Privacy Policy
Last updated: 2026-09-14
This policy explains what Pixel Kingdom Wars collects, why, who else sees it, how long we keep it, and what you can ask us to do about it. It describes the game as it actually works today.
The short version
- Your wallet address is your account. Everything you do in the game is stored against it.
- Your wallet address, your land deed and every on-chain transaction are on a public blockchain permanently. We cannot delete those public records. Gameplay and custody-ledger activity is stored by us off-chain.
- We also hold an email address if you set one up for two-factor codes, plus your name, avatar, gameplay records and chat.
- We use analytics and error reporting. Both identify you to the vendor by a pseudonymous code, never your wallet or email. There is currently no in-app switch to turn them off — see section 10.
- There is currently no self-service "delete my account" button. Email us and we will do it by hand — see section 12.
- We never ask your device for your location and never look it up from your IP address, and we never see your private key.
1. Who is responsible for your data
The controller of your personal data is Pixel Kingdom Wars, an independent development project. Contact us about anything in this policy at support@pixelkingdomwars.com.
We are a small independent developer and have not appointed a data protection officer; support@pixelkingdomwars.com reaches the person who handles these requests. We have not appointed a representative in the EU or the UK under Article 27 of the UK/EU GDPR.
2. What we collect and why
We collect only what the game needs. There are no advertising trackers in the game.
| What | Why | Legal basis (UK/EU) |
|---|---|---|
| Your Solana wallet address. This is your account identifier and appears throughout our database. | Signing you in, owning your base, land and balances, and every payment path. | Performance of our contract with you. |
| Display name and rename history. | Your public identity in the game; uniqueness stops impersonation. | Contract. |
| Profile picture, if you upload one. We decode and re-encode it to a 256px WebP image; the original file, its filename and any EXIF data (including any camera GPS tag) are discarded and never stored. | Your public avatar on the world map and rosters. | Contract. |
| Email address, if you add one, plus a pending address while you change it. | Account security contact and two-factor codes for withdrawals and key export. | Contract; and our legitimate interest in securing accounts. |
| Two-factor data: an authenticator secret (encrypted), one-time email codes (stored only as a keyed hash, never in readable form), the email they were sent to, failed-attempt counts and lockout times. | Protecting withdrawals and account changes; blocking brute force. | Contract; legitimate interest in security. |
| Sessions and sign-in challenges: session records, issue/expiry/revocation times, and single-use nonces bound to your wallet. | Keeping you signed in, letting you sign out everywhere, and stopping signature replay. | Contract; legitimate interest in security. |
Solana Mobile Seeker link, if you verify one: your Seeker wallet address, the Genesis Token mint, member number and verified .skr domain. |
Proving one physical device backs at most one account, which is how we keep the playtest free of farmed accounts. | Legitimate interest in preventing multi-accounting and abuse. |
| Historical playtest application, if you applied before open access: your email address, any handle and social links you gave, and your free-text answers, plus our reviewer notes, the invite code issued and the wallet that redeemed it. The former form did not ask for a wallet address. Open access no longer collects applications or issues invite codes. | Retaining the historical application and admission record; access is now open to everyone. | Steps taken at your request before entering a contract. |
| Chat: message text, your wallet, and your name and Seeker badge frozen as they were when you sent it. Reports include a full copy of the reported message, its author's wallet and name. We also keep mutes, blocks and a moderator action log. | Running public chat and moderating it; keeping evidence that survives a deleted message. | Contract; legitimate interest in a safe community. |
| IP address. For chat rate limits we store only a keyed hash, never the address itself. The raw address is used as a short-lived key in our own rate-limiting store (Redis, on our server in Germany), where it expires within the rate-limit window; the retired application bot check previously sent it to Cloudflare Turnstile; and it appears in our server request logs. | Blocking bots, spam and abuse. | Legitimate interest in security and abuse prevention. |
| Money records: deposits and withdrawals, including amounts, token mints, transaction signatures and the destination address you withdrew to; your ledger accounts and every ledger entry; and a weekly proof-of-liabilities record pairing your wallet with your exact balance. | Crediting you correctly, paying out correctly, and proving we hold what players are owed. | Contract; legitimate interest in accurate and auditable accounting. |
| Marketplace listings: seller and buyer wallets, price, payment signature and settlement time. The payment splits 95% to the seller and 5% to us, so our fee is part of the same public transaction. | Settling player-to-player trades and resolving disputes. | Contract. |
| Campaign participation and awards: opt-in time, qualifying activity by UTC day, scores and streaks, original deed-mint and close-time ownership evidence, frozen wallet/name snapshots, submitted report identifiers or public video-post URLs, judging notes, award decisions and external payment references. | Running the campaigns, publishing aggregate activity and shortened-wallet standings, verifying eligibility, judging entries and documenting rewards. Private reports and judging notes remain restricted to their authorized participants and staff. | Contract; legitimate interest in fair competitions, abuse prevention and audit records. |
| Referrals: who referred whom, when it qualified, and your referral code. A pending optional code is held in your browser through sign-in and sent to us to apply attribution. Failed requests may be retried; only one referrer can be recorded per wallet. | Running the referral rewards and its anti-abuse gate. | Contract; legitimate interest in preventing farming. |
| Gameplay records: last seen time, daily activity counts, streaks, quest, tutorial and campaign progress, item uses, forge contributions, raid history and full battle replays; clan membership; your land parcel's position on the in-game globe; and saved HOME and FARM layouts containing building identities and tile positions. | Making the game work — streaks, quests, matchmaking, revenge, replays, the world map and your saved base arrangements. Layouts belong to the deeded base and transfer with it. | Contract. |
| In-game mail sent to you, including subject, body and any reward attached. | System and admin notifications, and reward delivery. | Contract. |
| Product analytics and error reports. See section 10. | Understanding where the game breaks and where players get stuck. | Legitimate interest in maintaining and improving the game. You can object — section 10 explains what we can and cannot do about it today. |
We do not collect your real-world location. The game never asks your browser for it and we never look it up from your IP address. The "country" and map tile shown on a land deed are a position you chose on a stylised game globe. They are not a measurement of where you are.
We do not collect government IDs, payment card details, health, biometric or genetic data. We take no real money, so we hold no payment information.
Optional push notifications. If you enable them, we link a delivery registration to your wallet. For Web Push we store the subscription endpoint, encryption keys and browser user-agent string. For native Android notifications, when available, we store the Firebase Cloud Messaging registration token, an installation consent identifier and the app package name. We also keep registration and consent times, last successful delivery, failure counts, disabled or revoked status, and event identifiers and delivery outcomes. These records deliver the alerts you requested, avoid repeat sends and keep old registrations from being reused incorrectly. See sections 5, 7 and 8.
3. What other players can see
The game is social, and some of what you give us is public by design. Other players can see your display name, your avatar, your keep level and trophies, your clan tag, your Seeker badge, whether you are online, and whether your base is shielded or was recently raided. Chat messages carry your name and badge as they were when you sent them. Your wallet address is visible to other players in parts of the game interface, and your land deed's ownership is public on the blockchain.
One thing worth knowing: the public web address of your uploaded avatar image contains your wallet address. Anyone you send that image link to can read your wallet address from it, and anyone who has the link can fetch the image without signing in. Treat your avatar URL as public.
4. What goes on the blockchain — public, worldwide and permanent
Some of what you do is written to Solana devnet, a public blockchain. Once written it is public, permanent and replicated to computers all over the world. We do not control the network, its validators or the people who index it, and we cannot edit or delete anything on it — ever.
Written on-chain: your wallet address; your player account record; your Land Deed NFT, its current holder, its royalty terms and a link to its metadata; every devnet SOL or KEEP transfer to or from your wallet, including land purchases, marketplace payments and withdrawals; and a weekly Merkle root summarising all player balances.
A deed's traits — its in-game location name, country, map tile, keep level, building count, land size and founding date — are not on the blockchain. They live in a metadata document we generate from live game state and publish on hosting we control, so unlike the chain record we can change or remove it. Anyone who has already read or indexed that document may keep their own copy.
Deliberately not written on-chain: your real latitude and longitude, your display name, your email address and your avatar.
A wallet address is personal data whenever it can be connected to a person — and we hold exactly the records that could make that connection, such as an email address linked to a wallet. That is why our deletion process focuses on breaking that link. See section 12.
Because on-chain records are replicated worldwide by design, they leave the UK and the EEA and cannot be geographically restricted. You should understand this before your first on-chain action.
5. Who else processes your data
| Who | What they do | What they get | Where |
|---|---|---|---|
| Privy | Social and email login, and embedded wallets | Your Google or X identity or your email address. Privy also sets its own cookies and browser storage on the game's own domain, and holds the embedded wallet key material. We never receive your social identity or email from Privy, and we never see your private key — key export happens entirely inside Privy's own interface. | United States |
| Hetzner | Hosting for the game server and database | Everything in section 2 that we store | Germany |
| Cloudflare | Website hosting, image and file storage (R2), and bot checks (Turnstile) | Avatar images and deed metadata, stored in a publicly readable bucket. The former application form used Turnstile, which received your raw IP address and browser signals when its bot check loaded and when a submission was verified. The open-playtest page no longer loads that form or bot check. | Global edge network |
| Resend | Sending our emails | Your email address and the content of the message — two-factor codes, key-export codes and historical playtest invites | United States |
| Your browser's push provider (for example Google, Mozilla, Apple or Microsoft) | Delivering optional Web Push notifications | The push endpoint and delivery metadata, with the notification message encrypted for your browser. Your browser connects directly to its push provider. | Depends on the provider; see your browser's push-service privacy information |
| Google Firebase Cloud Messaging (FCM), when native notifications are available and enabled | Delivering optional native Android notifications | The app's registration token and package, notification title/body and destination link, and consent/event identifiers. Message text can include an attacker's display name or an in-game mail subject. The Firebase SDK also sends installation identifiers and configuration data to Google. The delivery identifier is a token, not your wallet address; wallet credentials are not sent. | Global Google infrastructure; see Firebase's privacy and security information |
| PostHog | Product analytics | A pseudonymous ID, event names and limited properties. No wallet address, no email, no chat. Because we relay events from our own server, PostHog sees our server's IP address, not yours. | United States |
| Sentry | Error monitoring | Error messages, the file and line that failed, and the same pseudonymous ID. Also relayed from our server, so Sentry does not see your IP address. | Germany |
| Solana RPC providers (including Helius and Alchemy) | Reading and submitting blockchain data | Your wallet address and its transaction and token history. To verify a Solana Mobile Seeker we query two independent providers on Solana mainnet with your Seeker address, so the badge does not depend on a single source. Your browser also talks to an RPC endpoint directly, which means that endpoint sees your wallet address and your IP address. | United States and global |
| Solana Mobile | Operates the Solana dApp Store | Under its developer agreement, Solana Mobile may request data about the game, including data about player transactions made through it. | United States |
We do not sell your personal data and we do not share it for advertising. There are no advertising trackers or ad networks in the game.
6. International transfers
Our servers are in Germany. Several providers above are in the United States. Where we send personal data outside the UK or the EEA, we rely on the provider's certification under the EU–US Data Privacy Framework where it holds one, and otherwise on the European Commission's Standard Contractual Clauses together with the provider's own security measures. Ask us at support@pixelkingdomwars.com and we will tell you which applies to a given provider.
Blockchain data is different, and section 4 explains why: it goes everywhere, permanently, and no transfer mechanism can pull it back.
7. How long we keep things
Some of this is automatic. Some of it is "indefinitely", as the table shows.
| What | How long |
|---|---|
| Chat messages | Deleted after 7 days, automatically, unless an abuse report is attached to the message. A reported message is kept for as long as the report is — 90 days — whether or not the report was resolved. |
| Chat abuse reports (including the copied message and its author) | Deleted after 90 days, automatically |
| Hashed chat rate-limit records | Deleted after 2 days, automatically |
| Raw IP rate-limit keys in our Redis store | Expire automatically within the rate-limit window — seconds to minutes |
| Chat mutes, chat blocks and the moderator action log | Kept indefinitely. Nothing purges them: a mute, a block or a moderation record that expired on its own would be reset by leaving and coming back |
| A replaced or removed avatar image | Stops being shown in the game immediately. The stored file is deleted by a background job, normally within minutes; until then it can still be fetched from its old address, and caches may keep serving it for a few minutes after that |
| Unclaimed in-game mail rewards | Expire on a daily schedule; the message itself is kept |
| Your account, name, email, avatar pointer, two-factor data, sessions, sign-in nonces, one-time-code records, playtest application, Seeker link, deposits, withdrawals, ledger, balances, marketplace listings, referrals, clan membership, raids, replays and all gameplay progress | Kept indefinitely until you ask us to delete them. We have no automatic deletion for any of it. |
| Push notification registrations, native consent revocations and notification event/delivery records | Kept indefinitely; there is no automatic purge. Opting out disables registrations rather than deleting their stored endpoints, keys or tokens. Native revocation records prevent delayed requests from restoring withdrawn consent. Provider-held records follow that provider's retention rules; turning notifications off is not a request to erase every provider record. |
| Server request logs, which contain IP addresses | No fixed deletion period is set, and no job removes them. |
| Anything on the blockchain | Forever. It cannot be deleted by us or by anyone. |
8. Cookies and what the game stores on your device
We set one cookie of our own: shardkeep_session, which keeps you signed in. It is httpOnly, same-site, secure in production, and lasts seven days. If you sign in with a social account or an email address, our login provider Privy sets its own cookies and browser storage on the same domain. The retired application form used Cloudflare Turnstile browser storage; the open-playtest page no longer loads it. All of these are strictly necessary — to sign you in, or to keep bots out — so we do not ask consent for them. We set no advertising or tracking cookies, which is why there is no cookie banner.
The game also stores things in your browser. Browser-held data can reach us. Your pending optional referral code is held on your device through sign-in and sent to us, with retries after failures, to credit your referrer; a marker recording that you launched from the Solana Mobile client is read at start-up and sent with analytics events as a platform flag; and, during a one-release migration, the layout editor can read an older skp_layouts copy and send its exact building identities and tile positions when you choose to import and save it. A device marker records a successful import so it is not offered again. Your current HOME and FARM layouts are stored on our server against the deeded base, not only in your browser. Notification registration data also reaches us when you opt in, as described below.
The rest stay on your device and are not sent to us: your last selected base, the name of the wallet you last connected, whether you have seen the playtest guide, a per-session flag that stops a notice repeating, and your reduce-motion, haptics, sound, music and landscape preferences. The game caches its own artwork and code for offline play; no personal data is in that cache. Clearing your browser data removes all of it, but does not delete layouts already saved on our server.
Notifications are optional and use server push. Turn on NOTIFICATIONS in the game's Settings and grant the browser or Android permission when requested. Web notifications use your browser's push service; native Android notifications use FCM when that service is available. Alerts can cover a raid on your base, completed building or training work, in-game mail and full mines where enabled. They can arrive while the game is not open.
Your device keeps the notification preference and registration information so it can refresh the registration and reject messages for an old or signed-out session. You can turn notifications off in the game or revoke permission in browser or Android settings. Game opt-out unsubscribes the browser or deletes the native messaging token and requests server-side retirement; network failures can delay server cleanup. Native account logout also revokes its known native registrations. These actions do not erase the retained records described in section 7.
9. Security
What we actually do: authenticator secrets are encrypted at rest with AES-256-GCM using a rotatable key bound to your wallet; one-time email codes are stored only as keyed hashes and never in readable form; chat rate-limit records store a keyed hash of your IP rather than the address; uploaded images are decoded and re-encoded so the original file and its EXIF metadata never reach storage; the session cookie is httpOnly and same-site; and traffic is encrypted in transit with HTTPS.
We never hold your private key. For self-custody wallets we only ever see your public address. For embedded wallets the key material is held by Privy, key export is protected by a fresh wallet signature and a two-factor code, and the key is revealed inside Privy's own interface without ever touching our servers.
No system is perfectly secure. If a breach puts your rights at risk we will notify the relevant supervisory authority within 72 hours and tell you without undue delay where the risk to you is high.
10. Analytics and error reporting
We measure how the game is used, and we collect crash reports, because otherwise failures are invisible to us.
You are identified to these vendors by a pseudonymous ID: a keyed, truncated hash of your wallet address computed on our server, so your wallet address itself never reaches the vendor. Before you sign in, a random per-tab ID is used instead. We call it pseudonymous, not anonymous, because we hold the key that produced it.
What is sent: event names such as opening the app, finishing a tutorial step, completing a raid or minting a deed; a build version and commit; whether you are on Android, iOS or desktop, and whether you launched from the Solana Mobile client; short error messages with the file and line that failed; and, when you redeem an invite or referral link, the code you used. What is not sent: your wallet address, your email, your name, chat content, tokens, signed payloads, your raw user-agent string, or your IP address. That second list is enforced by what the game chooses to send, not by a filter on our relay.
There is currently no in-app setting to turn analytics or error reporting off, and no consent banner; they start when the game loads. If you object, email support@pixelkingdomwars.com and we will delete the analytics and error records held under your pseudonymous ID. We cannot yet stop new events being sent while you keep playing, because that switch does not exist in the software.
11. Your choices and controls in the game
- Sign out — clears your session cookie and revokes every active session on your account.
- Change your display name — subject to a cooldown between changes.
- Replace or delete your profile picture — deleting clears it immediately and queues the stored file for deletion.
- Change your email address, or turn off your authenticator with a current code.
- Export your embedded wallet's private key — real portability for your funds, protected by a wallet signature and a two-factor code.
- Block another player in chat, and report a message to moderators.
- Cancel a pending withdrawal during its cooldown window.
- Unlink a Seeker device. Be aware this is deliberately a soft unlink: we mark the link revoked but keep the Seeker address and token record permanently, so unlinking and relinking cannot be used to farm accounts. That record is not erased by unlinking.
One control is not in the game yet: you can ask us for proof that your balance is included in the weekly on-chain liabilities root. Our API exposes it, but no screen does, so today it is an email to support@pixelkingdomwars.com.
12. Deleting your account and your data
There is no self-service account-deletion button in the game today. Deletion is a manual process and this is how it works:
Email support@pixelkingdomwars.com from the address on your account and say you want your account deleted. We will verify it is you — usually by asking you to sign a short message with your wallet, which proves control without exposing anything. We will complete the deletion within 30 days and confirm when it is done. If your request is unusually complex we may need longer, and we will tell you before the 30 days are up.
What we delete: your email address and any pending address; your display name; your avatar image and its record; your two-factor secrets and one-time-code records; your sessions and sign-in challenges; your playtest application, including your answers and social links; your chat messages and your profile data; your gameplay records and progress; and your analytics and error records.
What we keep, and why:
- Financial and ledger records — deposits, withdrawals and ledger entries — where we need them for accounting integrity, to prove solvency to other players, or to defend a legal claim. We keep the minimum and detach it from your identity where we can.
- Abuse and anti-sybil records: chat mutes, chat blocks, the moderator action log, moderation evidence for its 90-day life, and the Seeker link record — each of which a ban, a block or a device link would otherwise reset trivially. This is a legitimate interest we will explain to you if you ask.
- Server logs, which as section 7 says have no fixed deletion period.
What we cannot delete: anything on the blockchain — your wallet address, your land deed and its transfers, your transactions, and the weekly balance roots. They are public and permanent and no one can remove them. What deletion achieves is the removal of the links we hold between that public address and you as a person, so the on-chain record can no longer be attributed to you using information we have. A determined third party using blockchain-analysis tools may still be able to draw conclusions from public chain data, and that is outside our control.
Where a record cannot be corrected on-chain, the equivalent remedy is a new transaction that supersedes the old one. The original remains visible.
13. Your rights
These rights are yours wherever you live. The UK and EU give people a specific set of data rights; rather than hand them only to players in those countries, we give them to every player. You have the right to: get a copy of your data; correct it; delete it; restrict or object to how we use it — including an absolute right to object to direct marketing; receive it in a portable format; and withdraw consent at any time without penalty where we relied on it.
To exercise any of them, email support@pixelkingdomwars.com. It is free and we will respond within one month. If a request is complex, or you make several, we may take up to two further months — we will tell you within the first month if that happens, and why. We will verify your identity first, normally with a signed message from your wallet. If you contact us about a wallet address alone and we genuinely cannot connect it to you, we may ask for more information before acting.
If you are unhappy with how we handled it, please tell us first — then, if you are still unhappy, you can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk/make-a-complaint). In the EEA it is the authority where you live or work.
14. If you are in California or another US state
In the past 12 months we have collected these categories of personal information: identifiers (wallet address, display name, email address, IP address); commercial information (deposits, withdrawals, marketplace trades and in-game balances); internet and network activity (gameplay events, analytics events, error reports, server logs); and audio, electronic or visual information (your uploaded profile picture). We collect them from you, from your device, and from the public blockchain. We use them for the purposes in section 2 and disclose them for those purposes to the providers in section 5.
Sensitive personal information. The only category we hold is the security credentials that protect your account: your encrypted authenticator secret and the one-time codes we email you. We use them solely to sign you in and to protect withdrawals and key export, never to infer anything about you, so the right to limit their use does not arise. You can still remove them by turning two-factor off, or by asking us to delete your account.
We have not sold your personal information, and we have not shared it for cross-context behavioural advertising. We run no advertising. Because there is nothing to opt out of, we do not currently detect the Global Privacy Control browser signal; if that changes, this policy will change with it.
You may ask us to tell you what we hold, give you a copy, correct it, or delete it, and we will not treat you worse for asking. Email support@pixelkingdomwars.com; we respond within 45 days and may extend once where the request is complex. You can use an authorised agent, who will need your written permission. If we refuse a request we will tell you why, and you can appeal by replying to us.
15. Children
Pixel Kingdom Wars is for adults. You must be 18 or older to play, and the game is not directed at children.
We do not operate an age check and we do not ask your date of birth, so nothing verifies your age. The game does not present the Terms of Use to you for acceptance either: playing is your representation that you are 18 or over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete the account and its data.
If you are a parent or guardian and think your child has an account, email support@pixelkingdomwars.com. Tell us the display name or wallet address if you know it; we will delete the account and the data we hold, subject to the limits in section 12, and confirm it back to you. You do not need an account of your own to make that request.
16. Automated decisions and moderation
Some things happen automatically: rate limits and bot checks may block a request; anti-sybil checks may refuse a referral reward or a Seeker badge; and the game's rules execute in code and on-chain without a person reviewing each outcome.
Moderation decisions — muting, removing content, or withdrawing an account's access — are made by a person, not automatically. If an automated or manual decision affects you, you can contest it: email support@pixelkingdomwars.com, we will review it ourselves rather than by automated decision, and we will tell you the outcome and the reason.
17. Changes to this policy
When we change this policy we update the "Last updated" date and describe what changed. For material changes we will publish them on this page and announce them on pixelkingdomwars.com and our official channels before they take effect. We will not treat you continuing to play as consent to a materially new use of your data that requires your consent.
18. Contact
Pixel Kingdom Wars
support@pixelkingdomwars.com