Privacy policy

[Company name AS] (org. no. [000 000 000]), [Street 1, 0000 Oslo, Norway], is the data controller for the personal data described here. Write to support@tapheim.com about anything in this policy.

Your game account. When you first open the game it creates a random device identifier and an account for it. We store that identifier, your progress and save, the display name and country you choose to set, which app version and platform you last played on, and when you last synced. We need this to run the game for you: to keep your progress, restore it, and stop it being tampered with. Legal basis: our agreement with you (GDPR art. 6(1)(b)).

What happens in the game. The game reports events such as stages reached, bosses beaten and Sovereigns spent, with the time they happened. We use them to balance the game, find bugs and detect cheating, never for advertising. Legal basis: our legitimate interest in a fair, working game (art. 6(1)(f)).

Leaderboards and clans. Your display name, scores and clan membership are shown to other players. That is what a leaderboard is. Legal basis: our agreement with you (art. 6(1)(b)).

Push notifications. If you allow notifications, we store your device's push token so we can tell you, for example, that your boons have finished a job. You can turn this off in your phone's settings at any time. Legal basis: your consent (art. 6(1)(a)).

Your email address. If you attach an email to your account, we use it to send sign-in codes and receipts. Legal basis: our agreement with you (art. 6(1)(b)).

The launch list. If you leave your email to hear when the game launches, we use it for exactly that, once. You can ask to be removed at any time. Legal basis: your consent (art. 6(1)(a)).

Purchases. When you buy Sovereigns we store the order (what you bought, the price, when, and whether it was paid) and the billing name, address and optional phone number you give, which the card network uses to check the payment. Your card details go to our payment provider and never reach us. Legal basis: our agreement with you (art. 6(1)(b)), and the Norwegian Bookkeeping Act, which requires us to keep accounting records (art. 6(1)(c)).

Technical data. Like any server, ours receive your IP address and basic information about your browser or device with every request. We use it to deliver the service, keep it secure and investigate abuse. Legal basis: our legitimate interest in a working, secure service (art. 6(1)(f)).

• We do not sell your personal data or share it for advertising.
• This website uses no analytics, advertising or third-party tracking cookies. See the cookie policy.
• We do not make decisions about you by automated means that have legal or similarly significant effects. Anti-cheat checks can flag a save, but a person looks before an account is suspended.

We use a few providers who process personal data on our behalf, under data processing agreements that only let them use it to provide their service to us:

• WhiteGallo, our payment provider, which takes your card details on its own page and processes the payment.
• SendGrid (Twilio Inc.), which delivers our emails: sign-in codes and receipts.
• The companies that host this website and our game servers.
• Apple and Google, which deliver push notifications to your device and distribute the game through their stores under their own terms.

We also hand over data when the law requires it, for example to the police with a valid order, or to the tax authorities.

Some of these providers are based in, or use servers in, the United States. Where personal data leaves the EEA, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses. Write to us if you would like a copy of the safeguards.

• Your account, progress and email: as long as the account exists. When you ask us to delete it, we delete it within 30 days.
• Gameplay events: as long as we need them to balance the game and investigate cheating, and no longer than 24 months.
• Orders and billing details: five years after the end of the financial year, as the Bookkeeping Act requires.
• The launch list: until the launch email is sent, or until you ask to be removed.
• Server logs: normally no more than 90 days, longer only while investigating a specific incident.

You may ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict how we use it, or to receive it in a machine-readable form. You may object to processing based on our legitimate interests, and withdraw any consent you have given without affecting what we did before.

Write to support@tapheim.com. Because the game has no password, we may ask you to prove the account is yours, for example with a link code from the game's settings. We answer within one month.

If you think we have handled your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority where you live. We would be glad to hear from you first.

Tapheim is not made for children under 13, and they should not attach an email or join the launch list without a parent or guardian. Anyone under 18 needs a parent's or guardian's permission to buy Sovereigns. If you believe a child under 13 has given us personal data, write to us and we will delete it.

Everything between the game, this site and our servers is encrypted in transit. Your sign-in on this site is held in a cookie your browser's scripts cannot read, and card details never reach our systems. No system is perfectly secure, and if a breach puts your data at risk we will tell you and Datatilsynet as the law requires.

When this policy changes, the date at the top changes with it. If a change matters to how your data is used, we will also say so in the game or by email before it takes effect.