Privacy Policy
Last updated: October 5, 2026
This policy explains what data the game STRATUM ZERO (Android) processes, why, for how long, and what your rights are. We collect the minimum needed for the game to work: we do not ask for your real name, email or phone number, we show no ads, and we do not sell or share data with anyone for advertising. You do choose a player name, which other players can see on the leaderboards.
1. Controller
Syrzechs Studios · Cristian Vaquero, Spain
Contact email: [email protected]
For any privacy matter, write to that address and include your Player ID (shown in Settings → Account).
2. What data we process and why
| Data | What it is | Why | Legal basis (GDPR) |
|---|---|---|---|
| Device identifier | A code the app generates or reads on your phone the first time you open it, plus a secret key known only to your phone (on the server we store only a one-way hash of that key) | To create your guest account and let your phone sign in to it without a password | Performance of a contract (Art. 6(1)(b)): without it there is no saved game |
| Guest account | A random Player ID, the date it was created and the date of your last sign-in | To keep your saved game on the server | Performance of a contract (Art. 6(1)(b)) |
| Player name and avatar | The name you choose when you start (letters, numbers and "_") and the Gemkin portrait you set as your avatar | So you are recognized in the game. Other players see your name next to your times on the dungeon leaderboards | Performance of a contract (Art. 6(1)(b)) |
| Age and acceptance | The month and year of birth you give us when you start; the version and date of the terms and policy you accept; and, if you buy, the country of your Google Play account | To check the minimum age (16) and the purchase cap for 16-17 year olds; to be able to show what you accepted; not to sell paid geodes where the law does not allow it | Legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)) |
| Google link (optional) | If you link your account, the identifier Google gives us for your Google account and the date of the link. We never receive your password. We do not store your email or name | So you do not lose your progress and can play on another phone; to allow purchases | Performance of a contract (Art. 6(1)(b)) |
| Saved game | Your Gemkin, runes, in-game currencies and their movements, story and dungeon progress, teams, settings and battle history (team, result, seed and date) | For the game to work and be fair: the server plays and checks every battle and hands out the rewards | Performance of a contract (Art. 6(1)(b)) and legitimate interest in preventing cheating (Art. 6(1)(f)) |
| Purchases | For each purchase: the store (Google Play), the transaction ID and the receipt Google gives us to verify it, the product, the Prismas delivered, the date, and the fact that you accepted the "no refunds" notice (time and text version). We never see your card details: Google handles the payment | To deliver what you bought exactly once, verify the payment is genuine, remove the items if the payment is reversed, handle claims and comply with accounting law | Performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) and legitimate interest in preventing fraud (Art. 6(1)(f)) |
| Technical logs | The IP address the game connects from, the date and time, which request it made and server errors | To keep the server running, curb abuse (per-IP request limit), and investigate failures and attacks | Legitimate interest in the security of the service (Art. 6(1)(f)) |
What we do not do: no ads or advertising ID, no cross-app tracking, no advertising profiles, and no automated decisions with legal effects on you. The server does automatically reject battles or purchases that do not add up (for example, a fake receipt), only to protect the game.
3. Who we share it with
We do not sell your data. Only these providers process it, on our behalf and under contract:
- Server hosting and backups: during the beta, our own server located in Spain; later, Hetzner Online GmbH, with servers in the European Union (Germany or Finland).
- Connection to the server: Cloudflare, Inc. routes the game's connections to our server and sees the IP address and requests. It is a US company certified under the EU-US Data Privacy Framework.
- Google (Google Play, Sign in with Google and Google Play Billing): to link your account and process payments, Google processes data as an independent controller under its own privacy policy: https://policies.google.com/privacy
- Authorities, only when the law requires it.
4. Where your data is stored
On servers located in the European Union. Cloudflare may process your IP and requests outside the EU, under the EU-US Data Privacy Framework. What Google processes on its own account is governed by its own policy and its safeguards for international transfers.
5. How long we keep it
| Data | Period |
|---|---|
| Account, saved game and Google link | For as long as the account exists. If you ask us to delete it, it is erased within 30 days at most |
| Unlinked guest accounts with no sign-in for 24 months | Deleted automatically |
| Technical logs | 30 days |
| Backups | Renewed daily; old ones are deleted within 30 days at most, so anything you delete also disappears from backups within that period |
| Record of each purchase (transaction, product, date, Prismas and notice acceptance) | 6 years from the purchase, for accounting obligations and to handle claims. If you delete your account, this record is kept separately from everything else and only for those purposes |
6. Your rights
You can request access to your data, rectification, erasure, restriction, portability (a copy in a readable format), and you can object to processing based on legitimate interest. Email the address in section 1 with your Player ID; we will reply within one month at most. To protect your account, we may ask you to prove it is yours (for example, with a code the game shows you or by signing in with the linked Google account).
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority in your country.
7. How to delete your account
In the game: Settings → Account → Delete account. The game asks you to confirm; once you do, the account stops working immediately and its data is erased from the server within 30 days at most.
On the web, without installing the game: go to the Delete your account page on this same website (its address ends in /delete-account) and follow the steps. You will need to give us your Player ID and prove the account is yours: by signing in with the linked Google account or with the deletion code shown in Settings → Account. If you cannot do it on the web, email the address in section 1.
What is deleted: the device identifier and its key, the account, the Google link, your Gemkin, runes, currencies, progress, teams, settings and battle history, and your technical logs. What is kept and for how long: only the purchase records (section 5, 6 years), kept separately from everything else. Deleting your account cannot be undone and does not entitle you to a refund of anything purchased.
If you play as a guest, no longer have the phone and never linked the account, we have no way to know which account is yours; it will be deleted automatically after 24 months without use.
8. Children
The game is not directed at children under 16 and they must not use it. When you start, the game asks your age: if you are under 16, you cannot continue. Between 16 and 17, purchases have a monthly cap. If you are a parent or guardian and believe a child under 16 has an account, email us at the address in section 1 and we will delete it.
9. Security
Communication between the game and the server is encrypted (HTTPS). Your phone's key is stored only as a one-way hash, the database is not reachable from the internet, and only the people who run the game can access it.
10. Changes to this policy
If we change it, we will publish the new version on this page with its date and, if the change is significant, we will let you know in the game.