Privacy Policy
Draft — not legal advice; have a lawyer review before launch. Items in [square brackets] are placeholders the operator must fill in or confirm.
Last updated: [date of publication]. This policy explains what Domain Guardian II (the "Game", run via sunmew.com, "we") collects, why, how long we keep it, and what choices you have.
Controller and contact: [legal entity / owner name and address — to be filled]. Questions, access, export and deletion requests: support@sunmew.com. Security issues: security@sunmew.com. [If required for EU/UK users: EU/UK representative or Data Protection Officer contact.]
Age. The Game is for people 13 and older. We do not knowingly collect personal data from children under 13. If you are in the EEA/UK and below the age of digital consent in your country (13 to 16), you need a parent or guardian's permission. If we find data from a child under 13 we delete it.
1. What we collect, why, and for how long
| Data | Why (purpose) | Legal basis (GDPR / UK GDPR) | Kept for |
|---|---|---|---|
| Account data: Firebase user ID, email address, sign-in method, display name and profile picture (if your provider gives them), email-verified flag | Create and secure your account, cloud saves, leaderboards, contact you about your account | Contract | Until you delete the account (accounts unused for 2 years: we remind you first, then delete) |
| Login log: time, IP address, country, browser/OS type (user agent), sign-in method | Account security, detect stolen accounts and multi-account abuse, anti-cheat | Legitimate interests (security, fraud prevention) | 180 days (for banned accounts, until the ban is lifted). Visible to admins only; admin views are logged |
| Game progress and cloud saves: stars, records, chip wallet, tech, shop and equipment, missions, achievements, season pass | Provide the game across devices | Contract | Until you delete the account |
| Server ledger: chips earned and spent, rewards, lottery tickets and results, ad-reward counts, welcome-pack claim | Keep the economy correct, fix errors, refunds | Contract / legitimate interests | Until you delete the account |
| Lottery and welcome-pack records: your tickets (how you got them, when they expire, whether used), your draw results, cosmetic shards; the country code your connection comes from (read from our CDN for each lottery request to apply the country list, not stored) | Run the lottery, show you your records, fix errors and refunds | Contract / legitimate interests | Deleted with your game data / account. Admin views of the records are logged |
| Welcome-pack marker: a one-way keyed code made from your account ID and from your verified email address (the address itself is not stored for this) | Make sure the free welcome pack is claimed only once per person, also after deleting and re-creating an account | Legitimate interests (prevent abuse) | Kept after account deletion [while the welcome pack exists — confirm]; it cannot be turned back into your email |
| Leaderboard data: display name, score, level, time, ruleset, assisted flag | Run rankings | Contract | Current season + 1 year archive |
| Replay / action logs: server-issued seed, your build/placement actions, timing, game-code fingerprint, suspicion score, reports | Anti-cheat verification, review of suspicious runs, appeals | Legitimate interests (fair play) | Tied to the leaderboard entry: season + 1 year, unless needed for an open case |
| Moderation records: ban tier, reason, appeal text, admin audit | Enforce rules, handle appeals | Legitimate interests | While the restriction applies and for [e.g. 1 year] afterwards [confirm] |
| Ad and consent state: your consent choice (ads / analytics) and when it was made, ad rewards claimed, ad-free status | Respect your choices, prevent abuse, give rewards | Legal obligation / consent / contract | Consent record: while the account or browser setting exists; ad counts: per day/season |
| Analytics (only with consent where required): event type (such as chips earned, ad attempt, client error), the promotion channel a link was tagged with (a fixed name such as "reddit" or "share", never the full address or referrer), a random page-session ID stored only as a keyed hash, game version, IP hash (not the raw IP), and country code | Improve the game and fix errors | Consent (EEA/UK/CH) / legitimate interests elsewhere | Raw events 90 days, then only daily counts |
| Error reports (sent automatically when the game crashes, never in test mode or offline): error message and stack trace with e-mail addresses, IP addresses, tokens and link parameters removed before sending and again before storage, file and line, game version, menu or battle screen | Find and fix bugs | Legitimate interests | 30 days; no IP, account or device ID is stored with them |
| Security logs and rate-limit counters: IP address handled by Cloudflare and our servers | Protect against attacks and abuse | Legitimate interests | Rate-limit counters in memory only; server logs [e.g. 30 days — confirm] |
| Daily reminder (only if you turn it on): the push address your browser gives us (a URL at your browser's push service), the browser's encryption keys for it, your language (en/zh), the date of the last reminder, linked to your account or guest identity | Send one short notification a day when new daily contracts arrive (00:00 UTC) | Consent (you switch it on; switch it off in Settings at any time) | Until you turn it off, delete your account/game data, or your browser's push service tells us the address no longer works (then we delete it immediately); also deleted after 5 failed days in a row |
| Support emails you send us | Reply to you | Legitimate interests / contract | [e.g. 2 years — confirm] |
| Deletion log: time, pseudonymous reference (for signed-in users also the account ID) | Re-delete data if a backup is restored | Legal obligation / legitimate interests | 400 days |
| Backups: copies of the above | Recover from failures | Legitimate interests | Same-machine copies: 3 generations, hourly; off-site: daily, 30 days |
Analytics are separate from the login log. The login log holds raw IPs for 180 days for security. Analytics only stores a hash of the IP. The two sets of data are kept apart. "Hashed" or "pseudonymous" data can sometimes be linked to a person, so we treat it as personal data.
Guests: guest progress stays only in your browser. A guest sign-in token may be stored, and expires after 180 days of inactivity. Guest scores are not shown on leaderboards.
We do not use device fingerprinting for anti-cheat. We do not sell personal data. We do not use your data for automated decisions with legal effects; bans from automatic suspicion scores of step 3 and above are reviewed by a person, and you can appeal.
2. Advertising and consent
- We use Google AdSense / H5 Games Ads. Google and its partners may use cookies or similar identifiers and process data such as IP address and device information to show and measure ads. We do not give Google your account ID, saves or leaderboard data. Google acts as an independent controller for ad serving; see Google's policy and privacy policy.
- EEA, UK and Switzerland: under Google's EU user consent policy we use a Google-certified consent management platform (CMP, integrated with the IAB Transparency and Consent Framework) to ask for your consent before personalized ads and before analytics. We use Google's own consent message (Google AdSense "Privacy & messaging"), a Google-certified CMP. If you decline, you may only see non-personalized ads, we collect no analytics, and if no ads can be shown, you cannot earn ad-based rewards (chips from ads, 7x/10x speed unlock, double level rewards). Playing the Game normally does not require consent, and you can earn the same things by playing. You can change your choice at any time in Settings.
- California and other US states: we do not "sell" personal data for money. Ad serving may count as "sharing" for cross-context behavioral advertising or "targeted advertising". You can opt out through our settings control / the Google Ad Settings page, and by turning on a Global Privacy Control browser signal where supported. [Confirm the opt-out link once implemented.]
- Children: we do not direct the Game to children under 13 and we do not knowingly serve personalized ads to them.
3. Cookies, local storage and similar technologies
- Local storage (our own, strictly necessary): your progress, records, profile, settings (language, volume, quality), battle snapshot, sign-in helper flags, login-attempt throttle (keyed by an email hash), and the guest session counter. These stay on your device; clear them in your browser or with "Clear game data".
- Session storage: temporary flags while a redirect sign-in is in progress.
- Firebase Authentication keeps a sign-in session in your browser's storage (IndexedDB / local storage).
- Cloudflare Turnstile (bot check on signup/login) may set cookies or run checks in your browser.
- Google advertising scripts may use cookies or other identifiers (only after consent where required).
- Service worker and cache: to let the Game load faster and work offline. If you turn on the daily reminder, the service worker also receives and shows that notification.
- Prompt flags (local storage, strictly necessary): a count of finished runs and whether you already saw the "add to home screen" and "daily reminder" suggestions, so we ask at most once. They never leave your device.
- Fonts are loaded from Google Fonts (your IP address is visible to Google when this happens) [consider self-hosting to avoid this].
4. Who we share data with (processors and recipients)
| Recipient | Role | What |
|---|---|---|
| Google Firebase (Authentication, Firestore cloud saves) | Processor | Account ID, email, sign-in data, cloud saves |
| Cloudflare (hosting, CDN, D1 database, R2 storage, Email Routing, Turnstile, Access) | Processor | All site traffic including IP addresses; the game ledger and leaderboard data; support email forwarding; bot checks |
| Oracle Cloud (our own server for statistics and score checking) | Processor (infrastructure) | Analytics events with hashed IPs, replay checking; no account email |
| Google AdSense / H5 Games Ads | Independent controller | Ad requests and ad measurement through its scripts |
| Microsoft, GitHub | Independent controllers | Only if you choose that sign-in; they handle your login on their side |
| Email provider [Brevo / Resend / other] | Processor | Support replies we send and any account emails not sent by Firebase |
| Browser push services (Google Firebase Cloud Messaging for Chrome/Edge/Android, Mozilla for Firefox, Apple for Safari/iOS, Microsoft for legacy Edge) | Processor of your browser vendor | Only if you turn on the daily reminder: the push address and the reminder, which is end-to-end encrypted so the push service cannot read it |
| Authorities and advisers | — | If the law requires it, to protect rights and security, or to professional advisers under confidentiality |
Your display name and score are public on leaderboards. We do not sell your data.
5. International transfers
We operate from [country] and use providers that process data in the United States and other countries (Google, Cloudflare, Oracle). If you are in the EEA/UK, transfers happen under the EU–US Data Privacy Framework (for certified providers), or Standard Contractual Clauses / the UK IDTA or UK Addendum, together with their other safeguards. You can ask us for a copy of the safeguards at support@sunmew.com.
6. Your rights
Depending on where you live (for example the EEA/UK under GDPR, California under CCPA/CPRA and other US states), you may have the right to: access your data; get a copy in a portable format; correct it; delete it; restrict or object to some processing (including legitimate-interest processing); withdraw consent at any time (this does not affect earlier use); opt out of sale/sharing and targeted advertising; not be discriminated against for using these rights; and complain to your data protection authority (in the UK, the ICO). We never discriminate against you for using these rights.
How to use them
- Delete your account: in the Game, Settings, Privacy, "Delete account data". This removes your local data, cloud save, leaderboard entries and assets. We then also delete the login log and ledger entries tied to you, apart from what we must keep (for example the deletion log for 400 days, and backups that age out within 30 days). You can also email support@sunmew.com from your account email.
- Export your data: in the Game, Settings, Account, "Export My Data" (signed-in accounts), or email support@sunmew.com. Either way you get a machine-readable file with your account data, saves, ledger, leaderboard entries and login log.
- Opt out of ads personalization/analytics: Settings.
- We will answer within 1 month (GDPR; 45 days under CCPA, extendable). We may need to verify it's you. A guest score that is not linked to an account can't be found or removed.
- California: you may use an authorized agent. We do not knowingly sell or share the personal information of anyone under 16.
7. Security
We use HTTPS, server-side checks for all rewards and balances, signed tokens, rate limiting, restricted admin access (Cloudflare Access plus an admin list, with an audit trail), and separation between analytics data and login logs. No system is perfectly secure. If a breach affects you we will notify you and authorities as the law requires. Report problems to security@sunmew.com.
8. Changes
We may update this policy. For important changes we will notify you in the Game or by email before they take effect. The date at the top shows the current version.
9. Contact and complaints
support@sunmew.com. You may also contact your local data protection authority.