Privacy Policy

Orb Clash (“we”) is an online game at orbclash.io. This policy explains what personal data we collect, why, who helps us process it, and the rights you have. In short: we collect what we need to run your account and the game, we never sell your data, and you can download or delete everything from Account settings at any time.

Who is responsible

Orb Clash is the controller of your personal data. For any privacy question or request, write to [email protected].

What we collect

If you play as a guest

You can play without an account. We create a random guest name (like “Guest 7K2Q”) and keep it in your browser’s local storage so you keep the same name between visits. Guest progress is not saved on our servers.

If you create an account

• Sign-in details: your email address, the name you choose, your password (stored only as a secure hash by our sign-in provider) and, if you use them, the Google, Apple, Discord or GitHub accounts you link. We also keep a list of your signed-in devices (browser, rough location, last activity) so you can sign them out.
• Game data: your player profile (name, level, experience, wins and matches), coins and diamonds with a history of how they changed, the orbs and effects you own, daily quests and login streak, codes you redeemed, trades with other players, and rooms you hosted.
• Purchases: what you bought, the price and the order reference. Card and billing details are handled by our payment provider; we never see or store them.

When anyone uses the site

• Gameplay statistics: match and round results (which orbs played, who won, how long it took) to balance the game. These statistics are anonymous and are not linked to you.
• Usage analytics: pages viewed and basic device information, and, when you are signed in, your account ID (never your email or name), so we can see how the game is used.
• Error reports: technical details when something crashes, so we can fix it.
• Server logs: IP address and request details kept by our hosting provider for security and abuse prevention.

Why we use it (legal bases)

• To provide the game and your account (performance of our contract with you): sign-in, saving progress, matchmaking, trades, purchases and support.
• Legitimate interests: keeping the game secure and fair, preventing fraud and cheating, fixing errors, and understanding usage to improve and balance the game.
• Legal obligations: keeping purchase records for tax and accounting.
• Email: we send a welcome email when you sign up and messages about your account. We do not send marketing email.

Who processes it for us

We use these providers to run Orb Clash. They process data only on our instructions (or, for payments, as merchant of record under their own terms):

• Cloudflare: hosting, game servers and our database.
• Clerk: sign-in, accounts and session security.
• Polar: payments, as merchant of record (they handle checkout, billing and taxes).
• PostHog (United States): usage analytics.
• Sentry (Germany): error reports.
• Resend: sending account emails.

Some providers are in the United States. Where data leaves the EEA or UK, transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Storage on your device

We use cookies and local storage to keep you signed in, remember your guest name and the room you are in, and to run usage analytics. We do not use advertising or cross-site tracking cookies.

How long we keep it

• Account and game data: until you delete your account.
• Purchase records: kept for as long as tax law requires, with your identity removed when you delete your account.
• Finished trades: kept as part of the other player’s history, with your identity removed when you delete your account.
• Anonymous gameplay statistics: kept indefinitely, as they identify no one.

Your rights

Depending on where you live (including under the GDPR and UK GDPR), you can:

• Access and take your data: use Download my data in Account settings for a full copy.
• Correct it: change your name, email and sign-in methods in Account settings.
• Delete it: use Delete account in Account settings. Your account and game data are erased immediately.
• Object or restrict processing based on our legitimate interests, by writing to us.
• Complain to your local data protection authority.

For anything you cannot do yourself in the app, email [email protected]. We reply within one month.

Children

Orb Clash is not intended for children under 13. In the EEA and UK, players under the age of digital consent in their country need a parent’s permission to create an account. If you believe a child has given us data without permission, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and tell signed-in players about significant changes in the game.