Royal Snakes Arena (the "game") is made by AMCRAFTS ("we", "us"). This policy says what the game collects, why, where it goes, and how to get rid of it. It is written to match what the software actually does rather than what a game of this kind might do; when the game changes, this page changes with it and the date above moves.
The short version.
Solo matches against the computer and Pass & Play on a single phone run entirely on the device. Progress, settings and statistics live in the game's own private storage. The game requests four Android permissions and no others: network access, network-state, vibration, and — for future match notifications — notification posting. It does not request location, storage, contacts, camera, or the advertising-id permission.
The game reads no device identifier of its own. It does not read the Android ID, the advertising id, the IMEI or any hardware serial, and it does not generate a persistent installation id. We verified this against the source rather than assuming it.
Choosing Play as guest creates an account on our server with a random public identifier, a generated username and a display name. It has no e-mail address and no password, and it is not tied to your device, your phone number or any other app. Because nothing links it to you, it cannot be recovered if you lose the phone or reinstall.
To keep an account across devices you can register. For that we hold:
| Data | Why | Notes |
|---|---|---|
| E-mail address | To sign you in, and to identify the account if you ask us to delete it | Never shown to other players, never returned to the app, never used for marketing |
| Password | To sign you in | Stored only as a bcrypt hash and re-hashed as the standard moves on; we cannot read it |
| Username and display name | To identify you to other players and let friends find you | You choose the display name and can change it |
| Avatar, title and equipped cosmetics | Shown beside you in a lobby and in a match | Chosen from the game's own cosmetics |
| Short bio | Optional, shown on your profile | Up to 160 characters; leave it empty and there is nothing to show |
With an account the server keeps what the game is made of: your level and experience, coin and gem balances, owned and equipped cosmetics, match history and results, rating and rank, friends and friend requests, season mission progress, and tournament entries. This is data about play, not about you.
In a lobby, a match, a friends list or a friend request, other players see your public identifier, username, display name, avatar, level, and — in the friends list — your rating and rank tier. Your e-mail address is never sent to another player, and never sent back to the app at all. Other players can only find you by typing your username exactly; the search deliberately does not match on partial names.
Messages and emotes sent during an online match are stored so they can be delivered and, if reported, reviewed. If you report a player, we keep the report and what you wrote in it. If you block someone, we keep that too.
Each request to our server carries the game's platform, its version, your device's language preference, and a fresh random request id generated for that one request — it is not a stable identifier and cannot be used to recognise you across requests. Our application logs record the request id, a message and a small amount of context. They are automatically stripped of anything shaped like a token, a password or a key before being written, and they record no IP address, no e-mail address and no request body.
Our hosting provider's web-server logs, which are outside the game's control and standard for any website, do record the IP address of each request in the ordinary way.
To stop somebody hammering the sign-in form we count requests per minute. What is stored is a one-way hash of your bearer token, or of your IP address where there is no token, combined with the endpoint and the minute in question — not the IP address itself. Those rows are deleted once their minute has passed, by a job that runs every fifteen minutes, so nothing survives more than about an hour and a quarter, and it cannot be turned back into an IP address.
The game shows advertisements supplied by Google AdMob. Some appear on their own — when you return to the hub, and after a match finishes — and some only when you choose to watch one in exchange for coins. No advertisement is shown during a turn.
To serve them, Google's advertising software reads your device's advertising identifier, a resettable id Android provides for this purpose. You can reset or delete it at any time in Android's settings, under Privacy → Ads. Google acts as an independent controller of what it collects through its own software; what it does with it is described in Google's privacy policy, not this one.
Consent. Where the law requires it — the EEA, the UK, Switzerland, and the US states with their own rules — you are asked before any personalised advertising is requested, through Google's own consent form. The advertising SDK is not started at all until that question has been answered; if you decline, or if your consent state cannot be established, no advertisement is requested. You can reopen those choices from the game's Settings screen, under Privacy.
AdMob is the only advertising network in the game. There is no mediation and no second ad SDK.
On the phone, data lives in the game's private storage, which other apps cannot read. Our servers are rented from a hosting provider and located in their data centres; the database is not reachable from the public internet.
Between the phone and our server everything travels over HTTPS — the game refuses plain HTTP outright. Sessions use short-lived access tokens with refresh tokens that rotate on every use; if a refresh token is ever presented twice, the whole family is revoked. Refresh tokens are stored only as SHA-256 hashes, never in the clear. Passwords are hashed with bcrypt and are never stored or logged in readable form.
Account and game data are kept for as long as the account exists. When you delete an account it is disabled immediately and every session for it is revoked at once. Thirty days later a scheduled job erases the identifying parts of it: the e-mail address and password hash are removed, the username is replaced with a random one, the display name becomes "Departed Adventurer", the bio is removed, and the friends, friend requests, sessions and notification tokens are deleted outright.
The now-anonymous account row itself is kept, because deleting it would tear holes in the match history of every player you ever played against. After the erasure it holds nothing that identifies you.
The thirty days exist so that an account deleted in anger, or by somebody who got hold of the phone, can be recovered by writing to us. Ask us to bring it forward and we will.
If you live somewhere that gives you further rights over your data — access, portability, correction, objection, or complaint to a supervisory authority — you have them, and contact@amcrafts.in is where to exercise them.
The game is for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13; a registered account requires an e-mail address, and our terms require the holder to be at least 13. If you believe a child has created an account, tell us at contact@amcrafts.in and we will delete it.
When this policy changes the date at the top changes with it, and for a change that affects how your data is used the game will tell you before it takes effect.
AMCRAFTS · contact@amcrafts.in