Valknut: Ragnarok RPG Privacy Policy

Last updated: 11 November 2026.

Valknut: Ragnarok RPG is a mobile game by Biwazen. This policy explains what data the game keeps about you, why, for how long, who it is shared with and what you can do about it. It is written to be understood, and it describes what the game actually does: we collect nothing that is not listed here.

1. Data controller

Biwazen. Contact for anything about your data: info.biwazen@gmail.com.

2. What data we keep and why

Data	What for	Legal basis
Account: email address, password (stored only as a hash, never in plain text), player name, chosen server, sign-up and last sign-in dates, and a random account identifier the game attaches to every purchase.	Creating your account, recognising you when you sign in, showing your name to other players (Warband, League, friends, rankings) and knowing which account to deliver a purchase to.	Performance of the contract (the Terms of Service).
Guest account ("Play now"): your phone generates a random secret and we keep only its hash. We ask for no email or any other data.	Recognising your phone without you signing up.	Performance of the contract.
Email links: when you ask to verify your email, set or recover your password or delete your account from the web, we send you a single-use link; we keep only its hash, the address it goes to and, if you set a password, its hash.	Checking that the mailbox is yours before changing anything.	Performance of the contract.
Sign-in with Google, Facebook or Apple: the user identifier that provider assigns to your account and the provider's name. We do not keep the access token, your friend list, your photo or any other profile data.	Recognising your account when you sign in with that provider. Only if you choose to use it.	Performance of the contract.
Age: the month and year of birth you declare (never the day) and, if the store gives it to us, the age band Google Play or the App Store has for you (minor or adult).	Not letting anyone under 18 pay for anything that ends in a draw or use the server chat (section 8).	Legal obligation and legitimate interest in protecting minors.
Devices for notifications: the device's push notification token, its platform (Android/iOS), its language and your notification preferences.	Sending you the notifications you turn on (production ready, Tower, World Boss, Warband War, etc.). Only if you turn them on.	Consent; withdrawn by turning them off in the game or in the system.
Purchases: the transaction identifier issued by Google Play or the App Store, the product bought, the receipt signed by the store and, if the purchase is refunded, the refund date. We never see your card or payment method: the store handles that.	Validating the purchase, delivering what you bought and handling refunds, chargebacks and disputes.	Performance of the contract and legal obligations (accounting, tax).
Chat: the messages you write in any of the three channels —your Warband, private with a friend and your server—, with their date and the language we detect, and the language you want to read the chat in. Messages are translated by a program that runs on our own server: they are not sent to any third-party translation service.	Letting the people they are meant for read them and, if you want, in your language.	Performance of the contract.
Moderation: the reports you make (of a message or a player, with any reason you write) and the ones you receive, the messages the word filter masked, and the sanctions applied to you (warnings, mutes, removed messages, bans) with their reason. We never tell you who reported you.	Keeping the chat and the game free of abuse, reviewing what is reported and taking repeat offences into account.	Legitimate interest in a safe game and legal obligation (Digital Services Act).
Notices of illegal content from the public form: what is reported, the explanation, and the name and email of whoever sends it, if they leave them.	Reviewing the notice and answering whoever sent it.	Legal obligation (Digital Services Act).
Friends, referrals and Hall of Fame: your friendships, requests, blocks and gifts; your referral code, who joined with it and which code you joined with; and, if you finish among the best of a season, your name and avatar in your server's Hall of Fame photo.	Making those parts of the game work, which other players on your server see.	Performance of the contract.
Discord: if you link your Discord account, its user identifier. We do not keep your name, your email or anything else from Discord.	Paying the mission for joining the game's Discord server, once per Discord account. Only if you link it.	Performance of the contract.
Game state: heroes, resources, progress, Warband, in-game mail, rankings, and the history of in-game currency movements.	Making the game work: it is your playthrough.	Performance of the contract.
Anti-cheat check: every day, what each account earned is compared with the most the game lets anyone earn, and whatever goes over is flagged for a person to review.	Spotting cheating that spoils the game for everyone else.	Legitimate interest in a fair game.
Technical data: for each request to the server, the method, the path (which may carry a player's identifier, for example when opening their profile), the result and the duration, never its content; operational logs that carry your player identifier when the server processes something on your account; and your IP address, which is used for a few minutes to limit the number of attempts and is only stored in the logs when the server rejects a purchase receipt or a request fails on one of its public pages (email links, account deletion, Discord linking, illegal content form).	Keeping the service running, spotting failures and stopping abuse and brute-force attacks.	Legitimate interest in the security and proper functioning of the service.

Automated decisions: there are three. The word filter masks offensive words in a message and, if it does so three times in ten minutes, mutes you in the chat for ten minutes. A third refund of a purchase bans the account (section 4 of the Terms). And the age you declare, or the one the store gives, decides whether paid draws and the server chat are locked for you. You can ask for a person to review any of them by writing to the contact address.

What we do not do: there is no advertising, no third-party analytics apart from the purchase telemetry Unity receives (section 3), no cross-app tracking, we do not sell or hand over your data to anyone for commercial purposes and we do not build commercial or advertising profiles.

3. Who it is shared with

Only with these providers, each for the job described:

Contabo (Contabo GmbH, Germany): hosts the game server, where the database, the chat and the translation live.
Cloudflare (Cloudflare, Inc.): stores the encrypted backups and serves the content files the game downloads (so it sees your IP address when you download them). It also protects the team's access to the administration panel and forwards the support email. The connection to the game server does not go through Cloudflare.
Resend (Resend, Inc.): sends the emails the game sends (verifying your email, recovering your password, deleting your account, acknowledgements from the illegal content form), with your address and the text of the email.
Grafana Labs: receives the server's technical logs described in section 2 and its metrics, for 14 days, to monitor that the service works.
Google (Google LLC and its affiliates): sign-in with Google, Google Play purchases and age signals, push notifications on Android (Firebase Cloud Messaging), and the contact address, which is a Gmail address.
Apple (Apple Inc. and its affiliates): sign-in with Apple, App Store purchases and age range, and push notifications on iOS.
Unity (Unity Technologies and its affiliates): the game's payment system is Unity's, and it sends Unity data about each purchase when you start it, when you pay, if it fails and when it is delivered: the product with its title, description, price and currency; the store's signed receipt, which carries the transaction ID and the random account identifier the game attaches to every purchase (section 2); the store's error message if it fails; the country and language of the store and of the device; the device's model, operating system, storage and boot time; the game's version and install date; an installation identifier Unity creates on the device and a session identifier; and, on iPhone and iPad, the identifier Apple assigns to the device for each developer. Unity receives no advertising identifier, and neither your email nor your name. Unity processes this data as an independent controller, to diagnose and improve that system; we allow it on the basis of our legitimate interest in taking payments through a proven payment system, and it only happens when you buy.
Meta (Meta Platforms): sign-in with Facebook, only if you use it.
Discord (Discord Inc.): linking your Discord account, only if you do.

Each one processes the data under its own privacy policy. Some of these providers are outside the European Economic Area; those transfers rely on the safeguards provided by the General Data Protection Regulation (adequacy decisions, such as the EU-US Data Privacy Framework, or standard contractual clauses). Beyond these cases, we would only hand over data if a law or an authority required us to.

4. How long it is kept

Your account and playthrough data, your age, your devices and your Discord link, for as long as the account exists.
A guest account with no email and no Google, Facebook or Apple linked, 90 days from the last time you sign in; after that it is deleted as in section 5.
The links we send by email expire after 60 minutes.
Chat messages: Warband ones, 7 days; private ones, 30 days (and they stop being shown as soon as the friendship ends); server ones, 2 days. Then they are deleted. A reported message not yet reviewed is kept with its report until a person reviews it, for at most 2 years.
In-game currency movements, purchase receipts and the record of what support has done to your account, 6 years from each one, the period set by accounting and tax rules; then they are deleted. Of a deleted receipt only the transaction identifier remains, with no link to you, so the same purchase cannot be redeemed twice.
Bans and chat mutes, reports between players, notices of illegal content from the public form (with the name and email of whoever sends them, if they leave them) and the anti-cheat check records, with whatever support noted about them, 2 years (a ban or a mute, from when it ends); then they are deleted and stop counting as repeat offences.
Technical logs, with your player identifier or your IP when they carry them, 14 days. The IP that limits attempts, a few minutes.
Backups, encrypted, up to 12 months. Data deleted from the account may remain in a backup until that backup expires; backups are only used to restore the service after a failure.

5. Deleting your account

You can request deletion from the Account screen in the game, from the account deletion page if you no longer have the game (we send a link to your account's email), or by writing to us at the contact address. When you request it, you are signed out on all your devices and the account is scheduled for deletion after 30 days: during that period you can sign in and cancel it from the same screen. After that, everything that identifies you is erased: email, password, name, guest account secret, Google, Facebook and Apple identities, age, Discord link, pending email links, devices and notification preferences, all your chat messages, friendships, requests and blocks, in-game mail addressed to you, the reports filed against you and your places in the Hall of Fame.

What is kept, no longer linked to any person: the history of in-game currency movements and the purchase receipts, because they are the only way to investigate a chargeback or abuse later; the record of actions support took on the account; the reports you made, so that another player's case is not closed; and the anonymous game state (heroes, resources, progress, referrals), which identifies nobody. The history, the receipts, the record and the reports are deleted when their period in section 4 runs out.

If you remove Valknut from your Facebook account, Facebook tells us and we delete that link. If it was your only way to sign in, the account is scheduled for deletion just as if you had requested it; you can check its progress at the confirmation address Facebook shows you.

6. Your rights

You can ask us for access to your data, to correct it, to erase it, to take it with you, to object to processing based on our legitimate interest or to restrict it, by writing to info.biwazen@gmail.com from your account's email. If your account has no email (guest, or with Google, Facebook or Apple), give your player name and your server, and we will ask you for something only the account's owner has, such as the identifier of a purchase the store sent you; without that proof we cannot hand over or change anything.

If you ask for a copy of your data, we send to your account's email (or, if it has none, to the one you wrote from, once it is proven the account is yours) a JSON file, a readable format that is easy to take to another service, with everything we keep about you: the account, your identities, your age, your devices, your chat messages, your reports and sanctions, friends, in-game mail, purchases, balances and the history of your in-game currencies. It does not include passwords or tokens (they are credentials, not information about you) or who reported you. We answer any request within one month. If you think we have not handled it properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority in your country.

7. Security

All communication with the server is encrypted (HTTPS). Passwords, guest account secrets and email links are stored as hashes, sessions expire and are renewed, backups are encrypted, access to the server is limited to whoever operates it, and the administration panel also asks for a second factor.

8. Minors

You must be at least 16 years old to play; the game is not aimed at anyone under that age. If we learn that an account belongs to someone under 16, we delete it; if you suspect so, write to us.

When you start, we ask for the month and year you were born, and only support can change them afterwards. Until you declare them, and while you are under 18, you cannot pay with Amber for anything that ends in a draw or read or write in the server chat; everything else in the game stays open. If Google Play or the App Store tell us you are a minor, that outweighs what you declared.

9. Changes

If this policy changes, we will update the date above and, if the change affects what we do with your data, we will tell you in the game before it applies. The current version is always at this address.