Privacy policy

1. Controller and contact

The data controller is Royal North, obrt za digitalne usluge, vl. Matej Marić, Radmanovačka ulica 1, Zagreb, Croatia. For privacy questions, data access and deletion requests, email support@bela-royal.com. General enquiries may also be sent to info@bela-royal.com.

2. Google sign-in and Google account data

Google sign-in authenticates you to Bela Royal through Supabase Auth. We use basic identity and profile permissions (openid, email and profile). Google may provide Supabase with your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture. These details may be stored in your authentication profile and session. The game database uses the account identifier and email to link your game profile and progress. You choose a separate nickname and a supplied portrait in the game; your Google picture is not your public in-game portrait.

We use this information to verify identity, create and link accounts, maintain sign-in and protect access to your profile. We do not request access to Gmail messages, contacts, Google Drive files or calendars. We do not receive your Google password or send messages on your behalf through your Google account.

We do not sell Google user data, use it for personalised advertising or provide it to advertising networks. Authentication and hosting providers access it as needed to operate the service; authorised personnel may access it for support or security. Our use of Google data is subject to the Google API Services User Data Policy, including Limited Use requirements where applicable.

3. Other information we process

• Account and sign-in: email, account and player identifiers, verification information and sessions. Email/password authentication is handled by Supabase Auth; passwords are not stored in the game profile database.
• Gameplay and progress: nickname, selected portrait and equipment, matches, scores, wins and losses, ranks and seasonal results, challenges and claimed rewards, virtual coin balances and changes, acquired items and King's Treatment expiry. Active match state is retained to recover interrupted games.
• Activity and game quality: activity and registration times, platform (web, iOS or Android where available), screens visited, match duration and waiting times, disconnections, reconnections, missed turns and invalid actions. Some records are linked to a player identifier; they are not exclusively anonymous statistics.
• Security and support: IP address and technical request information, errors and access restrictions, and the email address and content of messages you send us. Do not send passwords, verification codes or payment card details.

4. Purposes and legal bases

We process data needed for sign-in, progress, matchmaking, results and virtual items to provide the service you request. Account protection, abuse prevention, troubleshooting and internal monitoring of game reliability and usage rely on our legitimate interest in a secure, functional game, taking your rights into account. We also process data to meet legal obligations or handle requests. If we introduce processing requiring consent, we will request it before that processing begins.

Automated matchmaking, scoring, ranks and inactivity rules are game mechanics. Internal administration statistics support service operation and improvements to the user experience and gameplay.

5. Public information and service providers

Other players may see your nickname, selected portrait and equipment, rank, and leaderboard and match results. Your email, authentication tokens and support messages are not part of your public profile.

• Google: identity verification when you choose Google sign-in.
• Supabase: authentication accounts, basic sign-in profile information and authentication sessions.
• Hetzner: hosting the website, game server, game database and server backups.
• Zoho Mail: receiving, storing and sending support email. Messages to our addresses may be forwarded to authorised team members' Gmail/Outlook mailboxes for handling.

Administrative access is restricted to authorised personnel. Information may be disclosed to authorities where required by law. Providers may process data in several countries. Transfers outside the EEA require appropriate safeguards under applicable law, such as adequacy decisions or standard contractual clauses, depending on the provider and processing involved.

6. Cookies, local storage, advertising and purchases

The web game uses essential cookies for sign-in and authentication redirects. The session cookie is marked HttpOnly and Secure. Browser storage retains preferences such as language and sound, and local progress where applicable. Clearing storage may sign you out and remove local settings; it is not a request to delete your server-side account.

The current web beta does not integrate advertising trackers or a payment-card billing system. The shop records items acquired using virtual coins. Internal gameplay statistics do not track you across other websites. Before introducing ads, real-money billing or additional analytics services, we will update our notices and provide any required user choices.

7. Storage, security and retention

Profile and progress data are retained while you use the account and as needed to provide the service. Player-linked activity records currently have no separate automatic deletion deadline; they are retained with the profile until its deletion, subject to justified retention. Support messages and security records are retained as needed to resolve enquiries, protect the service and meet legal requirements.

We use HTTPS, restricted administrative access and protected authentication sessions. Web-session contents are encrypted on the server; this does not mean all gameplay data is encrypted in the same manner. Expired web sessions and temporary authentication flows are periodically removed.

Backups may retain earlier data after deletion from the active database. Routine backups rotate, while backups made for individual deployments may be retained separately. A complete deletion request includes reviewing these backups and explaining any necessary retention and removal timeframe. Backups are not accessible to other players.

8. Deleting profiles, accounts and Google access

For complete deletion, email support@bela-royal.com with the subject “Account deletion”, preferably from your linked email address. Include your nickname and whether the request concerns the main game, the test environment or both. We verify ownership proportionately and do not ask for your password.

The game-profile deletion process removes linked player data, coins, items, challenges and match associations. Unlinked results and aggregate match statistics may remain. Deleting a game profile alone does not delete your Supabase authentication account or Google account. Complete removal of your authentication profile requires a separate support request. Signing in again before removal of the authentication account may create a new game profile.

You can revoke Google access through Google's connected-app settings. Revoking access does not automatically delete an existing game profile; request deletion separately. The test and main game have separate game databases but may share the same Supabase authentication account; complete deletion of that authentication account then affects both.

9. Your rights and policy updates

Subject to applicable conditions, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Contact support@bela-royal.com. We respond within the applicable statutory timeframe. You may complain to the Croatian Personal Data Protection Agency (AZOP) or another competent supervisory authority.

The game currently sets no minimum age and does not verify age or parental consent. This does not remove the special protections applicable to children’s personal data. Where applicable law requires parental authorisation for processing a child’s data, that processing requires such authorisation. A parent or guardian may contact us to review and request deletion of a child’s data. Material changes to our practices will be communicated on the website, in the game or by email.