Privacy policy
This policy explains what personal data the game Brindleward collects, why, how long it is kept and how you control it. It applies to the iPhone and Android apps and to the game servers.
- We collect only what the game needs to keep your village and to improve the game.
- No advertising, no advertising identifiers, no third-party analytics or trackers, and we never sell your data.
- An email address or Sign in with Apple is optional, and only used to protect and recover your village.
- Notifications are optional, and you choose which ones you receive.
- Feedback, screenshots and device details are sent only when you choose to send them.
- Our servers are in the European Union.
- You can delete your account at any time in the game: Settings, Delete this game account.
1. Who is responsible
Koi Bridge (Singapore) operates Brindleward and is responsible for your personal data (the data controller).
- Registered address: 68 Circular Road, #02-01, Singapore 049422
- Registration number (UEN): 202419939R
- Contact for privacy questions and requests: clement@koibridge.com
2. What we collect and why
Your game account
When you start playing, the server creates a player account with a random identifier and a random access key. Your device keeps the key; the server stores only a one-way hash of it. The account also receives a village code that you can share with neighbours. We use this to keep your village on the server and to recognise your device.
Email account (optional)
If you protect your village with an email address, we store the address, a one-way hash of your password (never the password itself) and the date the address was verified. To verify the address or reset the password we send an 8 digit code by email; the code is stored only as a hash and expires after 15 minutes. We use your email address only for these account messages, never for marketing.
Sign in with Apple (optional)
If you link Sign in with Apple, we store the identifier Apple gives to our app for your Apple account and an Apple refresh token, encrypted. The token is kept only so that we can revoke the link with Apple when you delete your account. We do not store the name or email address Apple may share.
Game data
The server stores your village and progress: buildings, resources, specialists, research, battles, rewards, records, decorations and settings that affect play. It also keeps a history of the game commands your device sent and their results, so that a command is never applied twice and the game stays fair.
Neighbours
If you exchange village codes with other players, we store the neighbour links, invitations, daily supplies, encouragements and invitation rewards. Your neighbours can see your village name, level, buildings and decorations. They never see your email address or your account details.
Notifications (optional)
If you allow notifications, the game schedules its reminders on your device, for example when a building is finished; these reminders never leave your device. To receive messages sent by our server, such as supplies from a neighbour, your device gives the game a push token issued by Apple or Google. We store that token with your player identifier, your language, your time zone offset and the app version, only to deliver these messages in your language and never at night, and we keep a record of the messages sent for 30 days to respect a daily limit. A push token is not an advertising identifier and is not used to track you. You can turn notifications off at any time in the game (Settings, Notifications) or in the settings of your device.
Gameplay events
To learn whether the game is fun, where players get stuck and what breaks, the game records a small set of events, linked to your player identifier. They contain no free text, no device identifier and no IP address. We collect them ourselves; no analytics company receives them.
| Event | Recorded when | Details kept |
|---|---|---|
session_start | the game connects and loads your village | none |
level_start | a new level is shown | level number |
level_complete | you complete a level | level number |
battle_start | a battle begins | mission |
first_combat_reached | you enter your first battle (once) | mission |
battle_result | a battle ends | mission, victory or defeat, number of turns |
quit_point | the game is closed or sent to the background | the last screen shown |
client_error | the app detects an error | error type, place in the app, app version and build number (at most 20 per day) |
Feedback and surveys (optional)
The game has a form to report a problem or share an idea, and test versions may ask a few short questions after some levels. Nothing is sent unless you press Send. When you do, we receive:
- what you wrote and the topic you chose, or your answers to the questions;
- a screenshot of the game screen, unless you turn off Include screenshot;
- technical details: the screen and level you were on, the current mission and battle turn, the app version and build number, the platform, device model, system version, language and screen size;
- an error fingerprint: a one-way hash of the last error lines recorded by the app and how many there were, never the messages themselves.
This is linked to your player identifier, so that we can understand what happened in your village. We use it only to fix problems and improve the game, never for advertising or to track you.
Connection data
Like any online service, our servers receive the IP address of your device and the language it prefers when it connects. The language is used to answer in your language and is not stored. The IP address is used to deliver the response and, in a short-lived counter keyed by a one-way hash of the address, to limit abusive request rates; these counters expire within minutes. The game server does not write IP addresses into its database or access logs. Technical error logs, which contain no IP address, are kept for at most 14 days.
What we do not collect
We do not collect your location, contacts, photos, microphone, advertising identifier (IDFA or Android advertising ID), payment data or browsing history, and we do not track you across other apps or websites. The game currently has no advertising and no purchases.
3. Legal bases
Under the EU General Data Protection Regulation (GDPR) we process your data:
- to provide the game you asked for (performance of a contract): account, game data, neighbours, optional email or Apple sign-in;
- for our legitimate interests in keeping the service secure and in improving the game: rate limiting, error logs, gameplay events;
- for feedback and survey answers, our legitimate interest in fixing problems and improving the game, limited to what you choose to send;
- to comply with legal obligations where they apply.
Under the Singapore Personal Data Protection Act 2012 (PDPA), we collect, use and disclose personal data only for the purposes described in this policy, which we notify to you here, and you may withdraw your consent at any time by deleting your account or contacting us.
4. Who receives your data
We do not sell, rent or share your personal data for advertising. Only these service providers process it on our behalf, under contract and only to run the game:
- our hosting provider, which runs the servers and stores the backups in the European Union;
- our email delivery provider, which sends verification and recovery codes when you use an email account;
- Apple, when you use Sign in with Apple, to confirm your identity and to revoke the link when you delete your account.
- Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging), when you allow notifications, only to deliver them to your device.
Apple and Google also process data when you download the game or test it (TestFlight, Google Play), under their own privacy policies. We may disclose data if the law requires it, for example to answer a valid order from a court or an authority.
5. Where your data is stored
The game servers, database and backups are hosted in the European Union. Koi Bridge is based in Singapore, so its team may access the data from Singapore to operate the game and answer support requests. Such access is protected by the safeguards required by the GDPR, such as the standard contractual clauses of the European Commission where needed, and by the protection obligations of the PDPA.
6. How long we keep it
| Data | Kept |
|---|---|
| Account, email, Apple link, game data, neighbours, command history | until you delete your account |
| Push tokens and notification settings | until you delete your account or turn notifications off, and at most 180 days after the game last ran on that device |
| Record of notifications sent | 30 days |
| Email verification and recovery codes | 15 minutes, or until used |
| Gameplay events | 13 months, then deleted |
| Feedback, survey answers and screenshots | 180 days, then deleted |
| Rate limiting counters | a few minutes |
| Technical error logs | at most 14 days |
| Database backups | 14 days, then overwritten |
7. Deleting your account
In the game, open Settings and choose Delete this game account. Deletion is immediate and cannot be undone:
- your village, progress, command history, neighbour links, gifts and encouragements are deleted;
- your email address, password hash and Apple link are deleted, and the link with Apple is revoked;
- your push tokens, notification settings and the record of notifications sent are deleted;
- your gameplay events are separated from you: the player identifier is removed, and what remains is kept only as statistics until the 13 month limit;
- your feedback, survey answers and screenshots are separated from your player identifier and deleted at the 180 day limit; to have them deleted sooner, write to clement@koibridge.com;
- copies in backups disappear when the backups are overwritten, within 14 days.
If you can no longer open the game, write to clement@koibridge.com from the email address linked to your village, or include your village code, and we will delete the account for you.
8. Your rights
Depending on where you live, you have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw consent. Players in the European Union have these rights under the GDPR and may complain to the data protection authority of their country. Players in Singapore have rights of access and correction under the PDPA and may complain to the Personal Data Protection Commission.
To use a right, write to clement@koibridge.com. We answer within one month, and may ask you to prove that the village is yours, for example with your village code shown in the game.
9. Children
Brindleward is not directed at children under 13 and we do not knowingly collect personal data from them. The game contains mild fantasy combat, no chat and no content written by other players, and its store age ratings reflect this. If you are under the age at which you may agree to data processing in your country, ask a parent or guardian before creating an email account. If you believe a child has given us personal data, contact us and we will delete it.
10. Security
All connections use HTTPS. Access keys, passwords and codes are stored only as one-way hashes, Apple tokens are encrypted, the database is not reachable from the internet, and backups are made daily. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities as the law requires.
11. Changes
We will update this policy when the game changes what it collects. The date at the top shows the latest version. For an important change we will tell you in the game before it applies.
12. Contact
Questions about this policy or your data: clement@koibridge.com
Write to us