Privacy policy

In this policy, "we" means ReaverGames Ltd, which developed Runewards, released it in 2018, and operates the game and this website today. This policy describes how the game handles your data now, and it replaces the policy published in 2018.

This policy covers the game client, the game servers and this website. It does not cover other sites you may reach from links here, and we cannot control what those sites do. By using the game or the site, you agree to the current version of this policy.

To run an account and a match, the server needs and keeps the following:

• Your account details: username, email address, and a password stored as a hash, never as text we can read. If you sign in with Google or Steam, the permanent identifier that company gives us for your account, so that we recognise you next time.
• A full name, only if you type one into your profile page. It is optional, it is shown to you and to nobody else, other players never see it, and the game does not use it. Clearing the field deletes it.
• Game data: your collection, decks, hero levels, quest and campaign progress, match results, your friends list, and the messages you send inside the game.
• Connection data: your IP address, the time of a login, and the kind of device you signed in from (phone or computer), which the server records as part of keeping the account secure.
• Error reports, generated automatically by the game when something fails. Each carries the error, the version of the game, and a description of your device — model, operating system, graphics hardware, processor and memory — and, if you are signed in, your username and email address, so that we can find the account the fault happened to. They go to our own server and nowhere else.
• Gameplay events, which the game sends to GameAnalytics (see section 03): a match started or finished and how it ended, a card played, a card crafted or salvaged. They travel with an identifier for the device, the device model, the operating system and the game version, and never with your username, your email address or anything else from your account.
• Purchases. If you buy something through Google Play or Steam, that store takes the payment. We receive a receipt naming the product, the price, the time and the store’s reference for the purchase — never your card or bank details — and we keep it so that we can honour the purchase.

Account and game data are used to provide the game: to sign you in, to keep your collection and progress, to match you against another player, and to fix faults. Connection data is used to run and secure the service. Error reports are used to find and fix faults.

Gameplay events are used to understand how the game is played — which modes and cards get used, and where players stop — so that we can balance it and fix what does not work. They are collected for us by GameAnalytics (GameAnalytics ApS, Copenhagen), the one outside company the game itself sends data to. GameAnalytics processes the events on our behalf and under our instructions; it may use them only to provide the service to us and for aggregate, anonymised statistics across many games, and it never receives your name, username or email address. The events are tied to a device, not to your account.

We do not sell your data, and we do not share it with anyone for marketing. We will send you email about the game only where you have asked for it, or where it concerns your own account, such as confirming your address or resetting your password.

We may disclose data where a court order or the law requires it.

We will not knowingly collect personal information from anyone aged 12 or under. If you are a parent and believe your child has created an account, contact us at support@runewards.net and it will be removed. The game is intended for players aged 13 and over.

This website sets one cookie, and only once you sign in. rw_session holds your session token, your player id and your username, so that you stay signed in as you move between pages. It lasts until you close the browser — or up to thirty days, if you asked to be remembered — and signing out deletes it.

Three other things are kept in your browser, none of them a cookie and none ever sent to us. The answer you give in the cookie dialog is kept in this browser’s local storage, so that the notice does not return on every page. On your profile page, the card list the server has already sent is held for the tab you are using, so that moving between pages does not download it again. And once you are signed in, the site notes for that tab that your sign-in is still valid and whether your account is an administrator’s, so that it asks the server once rather than on every page; for nearly everyone the second answer is no, and nothing on the page changes.

There is no analytics on this site. No measurement product, no advertising network, no social media widget and no tracking pixel is loaded on any page — not on some pages, not after consent, not at all. The fonts, images and scripts a page needs are all served from this domain.

Two things come from somebody else, and neither before you ask. The first is the trailer, which is a YouTube player on the home page and the media page. It is not loaded until you press play and agree to it, and you can change or withdraw that answer whenever you like through cookie settings. Once the video plays, Google may store data on your machine under its own privacy policy, which we can neither read nor delete. Until then, pressing nothing means Google is never contacted.

The second is signing in with an outside account — Google or Steam — offered on the sign-in page and on your profile. Pressing one of those buttons is what contacts that company; until you press it, nothing on the page reaches them. Google tells us three things about the account you choose — a permanent identifier, the email address, and the display name. Steam tells us one — a permanent identifier — and, where we hold a Steam Web API key, your public persona name; Steam never shares an email address, so an account created through Steam has none until you add one, and your profile will say so. We keep the identifier so we can recognise you next time, alongside the account it is connected to. We do not receive your Google or Steam password, and we cannot read anything else in either account. Each company sets its own cookies and keeps its own record of the sign-in, under its privacy policy rather than this one. You can disconnect either from your profile at any time, which deletes the identifier we stored; your Runewards account and everything in it stays exactly as it was.

The game client, which is a separate program from this website, stores your settings and a local copy of game content on your device so that it does not have to download them again. On Android the game keeps them in its own app folder, which is removed when you uninstall it. The app asks for no permission beyond network access, shows no advertising and contains no advertising SDK. Signing in with Google inside the game works the same way as on the website: nothing reaches Google until you press the button, and Google then tells us the same three things. Google Play, which delivers the Android app and handles any purchase made through it, keeps its own record of installs and payments under Google’s privacy policy, as Steam does for the Steam version.

Some information is visible to the person you are playing against, and to anyone else you interact with in the game. Your username and your visible match information are part of playing a game against another person.

Anything you type in a public function of the game should be treated as public. We are not able to keep private something you have chosen to tell other players.

We run the servers ourselves, on rented machines in Frankfurt, inside the European Union. Access to the database is restricted, passwords are stored as hashes, and all traffic between the game, this website and the server is encrypted in transit. No system is perfect, and we will tell you if something happens that affects your account.

Your data is kept for as long as your account exists. When the account is deleted — by you, from the game or from this website, or by us at your request — the account and everything it holds are removed at once: profile, collection, progress, friends, messages, and the error reports that name you. Match records are stripped of anything that identifies you. Receipts for purchases are kept, without the account they belonged to, for as long as tax and accounting law requires, and routine server logs are rotated away within a few weeks. Gameplay events already sent to GameAnalytics carry nothing from your account and are kept under its own retention period. The page Delete your account lists all of this in full.

You can delete your account yourself, at any time. In the game: Settings → Delete account. On this website: your profile, Edit profile → Delete account. Both ask you to confirm, then delete the account permanently. If you can no longer sign in, write to support@runewards.net from the address on the account and we will do it for you, within 30 days. The page Delete your account describes all three ways and exactly what is removed.

You can also ask to see what the account holds, or to have it corrected, at the same address. We may decline requests that are repetitive, would need disproportionate effort, or would affect somebody else’s privacy.

Where you have opted in to email about the game, every message includes a way to stop receiving them.

If our answer does not satisfy you, you can take it to a data protection authority: in Israel, the Privacy Protection Authority; if you live in the European Union or the United Kingdom, the authority of the country you live in.

This policy is current as of the revision date above. If it changes, the new version is published on this page, and the revision date changes with it.

Questions or complaints about this policy, or about how the game handles your data: support@runewards.net.