Nightfront — Privacy Policy
Tester version — Nightfront internal test. Not legal advice; not yet reviewed by counsel.
Version 0.7, 2026-11-10. Prepared by DRO Apps for Nightfront's internal test.
This is the tester version for Nightfront's internal test. It has not yet been reviewed by counsel. It describes how DRO Apps intends to handle personal data in Nightfront. It is not a legal opinion and nothing in it is legal advice. Where something is not yet decided for the test, the text says so; ask privacy@droapps.dk.
Key terms such as the General Data Protection Regulation (GDPR), the EU–US Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs) and the Digital Services Act (DSA) are explained where they are used.
1. Who we are
Nightfront is an online mobile game for iOS and Android, owned and published by DRO Apps, a Danish company owned by Daniel Negrescu. DRO Apps is the data controller for the personal data described in this policy: the company that decides why and how the data is used.
- Company registration (CVR — Det Centrale Virksomhedsregister) number: DK45467406; Borup, Denmark. The CVR register identifies the company.
- Contact, by e-mail only: privacy@droapps.dk for privacy questions, data-subject requests, complaints, appeals and legal matters; support@droapps.dk for everything else.
- Supervisory authority: Datatilsynet (the Danish Data Protection Agency).
We have not appointed a Data Protection Officer, and none is required at soft launch: DRO Apps is a one-person company, and the anti-cheat processing on every match is regular and systematic but not large-scale at hundreds to a few thousand players (GDPR Article 37(1)(b)). We re-assess the question when the game reaches 5,000 daily players and before any chat feature is added.
2. The game is for adults only
Nightfront is offered to adults only. We use one neutral 18+ confirmation when an account is created:
- the 18+ question is the first screen. Before you answer "Yes", the app starts no network service and makes no network call: no sign-in, no analytics, no crash reporting, no integrity check. Nothing leaves your phone;
- if you answer "No", nothing is stored on your phone and nothing is sent to us; the app shows that the game is rated 18+ until you close it, and asks again the next time it is opened;
- no account is created for a person under 18;
- every purchase requires an 18+ account;
- there are no age bands, no parent or guardian flow, and no per-country consent ages.
The 18+ confirmation is a declaration by the player, not an identity check. If we learn that an account belongs to a person under 18, we close the account and delete its data under section 8. Money for its purchases can come back only as a refund that the player, or a parent or guardian, requests in Apple's or Google's refund flow, which the store decides and pays under its own rules (terms, section 3); on request we confirm to the store whether anything from a purchase was used. DRO Apps itself pays no refund.
We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, e-mail privacy@droapps.dk; you need no account to do so.
We estimate how often players answer "No" without collecting anything from those who do: we compare the stores' first-time download counts with the number of accounts created on our server.
3. What personal data we collect, and where it comes from
We collect the data needed to run an online game, to keep it fair and secure, to award leaderboard prizes and to sell in-game currency. We do not ask for your real name, postal address or phone number to create an account, and we collect no identity data for prizes.
3.1 Account and sign-in data
PlayFab (a Microsoft service) is our identity provider. You can sign in with Apple on iOS, with Google Play Games on Android, or as a guest with an identifier generated on your device.
We process:
- your PlayFab ID, the account identifier that the game uses;
- the identifier from the sign-in method you use (Apple or Google), and which sign-in methods are linked to your account;
- your display name, and your visibility choice: whether your name is shown on the public leaderboards and in other players' recent-players lists (hidden by default; section 3.9);
- your country, taken from the store region you use and checked against the approximate login location; it also decides whether you can be awarded a leaderboard prize (section 3.8);
- your IP address and connection metadata, such as login and session times and the approximate login location, used to run the login and keep it secure;
- your game profile and progress: experience, level, unlocks, loadout, missions, rank and a hidden matchmaking rating;
- your Gold balance, with each grant tagged bought, free or prize (terms, section 9.1);
- your 18+ confirmation, which is a declaration and not consent, and your analytics and crash-report choices;
- app-integrity results from Apple App Attest or Google Play Integrity, used to detect tampered or automated clients (section 3.5).
On a guest account, the identifier is kept on your device: in the iOS Keychain, which survives a reinstall, or in encrypted Android preferences, which may be lost if the app is uninstalled and the system does not restore them.
3.2 Match data, the match roster and the match archive (K2)
Every online match produces a match envelope. It contains the mode, map, result, each player's statistics, weapon use, anti-cheat signals such as input timing, the server host, the game version and the start and end times. We use it to award rewards, update your rank and matchmaking rating, write the leaderboards, detect cheating and keep the game balanced.
Our match servers also keep server logs and connection metadata, including players' IP addresses, while a match runs and for a limited period afterwards (section 7). Photon (Exit Games), our real-time networking provider, processes your IP address and connection metadata to connect you to a match.
We keep the raw match envelopes in an archive that we call K2. Each match is stored as one file that holds the records of every player in that match; the file is written once and is not edited afterwards. K2 is pseudonymised: it records players under their PlayFab ID, not under a name or an e-mail address. Each match file is deleted when it is at most 30 days old, counting any recovery copy the storage service keeps; the archive is not included in backups, so no copy outlives those 30 days. This fixed expiry, with a deleted player's ID put beyond the archive reader's reach (section 8), is deletion "without undue delay" for records that are still needed for match integrity and other players' disputes (GDPR Article 17(1)(a) and (3)(e)). Only our owner's administrator role and our automated cheat-review job can read the archive; the AI-assisted tools in section 3.5 cannot. Section 8 explains what this means when you delete your account.
A match roster (who played in which match) is kept for 30 days and then reduced to the per-player result records in the results ledger (section 7).
3.3 Purchase data (K7)
When you buy Gold, the starter pack or the pass bundle, the purchase is processed and invoiced by the App Store (Apple) or Google Play (Google), which handles the payment and VAT toward you. DRO Apps handles no payments and does not receive your payment card details.
We receive and process:
- the product you bought, its price and the store receipt;
- the store transaction and order identifiers from Apple or Google;
- your Gold balance and the purchase ledger that records what was bought and when, including which Gold and items each purchase granted and whether anything from it has been used (the spend order in the terms, section 9.1).
To complete a purchase you asked for, the app reads the transaction data the store framework hands it (StoreKit on iOS, the purchase token on Android). This is the "strictly necessary" case of the ePrivacy Directive (Article 5(3)): the service you asked for cannot be delivered without it.
We keep the store transaction and order identifiers for purchase-fraud prevention, for example to detect repeated refunds or receipts that do not belong to the account, for 13 months after the purchase, separately from the bookkeeping copy of the purchase ledger (section 7). This is separate from advertising: we do not use these identifiers for advertising or profiling. We read no device identifiers to link accounts.
There are no withdrawals of any kind from the game. Every refund is requested by you in Apple's or Google's refund flow and, if the store approves it, paid by the store to your original payment method under the store's own rules. DRO Apps pays no money to anyone directly. We support a refund request only for a purchase made in the last 14 days from which nothing has been used (terms, section 9.3); when you ask, or when the store asks and you have agreed to us answering it (on iOS, Apple's request for consumption information), we confirm whether anything from a purchase has been used. Once the store has approved a refund we remove the refunded Gold from your balance and record this in the purchase ledger.
3.4 Analytics, crash reports and other Firebase services
We use Firebase (a Google service). No Firebase service runs until you say yes to the choice that covers it. Two separate switches are shown after the 18+ question, both off by default; you can change them later in Settings.
- If you say yes to analytics: Firebase Analytics records how the game is used, such as screens opened, matches played and progression, together with app and device information that the analytics software collects. Firebase Remote Config and Firebase A/B Testing also start: Remote Config sends presentation settings such as the default graphics quality for your phone model and interface layouts, and A/B Testing shows different players different versions of a screen, such as the tutorial flow, to see which works better. No reward, price, gameplay, matchmaking or security value is sent this way; those come from our own servers.
- If you say yes to crash reports: Firebase Crashlytics records crash reports and diagnostics.
- Firebase Installations creates a random Firebase installation ID on your device once you have said yes to either, or have turned on push notifications (section 3.7); the services above use it to decide which settings or reports belong to your device.
- If you say no to both, and have not turned on push notifications (section 3.7), the app uses no Firebase service and Google receives nothing from it. Turning on push creates a Firebase installation ID for the push service and starts no other Firebase service. The app's kill switches (for example a switch that hides a menu tab during an outage) and the news banner come from our own servers or from PlayFab configuration data, with no device identifier.
When a Firebase service runs, it contacts Google's servers, so Google also receives your device's IP address and basic app and device information, and may process the data in the United States (section 6).
There are no advertising software development kits (SDKs) in the game, and advertising personalisation signals remain off. Saying no to analytics and crash reports does not stop you playing.
3.5 Support, reports, device-integrity checks and bans
Support and appeals. If you contact support or appeal a decision, we process the messages you send, your PlayFab ID, your ticket number and any information you choose to include. Every appeal gets an automatic acknowledgement, and the answer comes by e-mail within 14 days (terms, section 10). We use an e-mail service for this: not yet decided for the test (ask privacy@droapps.dk).
Device-integrity checks. The app may ask Apple (App Attest, which stores a key on your device) or Google (Play Integrity) to confirm that the app and device have not been tampered with. Our server checks the result. A failed check never blocks you from playing and never bans you by itself. It has exactly two automatic effects: (i) you are matched in a separate low-trust pool until a later check passes, which clears it at the next launch; a person at DRO Apps reviews every standing flag within 7 days, and you are told in a notice with the appeal route; (ii) a leaderboard prize you would be awarded is held for a person's decision (section 3.8). A flag never changes your progress, rewards, Gold or rank. Requesting these checks falls within the "strictly necessary" exemption of the ePrivacy rules: it is security that the service every player asked for needs, the verdict has only the two bounded, reversible uses above, and no device fingerprint is kept beyond the verdict.
Reviewing flags, and AI-assisted tools. A person at DRO Apps reviews flags and decides bans. To sort the flags and watch server logs, DRO Apps uses AI-assisted tools that run on a third-party AI service (Anthropic's Claude). Before any of your personal data reaches that service, it must run under commercial terms with a data-processing agreement, a commitment not to train on the data and a lawful transfer mechanism (section 6); the signed terms and their date are not yet decided for the test (ask privacy@droapps.dk). What the tools receive is minimised: pseudonymous identifiers only, with no IP address, name, e-mail address or device identifier; logs are redacted first. The tools sort and summarise; the person decides. None of the low-trust pool, the prize hold or this AI-assisted sorting is a decision based solely on automated processing under GDPR Article 22: the pool is reversible, reviewed within 7 days and changes who you meet, not whether you play; the prize is held for a person's decision; the tools sort and never decide.
Bans. If we warn, suspend or ban an account, we keep a record of the reason (the category of breach and the kind of evidence), the duration, the evidence we relied on (including a copy of the flagged match's envelope) and the appeal. A ban applies to the account and to the Apple or Google sign-in identity linked to it: after the account is deleted we keep a one-way hash of that identity with the ban record, to handle appeals and to refuse linking the same sign-in identity to a new account. We read no device identifiers for this.
Leaving matches early. Leaving an online match at least two minutes before its end leads to automatic warnings and short queue bans within the same week (a warning, then 5 minutes, 30 minutes and 24 hours), recorded against your PlayFab ID.
3.6 Display names, clan names, reports and moderation (DSA)
Your display name, and a clan's name and tag, are user content. They are shown in matches (the scoreboard, kill feed, kill screen and results), in clan rosters and, if you choose to show your name, on public leaderboards and in other players' recent-players lists. They pass a server-side filter for profanity, slurs, impersonation of staff, brand names and extremist names and symbols; a name the filter refuses when you type it is not stored. Any player can report a name in the game; anyone, player or not, can report one by e-mail to privacy@droapps.dk (section 12). Reports reach our moderation queue, where a person reviews them. We keep the report, the decision, the statement of reasons and any appeal so that the decision can be reviewed. For a clan name or tag, we record which account set or last changed it and when, so that the statement of reasons reaches the right person.
The Digital Services Act (DSA, Regulation (EU) 2022/2065) requires providers of hosting services to let anyone report illegal content (Article 16) and to give a clear statement of reasons when they remove or restrict content or an account (Article 17). DRO Apps is a provider of a hosting service for these names, so Articles 11, 12, 14, 16, 17 and 18 apply to us; the online-platform duties in Articles 20 to 28 do not, because DRO Apps is a micro enterprise (Article 19). We follow Articles 11, 12, 14, 16 and 17 in every country; section 4 explains the position in Norway.
3.7 Push notifications
Push notifications are opt-in. We use Firebase Cloud Messaging (Google) and keep the push registration identifier that the service issues for your device. The identifier is created only when you opt in; automatic registration is off until then. We send at most one push a day in total; event-related pushes are at most three a week inside that limit; and we do not send push messages about Gold.
3.8 Leaderboards, prizes and giveaways
The game ranks players on a day, a week and a month board by kills, and on a season board by rank points. Every kill in an official online match is counted by our server. To rank you, we process your match results, your account level, your match count in the period, your linked sign-in method, your store country, your ban status and any device-integrity flag.
- Public display. Your place is shown to other players under your display name only if you chose to show it; otherwise as "Operator#xxxx" (section 3.9).
- Prize award. At each period's close, the top 200 places with player IDs are copied into a prize ledger kept for appeals and audits; prizes are credited to the winning accounts in-game after a 24-hour cheat review. If your device failed an integrity check, your prize is held for a person's decision within 14 days (terms, section 9.5). Ledger rows that led to no award are deleted 30 days after the board closes; awarded rows stay with the prize-grant record for the period in section 7.
- In-game rewards only. Every prize is an in-game reward (Gold, Credits, cosmetics, items, titles, badges or banners) with no cash value. It cannot be exchanged for money or for anything outside the game, and it cannot be transferred. Because nothing of monetary value leaves the game, we collect no real name, national identity number or address for prizes.
- Eligibility by country. Prizes are awarded only to accounts whose store country is one of the launch countries.
- Giveaways and event rewards are either the same grant to every eligible account or an in-game award by a skill ranking over a period. Nobody enters anything: the grant is written to your account by our server from the data above. A grant to every eligible player is free Gold; a skill-ranked award is prize Gold (terms, section 9.1). Giveaways are never run on social media.
3.9 Parties, invites, recent players and clans
- Parties and invites. A party is joined by an invite link or a six-character code. The link carries a random token made by our server, no account identifier and no tracking parameters; a code expires after 15 minutes or when the party is full. The text you share is fixed wording plus your display name, sent through your phone's share sheet; we do not see who you send it to.
- Recent players. Your profile holds a list of the last 20 human players you met: their display name (or "Operator#xxxx" with no clan tag if they have not chosen to show it), clan tag, when and in which mode. It exists so that you can invite them again. A player you block or mute is removed from your list, and a deleted account is removed from every list.
- Visibility, hidden by default. Your display name is hidden on the public leaderboards and in other players' recent-players lists unless you choose to show it. The choice is offered once after the 18+ question and the consent screen (nothing is preselected) and can be changed in Settings at any time. The choice covers only those two places; inside a match, names show as they always have.
- Clans. A clan has a name and tag, a join code and up to 30 members. Members see a roster (display name, role, season rank points). A clan ledger records, per match and member, the season, the match, the player, the mode, whether the match was won and the rank-point change; it is kept with the match results and feeds the clan board. The server records which account set or last changed the clan's name or tag, and when.
- Block and mute. Your block and mute lists (at most 100 blocked and the muted players) are stored in your profile and purged when you delete your account.
3.10 What we do not do
- We do not sell personal data.
- We do not use advertising SDKs or sell advertising profiles.
- We do not read device identifiers to link accounts or to enforce bans.
- We do not collect real names, national identity numbers or addresses for prizes.
- We do not ask for special categories of personal data (such as health data), and the game does not need them.
- We do not give our AI-assisted tools production personal data except under the terms in section 3.5.
4. Why we use the data, and the legal basis
The GDPR requires a legal basis for each purpose. The table below states the basis we rely on. Where the basis is our legitimate interests, the law requires a balancing test between our interests and your rights and freedoms; we rely on legitimate interests only where that test is met.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, save progress, matchmake, run matches and award rewards | Account, profile, match data | Performance of a contract (GDPR Article 6(1)(b)) |
| Record your 18+ declaration and keep the game adults-only | 18+ declaration, account ID | Contract (the terms admit adults only) for the declaration itself; legitimate interests (Article 6(1)(f)) in keeping the service adults-only. Data of a player who misdeclared their age, processed before we discovered it, rests on our legitimate interests in good-faith performance of the contract |
| Keep matches fair, detect cheating, balance the game and settle disputed results using the match archive, including keeping each match file until it expires (at most 30 days) after an account is deleted (section 8) | Match data, anti-cheat signals, account ID | Legitimate interests (Article 6(1)(f)); for the core delivery of a match, also contract |
| Build fair matches with the hidden matchmaking rating, including setting the AI players' difficulty from it | Match results, hidden rating | Contract. The rating is profiling (Article 4(4)) but engages no decision under Article 22: the rule is fixed, bounded, the same for everyone and decides no right; the Prize rules disclose it |
| Process purchases, keep the purchase ledger with its Gold tags and meet tax and accounting duties | Purchase data, account ID | Contract; legal obligation (Article 6(1)(c)); legitimate interests for fraud prevention (Recital 47 names fraud prevention as a legitimate interest) |
| Prevent purchase fraud using store transaction and order identifiers (K7) | Purchase data, account ID | Legitimate interests (Article 6(1)(f)); the 13-month period covers the stores' refund windows and the card schemes' chargeback windows |
| Analytics, interface tests and presentation settings (Firebase Analytics, A/B Testing, Remote Config, Installations) | Usage data, app and device information, the installation ID, IP address | Consent (Article 6(1)(a)); consent for storing or reading information on your device under the ePrivacy Directive (2002/58/EC). Nothing runs before you consent |
| Crash reports (Firebase Crashlytics, Installations) | Diagnostics, the installation ID, IP address | Consent (Article 6(1)(a)); ePrivacy consent |
| Operate, monitor and troubleshoot the service and the match servers | Server and application logs, metrics and traces, which may include IP addresses | Legitimate interests in running and securing the service; logs are kept 30 days (section 7) |
| Answer support requests and handle appeals | Support and appeal records | Contract; legitimate interests |
| Moderate names, handle reports, give statements of reasons and keep moderation records | Display name, clan names and tags, reports, moderation records | Contract and legitimate interests in a safe service, everywhere; in addition, legal obligation (Article 6(1)(c)) under DSA Articles 16 and 17 where the DSA applies (see the Norway note below) |
| Run the leaderboards and award prizes | Match results, account level and country, match counts, ban and flag status, the prize ledger | Contract, for ranking and awarding prizes; the "Operator#xxxx" entry under the contract; public display of your name only after your opt-in, which is consent (Article 6(1)(a)): a free, specific choice with nothing preselected, which you can withdraw in Settings at any time |
| Grant giveaways and event rewards | The eligibility data above | Contract: a grant to every eligible player is a gift under the terms; a skill-ranked award is performance of the Prize rules |
| Run parties, invites and clan rosters | Party membership, invite tokens, roster data, the clan ledger | Contract |
| Keep recent-players lists | The last 20 players met, with the visibility choice honoured | Legitimate interests, with your right to object (Article 21): you did not ask to appear in another player's list, so the hidden default and your objection protect you |
| Detect cheating with device-integrity checks, run the low-trust pool and hold prizes | Integrity results, account data | Legitimate interests in preventing fraud and abuse; the ePrivacy "strictly necessary" exemption for the check itself (section 3.5) |
| Sort flags and watch logs with AI-assisted tools | Pseudonymous identifiers and redacted logs | Legitimate interests, only under the processor terms in section 3.5 |
| Detect collusion and party abuse on the leaderboards (which players repeatedly play together) | Match rosters, party membership | Legitimate interests; this is profiling, and no decision is taken from it without a person's review |
| Send push notifications you asked for | Push registration identifier, notification settings | Consent (Article 6(1)(a)) |
| Establish, exercise or defend legal claims | Any data relevant to the claim | Legitimate interests (Article 6(1)(f)) |
We use a hidden matchmaking rating to build fair matches. It does not decide whether you may use the game. It is profiling (Article 4(4)) but not a decision with legal or similarly significant effects: it does not decide whether you play or what you are awarded.
Players in Norway. Norway is in the European Economic Area but not in the European Union. The GDPR applies in Norway through the Norwegian Personal Data Act (personopplysningsloven); the Digital Services Act had not been taken into the EEA Agreement as at this version's date. Our moderation and report handling therefore rests on the contract and on our legitimate interests everywhere, and on the DSA's legal obligation only where the DSA applies. The Norwegian rule on storing and reading information on your device (ekomloven § 3-15) applies in place of the Danish one. Your consumer rights in Norway come from angrerettloven and digitalytelsesloven, and you may complain to Datatilsynet (Norway).
5. Who we share personal data with
We use service providers (processors) that handle data on our behalf. They are listed, with their role, the data categories, their location and the status of their data processing agreement (DPA), in our processor list: not yet decided for the test (ask privacy@droapps.dk).
The processors are:
- Photon (Exit Games) for real-time networking;
- Microsoft for PlayFab (accounts, player data, economy, leaderboards, matchmaking) and Azure (backend, purchase and results ledgers, the match archive and the clan and prize ledgers, and Azure Application Insights for application logs, metrics and traces);
- Google for Firebase (analytics, interface tests and presentation settings after analytics consent; crash reports after crash-report consent; push for players who opt in; nothing for players who refuse both and have not turned on push) and Google Play (app distribution, sign-in and integrity checks);
- Apple for the App Store (app distribution), Sign in with Apple and App Attest;
- Hetzner and Edgegap for match-server hosting;
- Grafana (Grafana Cloud) for collecting server logs and metrics and sending alerts;
- the AI service our flag-sorting and log-watching tools run on (Anthropic's Claude), only under the terms in section 3.5: not yet decided for the test (ask privacy@droapps.dk);
- the e-mail service for support, reports, appeals and the durable-medium answers: not yet decided for the test (ask privacy@droapps.dk);
- the web host for the account-deletion page and the invite links: not yet decided for the test (ask privacy@droapps.dk).
We also share data:
- with Apple or Google when you make a purchase or request a refund. For store and payment data, Apple and Google are independent controllers under their own terms, not our processors: they decide how that data is used and they decide whether a refund is granted;
- with authorities or courts when the law requires it, or to establish, exercise or defend a legal claim;
- with a buyer or successor if the business is sold or reorganised, subject to the same protections.
We do not sell personal data and we do not share it with advertising networks. There is no payment processor beyond Apple and Google as the stores.
6. Transfers outside the European Economic Area
DRO Apps is in Denmark, inside the European Economic Area (EEA). Some of our processors may process data outside the EEA:
- PlayFab (Microsoft) may process personal data in the United States. PlayFab states that game data may be transferred to, stored and processed in the United States, and we have found no EU-residency option for PlayFab.
- Firebase (Google) may process personal data in the United States, but only for the services you have said yes to (section 3.4). A player who refuses analytics and crash reports, and has not turned on push notifications, has no data sent to Firebase.
- Microsoft and Google are certified under the EU–US Data Privacy Framework (DPF), the adequacy decision that allows transfers to certified US organisations. As a fallback, the transfers rely on Standard Contractual Clauses (SCCs), the EU standard terms for transfers outside the EEA.
- The AI service (section 3.5) is provided by a US company. Before any personal data reaches it, the transfer rests on the DPF, if the provider is certified, or otherwise on SCCs with a transfer impact assessment, as recorded in our transfer assessment: not yet decided for the test (ask privacy@droapps.dk).
- The e-mail service and the web host are hosted in the EEA, or the transfer rests on SCCs: not yet decided for the test (ask privacy@droapps.dk).
- The transfer assessment for these transfers is a pre-launch deliverable: it is reviewed in writing and signed by DRO Apps before launch. It is not yet signed.
- Grafana Cloud and Azure Application Insights: not yet decided for the test (ask privacy@droapps.dk). If either processes personal data outside the EEA, or its staff access logs from outside the EEA, we will name the country and the safeguard here before launch.
- Edgegap is a Canadian company. The match servers it runs for us are in the EU. If Edgegap accesses them from Canada, that transfer relies on the European Commission's adequacy decision for Canada (Decision 2002/2/EC), which covers organisations subject to Canada's federal private-sector privacy law (PIPEDA), as Edgegap is.
What we control stays in the EU: the backend, the purchase and results ledgers, the match archive and the clan and prize ledgers run in Azure West Europe; match servers run at Hetzner in Germany with overflow to Edgegap in the EU; and Photon runs in the EU.
The transfer position is reviewed on the outcome of the pending court case C-703/25 P and the announced challenge by the European privacy group noyb, on any change to a provider's DPF certification, when a processor or a country is added, and at least once a year.
7. How long we keep personal data
Each period below is DRO Apps' retention schedule.
| Data | Retention |
|---|---|
| Account, profile, visibility choice, recent-players, block and mute lists | While your account is open. Deleted when the account is deleted, except the records listed below. |
| Consent and 18+ declaration records | While your account is open, plus 1 year, so that the choice can be demonstrated (GDPR Article 7(1)) and a late dispute can be answered. |
| Match archive (K2) | Each match file is deleted when it is at most 30 days old, counting any recovery copy; excluded from backups. Not deleted early when you delete your account (section 8). |
| Match roster | 30 days, then reduced to the per-player result records below; your entries are pseudonymised when you delete your account. |
| Match result records (the results ledger: per-match results and Credits grants) | 13 months after the end of the season they belong to, which covers a season's appeals and audits. Append-only; after deletion your entries are kept under a keyed hash of your former ID (section 8). |
| Result lines kept for a reward replay (a match result whose rewards could not be applied yet) | At most 30 days from the match, then deleted; the result is applied as soon as it can be, and the match result records above are kept as stated there. |
| Match seat snapshots (each player's hidden skill rating, loadout power, party size and share of human players, copied when a match is made, to settle its rank points) | 1 day after the match's result is settled, then deleted; a match whose result never arrives, 1 day after it expires. |
| Leaver warnings and queue bans (the matches you left early in a week, and the end of any queue ban they led to) | The week they count in (at most 7 days), or until the ban ends if that is later, then deleted. |
| Matches per mode (how many online matches you played in each mode on each day, which weigh your hidden skill rating) | 60 days after the game day they count, then deleted. |
| Per-victim daily kill counts (the 10-a-day same-victim cap of weapon progress and the kill boards) | 2 days after the game day they count, then deleted. A count names its victim (a player's ID or an AI player's seat in one match); when you delete your account, every count that names you is deleted too. |
| Ledger backups (copies of the results ledger) | 7 days: one copy each night on our server and one copy pulled to the owner's workstation, the newest 7 of each kept. The match archive is never in them. |
| Server and application logs with IP addresses | 30 days. Metrics without personal data: 13 months. |
| Purchase ledger (what was bought, when, and its Gold tag) | 5 years from the end of the financial year the record relates to, as accounting material under the Danish Bookkeeping Act (bogføringsloven § 12). Purchase records and the Gold grants they created are accounting material; result rows that carry only Credits are not. |
| Store transaction and order identifiers for purchase-fraud prevention | 13 months after the purchase (beyond the stores' refund and chargeback windows), then only the bookkeeping copy above. |
| Prize-grant records (leaderboard prizes and skill-ranked giveaway awards) | 5 years from the end of the financial year the grant relates to, where the grant is accounting material (a Gold prize grant is a transaction in the company's books); otherwise 13 months after the end of the season. |
| Prize ledger (the top 200 of each closed board) | Rows that led to no award: 30 days after the board closes (the appeal window); a row still held for review stays until it is decided. Awarded rows: with the prize-grant record above. |
| Clan ledger (per-match rows) | Until the end of the season after the one they belong to. Per-clan season totals and season-end clan board snapshots carry no player ID and stay with the clan. |
| Collusion and party-abuse records (which players repeatedly played together) | 13 months after the season. |
| Device-integrity flags that led to no action | Deleted at the end of the season in which they were raised (at most 8 weeks). |
| Ban records | A minimal record (the hashed sign-in identity, the date, the category) while the ban stands, which for a permanent ban is indefinitely; this is what refusing a re-link needs, and the purpose lasts as long as the ban. The evidence, including a copy of the flagged match's envelope: 3 years after the decision or the last appeal (the Danish general limitation period under forældelsesloven). |
| Support, report and appeal correspondence | 2 years after the case is closed. |
| Analytics (only after consent) | 2 months (the setting configured in Firebase). |
| Crash reports (only after consent) | 90 days. |
| Push registration identifier | Until you opt out or delete your account. |
| Firebase installation ID | Deleted when you delete your account or withdraw both consents and push; Google states that it then removes the ID from live and backup systems within 180 days. |
| Residual copies in backups | Backups are rotated within 7 days; the match archive is excluded from backups. |
We do not keep personal data for longer than the purpose requires. Where a period is set by law, we keep the data for that period.
8. Deleting your account
You can delete your account in the app and from a web page linked in Google Play's Data safety form.
Deleting your account gives no refund. Before you confirm, the deletion screen warns you that all Gold, items and progress are lost, and shows a link to the store's refund flow (terms, section 10.5), where you can still request a refund of a purchase: DRO Apps supports such a request only for a purchase made in the last 14 days from which nothing has been used; for any other purchase the store alone decides under its own rules, and DRO Apps itself pays no refund.
When deletion is completed, we remove:
- your PlayFab profile, progress, Gold balance, visibility choice, recent-players list, block and mute lists and open invites;
- you from every other player's recent-players list, from your clan's roster and from any party;
- device-integrity flags that did not lead to a ban;
- your rows in the prize ledger that led to no award;
- your per-match rows in the clan ledger, which are replaced by one total per clan and season (matches, wins, rank-point sum) with no match ID and no identifier;
- your Sign in with Apple authorisation (revoked);
- your Firebase installation ID and, if you consented to analytics, the analytics data tied to your analytics user ID (we ask Google to delete both); crash reports you consented to remain for the period in section 7 and are not linked to your account.
What we keep, each for its period in section 7, and nothing else:
- the purchase ledger and prize-grant records, because tax, accounting and fraud prevention require them, under a pseudonym;
- the results ledger rows, which are written once and keep your entries under a scrambled code that cannot be traced back to you from the match archive: the key that makes the code is held in our backend's key store and is not available to anything that reads the archive, so an archive record cannot be linked back to those rows;
- your match archive records, which are not removed one by one: each match file holds a whole match with every player in it and is written once, so your records stay in it, under your former PlayFab ID, until that match file expires at most 30 days after the match (section 7); your match roster entries, pseudonymised, until the same expiry;
- ban records with their evidence and the hashed sign-in identity (section 3.5), to handle appeals and to refuse re-linking the same sign-in identity;
- support, report and appeal correspondence that forms part of a case;
- your consent and 18+ declaration records;
- the purchase-fraud identifiers (K7) for their 13 months;
- per-clan season totals and clan board snapshots, which carry no player ID.
Keeping your match archive records until the file expires is lawful after an erasure request: the records stay necessary for match integrity and other players' disputes for a short, fixed period and are then deleted (GDPR Article 17(3)(e)). They remain personal data for DRO Apps, which holds the key, so they are listed here as retained data.
We act on a deletion request without undue delay and at the latest within one month. For complex requests the GDPR allows two further months; if we need them, we tell you why within the first month (GDPR Article 12(3)). Residual copies in backups are removed within the 7-day backup rotation.
To start a deletion, use the in-app setting or the web page. If you cannot use either, contact privacy@droapps.dk.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify data that is wrong or incomplete;
- erase data (the right to be forgotten), subject to the records we must keep (section 8);
- restrict how we use data while a question about it is resolved;
- port data you gave us to another service, in a machine-readable format;
- object to processing based on legitimate interests, including profiling, the recent-players lists and the "Operator#xxxx" entry on public boards;
- withdraw consent at any time for analytics, crash reports and push — this does not affect processing that happened before you withdrew;
- hide or show your name on the public leaderboards and in other players' recent-players lists at any time in Settings (hidden by default);
- not be subject to a decision based solely on automated processing with legal or similarly significant effects; a person decides bans and held prizes (section 3.5).
To exercise a right, contact privacy@droapps.dk. We may need to verify that the account is yours. We answer within one month of receiving your request. If a request is complex, or there are many, we may extend this by up to two further months, and we will tell you why within the first month (GDPR Article 12(3)).
If you are not satisfied, you can complain to Datatilsynet (the Danish Data Protection Agency). You can also complain to the supervisory authority in the country where you live or work.
10. Security
We limit access to personal data to the people and systems that need it to run the game and support players. We use access controls on production systems and keep service credentials in a managed key vault rather than in the game client or the source repository. The match archive is readable only by our owner's administrator role and the automated cheat-review job.
No system is completely secure. If a data breach is likely to put your rights at risk, we notify Datatilsynet within 72 hours (GDPR Article 33); if it is likely to put them at high risk, we also notify you (Article 34).
11. Changes to this policy
We may update this policy. We will post the new version and update the version and date at the top. If a change is material, or we start using your data for a new purpose (GDPR Article 13(3)), we will tell you in the game or through the store before it takes effect.
12. Contact
DRO Apps, CVR DK45467406, Borup, Denmark. Owner: Daniel Negrescu. All contact is by e-mail:
- Privacy questions, data-subject requests, complaints, appeals and legal matters: privacy@droapps.dk
- Reports of a display name, a clan name or tag, a trademark problem or a suspected minor, open to anyone without an account: privacy@droapps.dk
- Point of contact for authorities under the Digital Services Act: privacy@droapps.dk, marked "DSA"
- Everything else, including support, refund guidance and general player help: support@droapps.dk
This text is the game's bundled tester text, rendered unchanged (game commit f6c6e9d2).