FlyFort is a 1v1 castle battle game. This policy explains exactly what the game collects, why, who else sees it, and how to make us delete it. It is written to be read, not to be survived.
Who we are
FlyFort is operated by Yoav Rubin ("we", "us"). We are the data controller for the personal data described here.
- Privacy contact: support@finplay.me
- Support: support@finplay.me
- Postal address: available on request to the privacy address above.
The short version
| What | Why | Legal basis (GDPR) |
|---|---|---|
| A player id, your trophies, cards, arena and match history | To run the game, match you against an opponent and keep your progress | Performance of a contract |
| Your Google or Apple account id, name and email (only if you sign in) | So your progress follows you to a new phone | Performance of a contract |
| Purchases and entitlements | To give you what you paid for and to restore it later | Performance of a contract |
| Advertising identifier and ad interactions | To show ads, which is how the free game is paid for | Consent (personalised) / legitimate interest (non-personalised) |
| Crash reports, device model and OS version | To find and fix the bug that broke your match | Legitimate interest |
| Product analytics (screens opened, matches finished, approximate location from your IP address) | To see which parts of the game are working | Legitimate interest |
We do not sell your personal data for money. Showing personalised ads does count as "sharing" for cross-context behavioural advertising under California law — see Advertising and your choices for how to switch it off.
What we collect in detail
Playing without an account
You can play without signing in. We create a random player id on your device and store your progress against it. That id is not your name, your email or your phone number, but it is still personal data because it identifies your account, and everything in this policy applies to it.
If you sign in with Google or Apple
We receive your account identifier, and the display name and email address on that account. We use them to link your progress to you and to show your name to your opponent. We never receive your password. If you use Apple's "Hide My Email", we only ever see the relay address Apple gives us.
Gameplay
Your cards, deck, levels, trophies, arena, chests, currencies, and a record of your matches: who played, what was played, and the result. Online match commands are validated on our server, which is also what stops other players cheating against you. Chest contents are drawn by the game on your device, with the odds published in the game and in the Terms.
Purchases
Apple and Google process the payment. We never see your card number. We receive a receipt and the resulting entitlement — for example, that "Remove Ads" is now active on your account.
Ads
Google AdMob receives your device's advertising identifier, coarse location derived from your IP address, and information about the ads you were shown and interacted with.
Technical and diagnostic data
Device model, operating system version, app version, language, and crash reports containing the state of the app when it failed. We ask our crash tool not to attach personal identifiers to these reports. Our analytics and crash tools receive your IP address when the app contacts them and derive an approximate, city-level location from it; we never collect your precise location.
Our website
The site at flyfort.app sets no cookies of its own. When we advertise, the Meta Pixel and the TikTok Pixel can be loaded on the site — but only after you choose Allow in the cookie notice. They then set their cookies and tell Meta or TikTok which pages you visited, that you joined the waitlist, your IP address and browser details, so we can see which ad brought you here. Choose No thanks and nothing loads. You can change your mind at any time from Privacy choices in the site footer. Legal basis: consent. The game itself never loads these pixels.
Who we share it with
These are the companies that process data on our behalf. Each one is bound by a contract to use it only for what we ask.
| Service | What it does | Where |
|---|---|---|
| Neon (Postgres) and Vercel | Stores your account and runs the game servers | European Union |
| Google AdMob | Serves the ads | Global — see Google's policy |
| RevenueCat | Validates purchases and tracks entitlements | United States |
| PostHog | Product analytics | European Union |
| Sentry | Crash reporting | Germany |
| Google and Apple sign-in | Authenticates you, if you choose to sign in | Global |
| Meta Platforms, TikTok | Ad measurement pixels on the website only, and only after you allow cookies | Global — see their policies |
We may also disclose data where the law requires it, or to protect the game and its players against fraud, cheating or abuse.
Advertising and your choices
FlyFort is free because it shows ads. You always have a choice about how they are targeted.
- In the European Economic Area, the UK and Switzerland we ask for your consent through Google's consent form before any personalised ad is requested. You can reopen that form at any time from Settings → Privacy choices in the game.
- On iOS we also ask for App Tracking Transparency permission. If you decline, you still get ads, but they are not personalised. You can change it in iOS Settings → Privacy & Security → Tracking.
- In California you have the right to opt out of the sharing of your personal information for cross-context behavioural advertising. Use Settings → Privacy choices, or email us.
- Anywhere you can buy Remove Ads, which stops interstitial ads entirely.
A rewarded ad is always your choice: you tap it to get the reward, and nothing is taken from you if you close it early. You simply do not get the reward.
Children
FlyFort is not directed to children. You must be at least 13 years old to play — or older, where your country sets a higher age for consenting to online services (16 in parts of the EEA). We do not knowingly collect data from anyone below that age.
If you are a parent or guardian and believe your child has created an account, email support@finplay.me and we will delete the account and its data.
Where your data is stored
Your account and game data are stored in the European Union. Some of our processors are based in the United States; where data reaches them, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision.
How long we keep it
- Account and progress — while your account exists, and for 30 days after you delete it, so an accidental deletion can be reversed.
- Match records — 90 days, for anti-cheat and dispute resolution.
- Purchase records — as long as tax and accounting law requires, typically 7 years. These are kept even after you delete your account, because we are legally required to keep them.
- Crash reports — 90 days.
- Analytics — 12 months.
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it — see Delete my data;
- stop using it for a particular purpose, or withdraw a consent you gave;
- export it in a machine-readable format.
We answer within 30 days and we do not charge for it. We will never degrade the game or your rewards because you exercised a right.
If you are in the EEA or the UK and you think we have got something wrong, you can complain to your national data protection authority. We would rather you told us first, at support@finplay.me.
Security
Data is encrypted in transit. Match outcomes are decided on our server rather than on your device, which is also what protects your trophies from another player's modified client. No system is perfect: if a breach affects you, we will tell you and the relevant authority within the time the law requires.
Changes to this policy
If we change something that matters, we will show it in the game before it takes effect and update the date at the top of this page. Previous versions are available on request.