Privacy policy

Who we are

Tales of Ember is a digital card game made by PuzaGames (Przemysław Puzoń), Poland. This policy covers the game, its online services at api.talesofember.com, and the studio's official social media accounts and the internal tool the studio uses to run them.

What the game stores

• Account data: your Steam id, Google Play or Apple identifier (or a device identifier on mobile), the display name you choose, your card collection, decks, match history, ratings and in-game currency balances. This is what a card game needs to work and to run ladders and tournaments.
• Account email (optional): if you add an email address to your account, we store it once a code sent to it has confirmed it is yours, so that you can sign in on another device and recover the account if a device is lost. It is used for sign-in codes and security notices only, never for marketing, and never shown to other players. You can remove it from the game at any time (Profile, Account); a removed address is kept for 30 days so we can act on a "that was not me" report.
• Purchases: receipts and transaction ids from Steam, Google Play or the App Store so we can deliver what you bought and handle refunds. We never see your card number.
• Technical data: IP addresses and request logs kept for security and abuse prevention, and anonymous gameplay telemetry (which cards were played, match length) used to balance the game.
• Creator connections (optional): if you connect a Twitch, Kick or YouTube channel from your profile, we store that channel's public id and name, when the channel was created, and, while you are playing, whether it is live, its title and its viewer count at the time of each check, so the game can pay the creator boost. Twitch and Kick sign-ins are discarded as soon as the channel id has been read. YouTube offers no other way to see whether a channel is live, so for YouTube alone we keep an encrypted read-only access token until you disconnect the channel; you can also revoke it at security.google.com/settings/security/permissions. Disconnecting removes the connection, and a channel that was disconnected keeps a record of which account it belonged to for 30 days, purely to stop the same channel being passed between accounts.
• Invites (optional): your invite code, the code you entered and who it belongs to, how far you have played towards the invite milestones, and - for 30 days after a code is entered - a salted hash of the IP address it was entered from. The hash exists only to notice several invites arriving from one household and is deleted automatically; it is never used to identify or locate you.

Social media accounts

Our official accounts on TikTok, Instagram, YouTube, X, Facebook and Reddit are operated by the studio using a private dashboard. That dashboard connects to those platforms through their official APIs with the studio's own credentials and stores: the studio's access tokens (encrypted), the posts we publish, public comments and replies left on our own posts (author name, public profile id, text, time) so we can answer them, and the aggregate statistics those platforms report about our accounts and posts. We do not collect data about other users of those platforms beyond what they publicly write on our posts, we do not use that data for advertising, and we delete or refresh it in line with each platform's developer policy (comment data within 30 days of retrieval, YouTube data as required by the YouTube API Services Terms). Replies are written by a person, never generated and posted automatically.

Because our accounts use the YouTube API Services, our use of that data is also governed by the YouTube Terms of Service and the Google Privacy Policy. You can revoke our access to your Google data at security.google.com/settings/security/permissions.

Press and creator contacts

We keep a small contact list for talking to journalists and content creators about the game. For each contact we hold a name or channel name, a business email address, the public page the address was published on, the date we recorded it, and the messages exchanged.

Most of that list comes from the creator programme form at /creators, which people fill in themselves. When you use it we also store what you typed into it, the time, and the IP address the form was sent from. The IP is kept for one reason only: it is the evidence that the consent shown on that page was actually given, which we have to be able to demonstrate. It is never used to identify, locate or profile you.

Where that address came from a page you published rather than from you directly, this is the notice the GDPR requires us to give you. The data is the business contact details you made public; the source is named in the first message we send you; we rely on your publication of that address for enquiries of this kind, and on our legitimate interest in telling relevant creators about the game, as our lawful basis. We contact each address at most twice and then stop. Where you asked us to write to you through the creator programme form, we rely on that consent instead, and you can withdraw it at any time with no effect on what came before. You can object at any time and we will act on it within ten working days, and we keep a suppression record of your address afterwards purely to make sure we never write again. Contact details are deleted after twenty-four months of no contact.

Sharing

We do not sell personal data. Data is shared only with the platforms you already use to play or follow us (Steam, Google, Apple, Discord, and the social networks above), with our hosting provider (Hetzner, Germany), and when the law requires it.

Retention and your rights

Game account data is kept while the account exists; you can delete your account from the game's settings or by writing to us, after which it is removed within 30 days except for records we must keep for tax or fraud-prevention reasons. Deleting the account also deletes its creator connections, stream records and invite records. Under the GDPR you may ask for a copy of your data, its correction or deletion, or object to processing, by contacting the address below. Children under 13 may not create accounts.

Contact

PuzaGames — [email protected]

Privacy policy · Terms of service