# Mage Cauldron Privacy Notice

Last updated: 7 November 2026

This notice applies to the Mage Cauldron mobile game, including its closed alpha. The escape-room customer register and website cookie descriptions elsewhere on this page apply to those services, rather than to the game.

## Data controller and contact

Cube Seinäjoki Oy, Finnish Business ID 2876111-9, is the data controller for Mage Cauldron. For privacy questions or requests, contact magecauldron@gmail.com and state that your request concerns Mage Cauldron. Do not send passwords, login tokens or other authentication credentials.

## Data needed to operate the game

We process game account identifiers, saved progress, inventory, settings and gameplay action records to provide the game, maintain your account and restore your progress. We also process technical information, such as app version, timestamps, connection information and error records, to maintain reliability, prevent abuse and protect the service.

Processing necessary to provide the game is based on performance of our agreement with you. Processing for service security and abuse prevention is based on our legitimate interest in operating a reliable and secure service.

Essential account and gameplay data are separate from optional Google Analytics data. Disabling optional analytics does not delete your progress or prevent you from playing.

## Optional Google and Apple account linking

You can optionally link your existing game account to Google on Android or Sign in with Apple on iOS. Linking associates that identity with your current game account; it does not merge two players or currently provide a separate account-recovery flow on a new device. You can keep playing without linking.
If you choose to link, Google or Apple authenticates you and Supabase Auth processes the provider's account identifier, email address and available basic profile information to maintain the link. Apple can provide a private relay email address if you choose Hide My Email. We request only basic identity permissions, not access to your email messages, contacts or files. Your Google or Apple password is handled by that provider and is not received by the game. Linking is separate from optional analytics and advertising choices.
For linked Apple accounts, we also store an encrypted Apple authorization token on our server so that we can revoke the game's Apple authorization during account deletion. The token is not part of your public profile or analytics events. Removing a game account removes its stored identity link; it does not delete your Google or Apple account. If an older Apple link has no stored revocation token, the game provides instructions to remove its authorization through Apple before retrying deletion.

## Chat, profiles and rankings

Your selected mage name, avatar and frame, progression, ranking and public build information can be visible to other players through chat, rankings and player profiles. Private currency balances and authentication credentials are not part of the public profile. Avoid putting personal information in your mage name or chat messages.

If you use alpha chat, we store your messages, their time and sender information, your acceptance of the chat rules and your blocking choices. Other chat participants can see your messages. Block and Report are available from chat and player profiles. Reports can include the reported message or profile, its sender, the reporting account and the selected reason; the developer can review these records and relevant surrounding conversation for moderation and abuse prevention. Blocking hides that player's messages for you; it does not delete their account or messages for other players.

Chat history normally displays the last seven days. During chat history reads, the service removes stored messages older than 30 days and reports older than 90 days. This cleanup is triggered by activity; an inactive or closed chat can retain older records until the next cleanup. Chat and moderation information is separate from the server-side balance dataset described in this notice.

## Delete Account

You can permanently delete your game account from your player profile → Settings → Delete Account. This removes the game account and its progress, inventory, messages and associated blocking/report records. The confirmation warns that the action cannot be undone. Copies of conversation text held as evidence in another player's moderation case may remain until that case's retention cleanup; account deletion does not promise erasure of every other player's report or evidence. Reset Progress is a separate action and does not delete the account. After successful account deletion, the game automatically creates a new, separate guest account so that you can continue playing. This new account does not restore the deleted account’s progress or identity link.

Deleting the game account does not itself erase optional Google Analytics data already uploaded. For requests concerning that data or exported balance records, contact magecauldron@gmail.com. The existing notice's rights, operational/legal retention exceptions and separate analytics retention continue to apply.

## Server-side game balance analytics

We use gameplay records already handled by our game servers to understand progression and balance Trial and Adventures for current and future game accounts. We record stage and mage level, the spells, equipment, substats, familiars and completed research used in a battle, and its outcome and duration. We also take snapshots of current progression. We do not reconstruct past battle builds from your current inventory.

This processing is based on our legitimate interest in maintaining a fair, functioning and enjoyable game. We have assessed its necessity and impact on players, including younger players. Reports use a separate pseudonymous analytics identifier. We do not include your name, email, login credentials, advertising identifier, device identifier, age choice, chat messages or payment details in this dataset. Access is restricted to the developer and necessary service providers. We use aggregate reports and may inspect pseudonymous builds to diagnose balance issues.

This is server-side processing, separate from the optional Google Analytics and advertising choices below. It does not install analytics cookies or collect additional device information. These balance records are not sent to Firebase Analytics, GA4 or Google Ads, used for advertising audiences, or combined with advertising data. They are not used to set individual prices or make automated decisions with legal or similarly significant effects. PvP battle measurement is not enabled.

The game database holds detailed balance records for at most 30 days. Our restricted reporting dataset uses Google Cloud BigQuery in the EU and retains detailed records for at most 180 days after transfer, giving a maximum of 210 days in total. Small records needed to honour an objection or prevent erased data from being collected again may remain while the game account exists. Ordinary gameplay saves have their separate operational retention described below. International processing safeguards in the next section also apply to our reporting service providers; see [Google Cloud's data processing terms](https://cloud.google.com/terms/data-processing-addendum).

You can object to this processing for reasons relating to your situation or request access or deletion by contacting magecauldron@gmail.com and stating that your request concerns server-side balance analytics. We will verify the relevant account and stop this balance collection while handling your objection. Declining the optional Google SDK choices does not itself submit this separate objection and does not affect your ability to play.

## Service providers and international processing

Our game infrastructure uses Supabase and Cloudflare. These providers process data to provide their services. Their international operations may involve processing outside the European Economic Area. Where required, international transfers must be covered by applicable safeguards, such as European Commission adequacy decisions or standard contractual clauses.

The statement elsewhere on this page about the escape-room customer register remaining within the EU/EEA does not apply to all Mage Cauldron infrastructure. Further information is available in the [Supabase Privacy Policy](https://supabase.com/privacy) and [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/).

## Optional game analytics and advertising

We use Usercentrics App CMP to present and record privacy choices for adult players. Usercentrics processes a consent record, a randomly generated consent identifier and technical request information to manage and demonstrate those choices. This consent-management processing is separate from optional Google analytics and advertising. We do not send the numeric age selected in the game, your game account ID, or your gameplay events to Usercentrics. See the [Usercentrics privacy policy](https://usercentrics.com/privacy-policy/) for more information. You can reopen the choices in Settings.

Game analytics and Advertising measurement & audiences are separate optional choices, presented in the game and available in Settings → Privacy choices. Both are OFF by default for new installations. Declining either choice does not affect access to the game or saved progress. Advertising use requires both choices; accepting Game analytics alone does not enable it. Existing alpha analytics choices do not automatically become advertising consent.

Optional Google collection is available only to players who confirm an age of 18 or over. The number selected on the 0–99 age slider is converted to a local age group and discarded after confirmation. The age-group choice is stored locally on the device and is not sent to Google or our game servers. If a player selects a younger age group or leaves it unspecified, both optional Google choices remain disabled. This does not affect gameplay, progression or rewards. Necessary account and gameplay processing remains separate.

With Game analytics enabled, Google Analytics for Firebase receives app and device information, installation and session identifiers, viewed screens, observed foreground play time, brew counts, item inspection and equip/discard decisions, progression milestones and purchase measurements when available. We use these to understand gameplay, retention and the game's performance. We do not send your name, email address, login credentials or game account identifier as analytics event data.

If you also enable Advertising measurement & audiences, Google may use this information and your device's advertising identifier for Mage Cauldron advertising measurement, advertising audiences, personalized advertising and finding prospective players with similar playing or purchasing behaviour. Selected conversion events and audiences may be shared with our linked Google Ads account. A completed, verified real-money purchase is our primary advertising conversion; installation, active days, returns and progression are supporting measurements. Purchase measurements may include a transaction reference, product, monetary amount and currency; payment card details are not sent as analytics event data. Earlier analytics-only alpha history is not replayed as new advertising conversions. This choice does not add in-game ads.

This optional processing is based on your consent. You can change or withdraw it in Settings → Privacy choices. Turning Advertising measurement & audiences off stops the corresponding future advertising use and clears the local audience-qualification counters. Turning Game analytics off also turns advertising use off, stops SDK collection and clears local analytics data. These choices do not automatically erase data already uploaded; contact magecauldron@gmail.com for access or deletion requests.

Google may process information outside the EEA; see [Google's Privacy Policy](https://policies.google.com/privacy) and [how Google uses information from sites and apps](https://policies.google.com/technologies/partner-sites). Where required, international transfers must use applicable safeguards, including adequacy decisions or standard contractual clauses. GA4 event and user-data retention is set to 14 months. Aggregate reports and BigQuery exports have separate retention and are not automatically deleted by changing this setting. Installation-based observations may restart after reinstalling the game or resetting analytics and do not necessarily represent distinct people.

## Retention

We retain account and gameplay information for as long as necessary to provide and maintain your game account. Technical and security records are retained as needed for their operational purpose, investigation of incidents and applicable legal requirements. You can request deletion; some information may need to be retained where required by law or necessary to establish, exercise or defend legal claims.

## Your rights

Subject to the conditions of applicable data protection law, you may request access to your personal data, correction, deletion, restriction of processing or data portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal.

We may need to verify that you are entitled to access the relevant game account before responding to a request. You may also lodge a complaint with the Finnish Data Protection Ombudsman: [tietosuoja.fi/en](https://tietosuoja.fi/en).

## Changes to this notice

We will update this notice when the game or its data processing changes. Information about optional analytics will be provided before the affected collection begins.