Privacy Policy

The short version

Creature Lab is a card-collecting game for players aged 13 and over. You can play without creating an account. We collect the minimum needed to run the game, we use no third-party analytics or tracking SDKs (the only measurement is our own pseudonymous game statistics, described below), and we never sell personal data.

What we store

• An anonymous player profile. A random player ID is kept in a cookie on your device so the game remembers you. It is not linked to your name, email, or any real-world identity unless you choose to sign in. The cookie keeps you signed in while you play and stops working after a long time without use (up to 180 days); signing out of a device or deleting your account ends it sooner.
• Game progress. Your chosen display name, the cards you collect, battles, trades, and token balances are stored on our server so your collection is safe.
• First-time guide progress. The short guide shown to new players remembers which step you reached, whether you finished or skipped it, which first-visit tips you have already seen, and which practice battle was your guided one. It holds no name, text or anything else about you, it is used only to show the guide once and let you carry on where you left off, and it is not sent to anyone else.
• Friends and other players. You can add friends with a Friend Code (a random code that is not your player ID), a link, a QR code, or by searching for a display name. We store your Friend Code, your friends, friend requests you send and receive, players you block, and the friendly battles you challenge each other to. Your chosen display name (a nickname, never a real name) is visible to other players, and other players can find you by it. Players cannot send each other messages, photos or any free text. We do not read your contacts and we do not use your location.
• Leaderboards and seasons. Your display name, rank and score appear on the public leaderboards, and each month's season results (rank, rewards, badges) are kept in the game's history.
• Reports and blocks. Players can report another player by choosing a reason from a fixed list (no free text) and can block anyone. We review reports, and we keep the report and what we did about it (for example resetting a name or pausing a player's social features) so the same problem can be handled consistently.
• Game statistics (pseudonymous). To understand and improve the game we record a short, fixed list of actions (for example that the friends screen or the season screen was opened, or which way of adding a friend was used). Each one is a label with a value from a fixed list: no names, Friend Codes, text, location, device identifiers or advertising identifiers. They are tied to you only by a stable random identifier made from your player ID with a one-way hash and a secret key kept on our server. That makes them pseudonymous, not fully anonymous: we can count how many different players do something and follow one identifier over time, and without the key we cannot tell who it belongs to. They are never sent to anyone else, they are deleted automatically after 90 days, and they are deleted when you delete your account.
• Optional sign-in. If you sign in with Google or Apple (via Firebase Authentication), we receive your email address and account identifier. We use them only to link your collection across devices — nothing else.
• Purchase receipts. When you buy tokens through Google Play or the App Store, the store sends us a purchase token we verify and keep so the same purchase is never granted twice. Payment details (card numbers, billing address) never reach us — they stay with Google or Apple.
• Saving, switching and restoring your game. Where the game offers it (More → My game), you can move your game to another device with a transfer code, switch between games on a device, and go back to a game you left. For this we store: the transfer code (a short code shown on one device and typed on another; it works once and expires after 10 minutes, and wrong guesses are limited); a short record that a device moved to another game, kept for up to 24 hours so the move can be finished if the connection drops; and a “way back” to the game you left, kept for 30 days, or up to 180 days if you keep using it. When you choose between two games, the screen can show you, and only you, each game's display name, number of cards, coins, battles won, friends and when it was last played. We never merge two games on our own, and nothing is moved between games unless you choose it and confirm.
• Linked game accounts. If you link a Google Play Games or Apple Game Center account, our server verifies it with Google or Apple and keeps only the account identifier they give for this game: no name, email, friends or photos. (Google's answer also carries the games profile's display name and avatar picture address, and a short-lived access token; we read past them and store none of them. Apple gives us the identifier, your app's bundle id and a signature we check against Apple's own certificate.) We store that identifier only as a one-way keyed code (a keyed hash) that cannot be turned back into your account, to recognise you when you reinstall the game or change phones. On a fresh install the mobile app may ask your games account for that proof once, without a screen, so your saved game comes back by itself; nothing is linked to an existing game without your confirmation. It is removed when you delete your account. To give the welcome tokens only once per game account, even after a reinstall or an unlink and link again, we keep a separate one-way keyed code that has no player ID, no name and no link to your profile. While your account exists we keep it. After you delete your account we keep it for 180 days and then delete it automatically (see Keeping and deleting data).
• Network address and abuse protection. To stop automated creation of fake players and guessing of transfer codes, we count requests per network source for up to 24 hours. Mostly this is a one-way keyed digest that changes with the time window; for a few limits (the first-visit limit and the operators' sign-in) the network (IP) address itself is held for up to 24 hours. We use it only to protect the game: not to identify you, not to build a profile, and never to share it.
• Security and account records. When a device is moved to another game, a link is confirmed or declined, an account is merged or deleted, or an abuse alert goes off, we write a short record: the random player ID, what happened and counts such as how many cards moved. A player's record never holds a name, a transfer code, a session value or a network address. Ordinary records are deleted automatically after 90 days, and significant security records (for example operator sign-ins, revealed secrets, account deletions and abuse alerts) after 180 days. They stay after an account is deleted, without any name, until their period ends. Records the game itself uses (for example that you opened your first pack, and the settlements of battles and trades) stay in the game's history under the random ID, which points to nobody once the account is deleted, and purchase records are kept as described below.
• Technical storage in your browser. Besides the cookie, the app keeps a few small items in your browser: your sound, music and language choices and, if you use My game, short-lived markers that let the app recover when the connection drops during a switch or a deletion (a timestamp, a one-time note for the next screen, and an opaque tag that tells the app whose game its saved data belongs to). They hold no name and no game data, they are used only to make the game work, and they are not shared or used to track you.

Advertising

The mobile app can show optional rewarded ads (you choose to watch an ad to earn a token). Ads are served by Google AdMob, which may process device identifiers (such as the advertising ID), the device's IP address (from which a general location may be estimated), and how ads and the app perform, to deliver and measure ads and to prevent fraud. We do not receive that data. The game is for players aged 13 and over and is not directed at children, so ad requests are not declared child-directed; but because some players may be below the age of digital consent of their country, every ad request is tagged as coming from a user under that age: ads are non-personalized, no interest-based ads or remarketing are requested, the advertising ID is not used to profile you, and ad content is capped at a Teen rating, in every country. We do not build advertising profiles ourselves and we do not sell personal data. Google's practices are described in Google's Privacy Policy.

Age requirement and younger players

Creature Lab is for players aged 13 and over; it is not intended for children under 13 and we do not knowingly collect personal information from them. If we learn that a child under 13 has created a profile, we delete it and its data. The game is built to be safe for younger players anyway: no account is required to play, the in-game shop sits behind an adult check (an adult must type their own year of birth, which we do not store), ads are non-personalized, and we collect no precise location, no contacts, and no photos. Players cannot chat or send each other any text, display names are screened, a friend request carries no message and must be accepted, and any player can block or report another. If you believe a child under 13 is playing, or a minor provided personal information beyond this, contact us and we will delete it.

From a player under 18 we collect nothing beyond what the game needs to work: a random player ID and a display name that must not be a real name. We never ask a minor for an email address, a location, contacts or photos. Optional sign-in is meant for adults: where a player is below the age of digital consent in their country (this age differs between countries, and is often 13 to 16), a parent or guardian should do it; the same goes for linking a game account. Signing out, switching games and deleting an account happen only when the player chooses and confirms, and deleting an account asks an adult to confirm first. A transfer code works like a key for ten minutes, so please keep it private. A parent or guardian of a minor can contact us at any time to see, correct or delete their child's data, or can delete the account on the account deletion page.

Third parties we rely on

• Firebase Authentication (Google) — optional sign-in.
• Google Play Games Services and Apple Game Center — optional linking of your game to your game account (we receive only the account identifier, described above).
• Google AdMob — optional rewarded ads in the mobile app.
• Google Play Billing / Apple App Store — purchases and payment processing.

We do not share personal data with anyone else, and we do not sell data to anyone, ever.

Why we use your data

Where the law of your country asks for a legal basis, ours are:

• To provide the game you asked for (your profile, collection, friends, battles, trades, leaderboards, purchases, and saving, switching and restoring your game).
• Our legitimate interests in keeping the game safe, fair and working: preventing cheating and abuse (including the network counters and the welcome-tokens code described above), handling reports, keeping security and account records, and the anonymous game statistics described above, which we keep small and delete after 90 days.
• Your choice, for optional sign-in. You can withdraw it by deleting your account.
• Legal obligations, for purchase and accounting records.

Where data goes

Creature Lab is operated from Israel. Your data is stored on our server, and the services listed above process the data they handle in the countries where they operate, which can include Israel, the European Economic Area, the United States and other countries. Where the law requires a safeguard for such transfers, we and those providers rely on mechanisms the law recognises, such as adequacy decisions or standard contractual clauses.

Keeping and deleting data

Game progress is kept for as long as your profile is active. You can delete your account and all its data yourself on the account deletion page (also reachable in the app under More → Delete Account), or by contacting us at the address below. Deleting your account removes your collection, your Friend Code, friendships, requests and blocks, your challenges, name history, first-time guide progress, leaderboard payouts, your game statistics, your linked game accounts (their keyed codes), your transfer codes, your way-back and device-move records and your sign-ins; your sign-in at Firebase is deleted too (the deletion is queued and retried until Firebase confirms it). A closed season keeps its results without your profile, battles and trades stay in your opponents' history without your name, and a report you filed or one filed against you is kept for our moderators without any name. Purchase records and a record of the moderation and account actions we took may be retained where required for accounting, fraud prevention or safety. Two things stay for a limited time without any name or link to you: the security and account records described above (until their 90 or 180 days end), and, if you linked a game account, the one-way code that stops the welcome tokens being given twice, which is kept for 180 days after the deletion and then deleted automatically. Copies of our database kept as backups, used only to restore the service after a failure, may still hold deleted data for a limited time: up to 6 months in our own storage and up to 12 months in the encrypted off-site copy, after which they are removed; they are never used for anything else. If deleting your sign-in at Firebase fails, the deletion stays queued and is retried until Firebase confirms it.

Your rights

Depending on where you live (for example in the European Economic Area, the United Kingdom, Israel, or a US state such as California) you may have the right to know what we hold about you, to receive a copy, to have it corrected or deleted, to limit or object to some uses, to move your data, and to withdraw consent you gave us. You can delete your account yourself, as described above. For anything else, write to support@creature-lab.app; we will reply without undue delay and within the time your law sets, and we may need to confirm that the request comes from the account holder or the child's parent. We do not discriminate against anyone for using these rights. If you think we have handled your data wrongly, you can also complain to the data-protection authority of your country.

Security

Data is stored on our own server, sessions use secure HTTP-only cookies, transfer codes work once and expire after ten minutes, and purchases are verified server-side before anything is granted. Linked game accounts are stored only as one-way keyed codes. No system is perfectly secure, but we keep the amount of personal data we hold deliberately small.

Changes & contact

If this policy changes, the date at the top changes with it and material changes will be announced in the app. Creature Lab is the controller of the data described here. Questions, privacy requests or deletion requests: support@creature-lab.app. The rules for using the game are in the Terms of Use.