Privacy Policy
Last updated: 14 November 2026 · Applies to: the Object Wars Android app, this website (objectwars.ip1.cc) and related services.
1. Who we are
Object Wars is operated by [OPERATOR LEGAL NAME], [POSTAL ADDRESS] ("we", "us"). We are the controller of the personal data described here. Contact: support@objectwars.ip1.cc (placeholder — replace with the final support address).
2. What we collect and why
| Data | Why we use it | How long we keep it |
|---|---|---|
| Photos you take or pick (the image file; location/GPS metadata is removed on upload) | To check the photo is suitable, recognise the object and generate your warrior. | Original photos are deleted 30 days after upload. Photos rejected by moderation are deleted on the same schedule. |
| Generated warriors (artwork, name, class, element, stats, story) | To show your collection, run battles and let you share cards. | While your account exists. Deleted when you delete your account. |
| Account identifiers: a random guest ID created by the app on your device, your player code (e.g. OW-7K2Q9M) and display name | To create your account without registration and keep your progress. | While your account exists. |
| Google sign-in (optional): Google account ID and email address | To let you link your account and restore it on another phone. | While your account exists or until you unlink. |
| Gameplay data: battles, battle replays, missions, achievements, tournament entries, coins and Sparks balances | To run the game, rankings and rewards, and to detect cheating. | While your account exists. Battle records shown to your opponents are anonymised when you delete your account. |
| Purchase history: Google Play order ID, product, date, status. We never receive your card details. | To deliver what you bought, handle refunds and meet tax and accounting obligations. | As long as the law requires for accounting records, typically [N] years, even after account deletion. |
| App interactions and diagnostics: events such as "first open", "creation completed", "battle finished", crash and error reports, device model and Android version | To keep the game working, fix bugs and understand which features are used. | [13 months] in identifiable form, then aggregated. |
| Notification token (only if you allow notifications) | To send the notifications you chose. You can turn each type off in Settings. | Until you disable notifications or delete your account. |
| Reports and moderation records | To review reported content and keep the community safe. | Up to [2 years] after the case is closed. |
| Website forms: waitlist email and language; account-deletion requests | To tell you when the game is on Google Play; to process your deletion request. | Waitlist: until launch announcement plus 30 days, or until you unsubscribe. Deletion requests: [3 years] as proof of compliance. |
| Server logs: IP address, time, request | Security, abuse prevention and rate limiting. | 30 days. |
3. How AI processes your photos
When you create a warrior, your photo is sent over an encrypted connection to OpenAI, a third-party AI provider, which we use to (a) check that the image is safe and shows an object rather than a person, (b) describe the object, and (c) generate original artwork that resembles it. Text that happens to be visible in your photo is treated as part of the image, never as instructions.
- No training on your photos. We do not use your photos or generated warriors to train AI models, and we use our AI provider's API under terms that, at the time of writing, do not allow it to train its models on data we send. [Verify against OpenAI's current API data-usage policy before publication.]
- Under those terms OpenAI may keep request data for a limited period to detect abuse. [Insert the current retention period stated by OpenAI.]
- Don't photograph people. Photos that mainly show people are refused. Avoid capturing faces, documents, screens or anything personal in the background.
- AI output can be unexpected. If a warrior looks inappropriate, report it in the app and we will review it.
4. Who we share data with
- Service providers who process data for us under contract: OpenAI (AI moderation, analysis and image generation), [HOSTING PROVIDER] (servers and object storage, located in [REGION]), Google (Play Billing, Google sign-in and, if enabled, push notifications).
- Other players see your display name, player code, the warriors you battle with and battle results. Challenge links show the challenger's warrior to anyone who has the link.
- Authorities, when the law requires it.
We do not sell your personal data, and Object Wars does not currently show third-party advertising.
5. Legal bases (EEA and UK)
We process data to perform our contract with you (running the game), on our legitimate interests (security, fraud and cheat prevention, improving the game), with your consent (notifications, optional Google sign-in) and to comply with legal obligations (purchase records). You can withdraw consent at any time.
6. Children
Object Wars is not directed at children under 13. You must be at least 13 years old to use it, and at least 16 years old if you live in the European Economic Area (or the higher age your country sets for consenting to online services). If we learn that an account belongs to someone below the required age, we delete it. Parents can contact us at the address above.
7. Your rights and choices
- Export your data: in the app, go to Profile → Settings → Export my data [confirm final menu path], or email us.
- Delete your account: in the app, Profile → Delete account, or use the web deletion form.
- Access, correct, restrict or object to processing, and lodge a complaint with your data protection authority.
- Turn notifications on or off per type in the app settings.
8. Account deletion
When you delete your account we delete your profile, warriors, generated artwork, remaining photos, gameplay progress, notification tokens and linked sign-in within 30 days. Battle records that other players keep in their history are anonymised (your name and artwork are replaced by a placeholder). We keep only what the law requires (purchase records), security logs for up to 30 days and encrypted backups, which roll over within [35 days]. Virtual currency and items are lost on deletion.
9. Security
Data travels over HTTPS. Photos and artwork are stored privately and served through short-lived signed links. Access to production systems is restricted and logged. No method is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
10. International transfers
Our providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [Confirm per provider.]
11. Changes
We will post updates here and change the date at the top. For significant changes we will notify you in the app.
12. Contact
support@objectwars.ip1.cc (placeholder) · [OPERATOR LEGAL NAME AND ADDRESS]