Privacy Policy

This Privacy Policy explains how Emberhatch LLC (doing business as Emberhatch Games, "we", "us" or "our") collects, uses, shares and protects information when you play Dinos vs Dragons, including on our website dinosvsdragons.com, in our Android and Apple apps, and on our game servers (together, the "Game"). It is part of our Terms of Service.

Contents

1. Who we are
2. Information we collect
3. How we use information, and our legal bases
4. How we share information
5. Device storage, cookies and tracking
6. Children's privacy
7. How long we keep information
8. Deleting your account
9. Your rights and choices
10. Additional information for U.S. state residents
11. Additional information for the EEA, UK and Switzerland
12. Security
13. International transfers
14. Automated checks and AI
15. Emails and other messages
16. Changes to this Privacy Policy
17. Contact us

1. Who we are

Emberhatch LLC, a Florida limited liability company, operates the Game and is responsible for your information (the "controller" under European data protection law). You can reach us at dinosvsdragons.support@gmail.com. This policy does not cover third-party websites or services the Game links to, such as Google, Apple or app stores, which have their own privacy policies.

2. Information we collect

2.1 From your sign-in provider. When you sign in, we receive and store:

• Google: a unique account identifier, your email address, whether Google has verified it, and the name on your Google account.
• Apple (on Apple devices): a unique account identifier and an email address, if Apple shares one. If you use Apple's "Hide My Email", this is a private relay address. We do not store a name from Apple.

We never receive your Google or Apple password. We do not collect your profile picture.

2.2 Information you give us.

• Year of birth. Asked once when you first sign in, to decide whether you may have an account and whether you are an adult (who can add child profiles). We store the year, not your full date of birth.
• Profile nicknames. The name other players see for each profile. For your first profile, the box starts with your Google first name as a suggestion, which you can change before you continue.
• Clan names and tags, chat messages, quick messages, reports and friend requests you send in the Game.
• Support messages. Anything you send to our support email, such as your email address and the content of your message.

2.3 Information created as you play.

• Player details: a random player ID, a friend code, the dates your player was created and last seen, and whether a profile is a child profile.
• Game progress: units, levels, Commanders, skills, currencies (such as Star Shards and fossils), quests, achievements, settings that sync between devices, and story progress. We keep your current saved progress and one previous copy.
• Battle records: for single-player battles, your army setup and the commands you gave, which our servers replay to check results; and a record of the rewards you have earned.
• PvP information: games played and won, your rating and league for each monthly season, and your best rating. PvP battles are run by our servers while they happen; we do not keep full replays of PvP battles.
• Social information: your friends list and friend requests, clan membership, clan raid damage, and (for child profiles) which friendships a parent approved or declined.

2.4 Chat and safety records. Clan chat messages (with the sender's nickname and the time), which messages were reported and by whom, and messages a clan leader removed, so we can review abuse.

2.5 Purchase information (once purchases are offered). What you bought, when, the price, the order or receipt identifiers from the app store or payment provider, and the total of Star Shards you have bought (for the Star Shard Track). We never receive or store your full card or bank details; the app store or payment provider handles payment.

2.6 Device and technical information.

• IP address. Our servers use your IP address while you are connected to protect the Game (for example, to limit how many connections or new players come from one internet connection). We do not store it in your account or our game database. Our hosting and network providers may record it briefly in their security and access logs.
• Sign-in and device keys. Random keys that keep you signed in and tie a player to a device. Our servers store only a scrambled (hashed) form of them. Sign-ins expire after 60 days.
• Technical logs. Our servers keep logs of their activity, which may include nicknames, friend codes and match events and, when a PvP battle goes out of sync, that battle's setup and commands, to help us fix problems.

2.7 Crash and error reports. When the Game hits an error or crashes, it sends a report to help us fix it: what went wrong and where in the Game's code, the device, operating system and browser type, the Game's version, and the last few technical steps the Game took. The Game is set up so reports do not include your name, email, account or player ID, IP address, chat messages or anything you typed, and we do not record screens or sessions. Reports are processed for us by Sentry (Functional Software, Inc.).

2.8 Play statistics. We keep daily totals (for example, how many battles were played) that do not identify you, to balance and improve the Game.

2.9 Guest players. If you play as a guest, we collect only the nickname you choose, a random player ID, a hashed device key, your game progress and battle records, and (if you play Casual PvP) PvP information. Guests are not asked for an email or year of birth.

2.10 What we do not collect. We do not collect your precise location, contacts, photos or files, camera or microphone, advertising ID, payment card numbers, government ID numbers or biometric information. Our Android app asks only for permission to use the internet.

3. How we use information, and our legal bases

We use information for the purposes below. If you are in the EEA, UK or Switzerland, the legal basis for each is shown in brackets.

We do not use your information for targeted advertising, sell it, or build profiles about you for marketing. If we ever want to use your information for a purpose that is not compatible with these, we will tell you first and, where the law requires, ask for your consent.

4. How we share information

4.1 Service providers. These companies process information on our behalf, under contracts that limit how they may use it:

4.2 Other players. Other players can see only what the Game shows them:

• Everyone: your nickname and, if you have one, your clan tag, in PvP matches and on the season's public leaderboard (with your rating). Child profiles appear on the public leaderboard only as "Young player", without a name or clan tag.
• Signed-in adults: other signed-in adults can see that your adult profile is online, with your nickname.
• Friends: your nickname, rating, clan tag and online status.
• Clan members: your nickname, online status, rating, raid damage and your clan chat messages.

Your email address, name from Google, year of birth and friend code are not shown to other players (you share your friend code yourself if you choose).

4.3 Legal reasons and safety. We may disclose information if we believe in good faith it is necessary to comply with the law or a valid legal request (such as a court order), to protect the safety of any person (including reporting child-safety concerns to the authorities), to prevent fraud or cheating, or to protect our rights.

4.4 Business transfers. If Emberhatch LLC is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. The new owner must keep honoring this Privacy Policy, and we will notify you where the law requires.

4.5 With your consent. We may share information in other ways if you ask us to or agree.

5. Device storage, cookies and tracking

5.1 Device storage. The Game stores information on your device (in your browser's local storage or the app's storage) so it works and loads quickly: your saved progress, your account list (your email, name, year of birth and a sign-in token, so you stay signed in), offline battles waiting to be checked (in the apps), and settings such as sound, screen shake, full screen and muted players. You can remove it by signing out and clearing the website's data or the app's storage, or by uninstalling the app; a guest's progress may then be lost.

5.2 Cookies. Our website does not set cookies for tracking or advertising. If you sign in with Google on the website, Google's sign-in service may use its own cookies under Google's privacy policy. Our network provider may use strictly necessary cookies for security.

5.3 No third-party tracking. We do not use third-party analytics, advertising or tracking tools, and we do not track you across other websites or apps. Because we do not track you, we handle every visitor the same way, including those whose browsers send "Do Not Track" or Global Privacy Control signals.

6. Children's privacy

This section is our notice to parents under the U.S. Children's Online Privacy Protection Act ("COPPA") and similar laws.

6.1 How children play. Children under 13 may not create their own accounts. When someone signs in for the first time, the Game asks for their year of birth. If the answer shows they are under 13, the account is not created and the information we received is deleted (we keep only a scrambled one-way code for 2 days, so the same sign-in cannot immediately try again with a different age). A child under 13 may play only through a child profile that a parent or legal guardian adds to the parent's own account.

6.2 Parental consent. Only an adult account holder (18 or older) can add a child profile, and they must sign in again with Google or Apple shortly before doing so. The parent confirms they are the child's parent or legal guardian and consents to this Privacy Policy and the Terms of Service for the child. We do not collect information from a child through a child profile until the parent has given that consent.

6.3 What we collect from child profiles. Only: the nickname the parent or child chooses, a random player ID and friend code, the child's game progress and battle records, PvP information, the child's friends list and friend requests (and the parent's approvals), clan membership, the preset quick messages the child sends, and the technical information described in Section 2.6 and crash reports described in Section 2.7. We do not ask a child for an email address, real name, phone number, photo, location or any other contact information.

6.4 How we use it. Only to run the Game for the child, as described in Section 3: saving progress, running battles, PvP, friends and clans, checking results, keeping the Game safe and fixing problems. The random player ID, device key and IP address are "persistent identifiers" used only to support the Game's internal operations: keeping the child signed in, saving progress, preventing cheating and abuse, and keeping our servers secure. We never use them to contact a child, to build a profile of a child, for advertising, or for any other purpose.

6.5 What other players see. A child profile can add friends only by friend code, and a friendship starts only after the parent approves it. Approved friends and clan members see the child's nickname and game activity. On the public leaderboard, a child appears only as "Young player", and child profiles are hidden from players who are not already their friends. Children cannot type free-text chat: they can send only preset quick messages, and a clan with a child profile in it allows only preset quick messages for everyone and always needs the leader's approval to join. Children cannot make purchases.

6.6 Disclosure to third parties. We do not sell or rent children's information, show children ads, or disclose their information to third parties except to the service providers in Section 4.1 that help us run the Game (and only for that purpose), or for the legal and safety reasons in Section 4.3.

6.7 Parents' rights. A parent can at any time: review the child's information; ask us to delete it; and refuse to allow any further collection or use of it. A parent can see the child's progress by switching to the child profile in the Game. To get a copy of a child's information, or to delete a single child profile, email dinosvsdragons.support@gmail.com from the account's email address; to delete the whole account, including every child profile on it, use the steps in Section 8.1. We will verify that a request comes from the parent before acting. Deleting a child profile ends the child's use of the Game and removes the child's information as described in Section 8.

6.8 How long we keep children's information. We keep a child profile's information only while the parent's account is active and the child profile exists, and only for the purposes in Section 6.4. When the parent deletes the child profile or the account, we delete the child's information as described in Section 8. Our full retention schedule is in Section 7.

6.9 Teens. We do not sell teens' information, use it for targeted advertising, profile them, or collect their precise location.

6.10 If we learn of a mistake. If we learn that we collected personal information from a child under 13 without a parent's consent, we will delete it promptly. If you believe this has happened, please contact us.

6.11 Operator contact. The operator responsible for children's information in the Game is Emberhatch LLC, email dinosvsdragons.support@gmail.com. No other operator collects or maintains personal information from children through the Game.

7. How long we keep information

We may keep information longer where the law requires it, to resolve a dispute, or to deal with fraud, cheating or a safety concern that is under review, and only for as long as needed for that purpose.

8. Deleting your account

8.1 In the Game. Open the player menu (top right), choose Google Account (on iPhone and iPad: Your Account), then Delete Google Account (on iPhone and iPad: Delete Account), and confirm. For your security, you may need to sign in again first. This deletes every profile on the account. To delete only one child profile, email us (Section 6.7). A guest player can be removed from the device in the player menu; our servers then delete it on the guest schedule in Section 7, or sooner if you email us its nickname and friend code.

8.2 Without the Game. If you can't use the Game (for example, you uninstalled the app), follow the steps on our account deletion page or email dinosvsdragons.support@gmail.com from the email address on your account, with the subject "Delete my account". We may ask you to confirm the request.

8.3 What happens. When you delete your account, we immediately delete from our live systems your sign-in details, year of birth, every profile on the account, their progress (including the previous copy), friends and friend requests, clan memberships and their clan chat messages. Deleted information leaves our backups within 30 days. We keep only: chat reports, as described in Section 7; purchase records we must keep by law (once purchases are offered); daily statistics that do not identify you; and information we must keep for legal reasons. Deletion cannot be undone, and unused Virtual Items are lost.

8.4 Sign-in providers. Deleting your Game account does not delete your Google or Apple account. You can also remove the Game's access in your Google or Apple account settings.

9. Your rights and choices

9.1 Your rights. Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and get a copy in a portable format;
• correct inaccurate information (you can change nicknames in the Game; for your year of birth, contact us);
• delete your information (Section 8);
• object to or restrict some processing, and withdraw consent where we rely on it;
• opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these); and
• not be discriminated against for using these rights.

We offer these rights to all players, wherever they live.

9.2 How to make a request. Email dinosvsdragons.support@gmail.com from the email address on your account, saying what you are asking for. To protect your account, we will confirm your request comes from you (for example, by replying to that address or asking for your friend code) before acting. For a guest player, tell us the guest's nickname and friend code from the account menu. You may use an authorized agent where the law allows; we may ask for proof of their authority and to confirm your identity directly.

9.3 Response time. We will respond within one month (GDPR/UK GDPR) or 45 days (U.S. state laws). If we need more time, as the law allows, we will tell you why.

9.4 Appeals. If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal". We will respond to the appeal within the time the law requires (generally 45 to 60 days). If you are still not satisfied, you may contact your state Attorney General or your data protection authority.

10. Additional information for U.S. state residents

10.1 Who this covers. Several U.S. states, including California, Colorado, Connecticut, Virginia, Texas, Oregon and others, give their residents privacy rights. Some of these laws apply only to businesses above certain size thresholds, which we may not currently meet. We still describe our practices here and honor the rights in Section 9 for everyone.

10.2 Categories of personal information (last 12 months). Using the categories in the California Consumer Privacy Act:

We collect this information from you, your device and your sign-in provider, for the purposes in Section 3, and keep it for the periods in Section 7. We do not sell or share personal information (as the CCPA defines "sell" and "share"), and have not done so in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.

10.3 California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing purposes.

10.4 Florida. We do not sell personal information or use it for targeted advertising. We do not profile children or collect their precise location, and we do not use design choices meant to trick players into giving up more information than needed.

10.5 Nevada. We do not sell covered information as defined by Nevada law.

11. Additional information for the EEA, UK and Switzerland

11.1 Legal bases. Our legal bases for each use are in Section 3. Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and object at any time.

11.2 Your rights. In addition to the rights in Section 9, you have the right to data portability, to object to processing based on legitimate interests, and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concerns first.

11.3 Children. In some countries, young people below a certain age (between 13 and 16, depending on the country) need a parent's permission to use online services. If you are below that age where you live, please play only with your parent's or guardian's permission, or through a child profile on their account.

11.4 Providing information. We need your sign-in details and year of birth to provide an account. Without them, you can only play as a guest.

12. Security

We use technical and organizational measures designed to protect your information, including encrypted connections (HTTPS), storing sign-in tokens and device keys only in hashed form, limiting who can access our systems, server-side checks of game results and purchases, rate limits and protection against attacks, and limiting crash reports to technical information. No system is completely secure, and we cannot guarantee the security of information sent over the internet. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

13. International transfers

We are based in the United States, and our servers and most of our service providers are in the United States. If you play from outside the United States, your information will be processed in the United States, where data protection laws may differ from those where you live. Where our service providers transfer personal information from the EEA, UK or Switzerland, they rely on approved safeguards, such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission's Standard Contractual Clauses. You can ask us for more information.

14. Automated checks and AI

14.1 Automated checks. The Game uses automated checks to keep play fair, for example replaying battles to confirm results, checking saved progress against our records, filtering names and chat, and limiting suspicious traffic. These checks may mean a reward does not count or a name or message is blocked. They do not produce legal or similarly significant effects. If you think a check got it wrong, contact us and a person will review it.

14.2 AI. Some of the Game's art and music was made with the help of AI tools. We do not send your personal information to AI services, and we do not use it to train AI models.

15. Emails and other messages

We do not send marketing emails or push notifications. We email you only to reply to messages you send us, or when we need to tell you about your account, a request you made, or important changes (such as to our Terms or this policy). If we ever offer marketing emails, we will ask first where the law requires, and every marketing email will include a way to unsubscribe and identify us as the sender.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date. If a change is significant, we will notify you in the Game before it takes effect, and where the law requires (for example, a change in how we use children's information), we will ask for consent again.

17. Contact us

Emberhatch LLC
Email: dinosvsdragons.support@gmail.com

Please write "Privacy" in the subject line so we can route your message quickly.