordan Armour, Sydney, NSW, Australia
Email: [email protected]