Privacy Policy

Effective date: 9 November 2026
Last updated: 9 November 2026

This Privacy Policy explains how Arcage Studios handles personal information when you visit our website, apply to test a game, contact us or use Lumen Anchorage.

1. Who is responsible

The controller is Dawid Tomasz Kolaczynski, trading as Arcage Studios, Apartment 16, River Towers, Lee Road, Cork, T23 FC63, Ireland. Contact [email protected] or +353 83 467 8087 about this policy or your information.

Lumen Anchorage is in development. Purchases, live advertising and public social or competitive features are not currently open to the public. The sections below explain the additional processing that applies when those features are available and you use them; they do not announce their launch.

2. Visiting the website

Our site uses Cloudflare for page delivery and security. Delivering a request involves your IP address, requested address, request time and technical browser/device information. Cloudflare may process request and security records to operate and protect its services. We use necessary technical processing for our legitimate interests in providing a reliable, secure website.

This website uses no analytics, advertising pixels or marketing trackers, and does not embed social feeds or advertisements. It sets no optional marketing cookies. Hosting and security processing is limited to what is needed to deliver and protect the site. Links to other services are ordinary links: those services receive a request when you choose to visit them. We will review privacy information and obtain any required consent before introducing optional tracking.

3. Closed-test applications

Our application is hosted on Google Forms, with application administration in Google Sheets. It asks for your Discord username, Google Play email, Android device, country, expected activity, ability to participate for 14 consecutive days, feedback commitment and interests, previous beta experience, and optional notes.

We use your answers to assess device coverage, availability and feedback interests, select testers and contact you about testing. Selection is reviewed by the studio operator, not decided solely by an automated score. Applying does not guarantee a place. The current application asks for a Discord username for test coordination; following our public social pages alone does not apply for testing.

Dawid Tomasz Kolaczynski is the only Arcage Studios operator authorised to access applications. Google also processes the information through its services. We do not publish application responses or use a testing application to subscribe you to marketing. Our basis is our legitimate interest in organising voluntary, relevant testing, balanced against applicants’ privacy and ability to withdraw.

Unsuccessful or withdrawn applications are removed within six months of the decision or withdrawal, subject to an earlier valid erasure request or a specific legal reason to retain a limited record. Selected testers’ application details are retained only while needed for organising their testing. This includes relevant Form responses, Sheet entries and administration copies. To withdraw, correct an answer or request deletion, email us using the address above.

4. Your account and game progress

When you use Lumen Anchorage, we process the identifiers needed for Google Play Games and Firebase sign-in, a player ID, your chosen nickname, and information needed to save and restore your game. This includes levels and progression, Credits, Platinum and event currencies, inventory, cosmetics, unlocks, saved runs, checkpoints and the records of game transactions.

We use this information to provide your account, fulfil game actions, preserve ownership and restore progress. Where necessary to provide the service you request under a valid agreement, our basis is performance of that agreement. We do not receive your Google password through the sign-in process.

We keep minimum proof of Terms acceptance: the authenticated account reference, document version or hash, acceptance time and necessary receipt binding. A privacy-notice acknowledgement is separate from advertising consent. We use this evidence to administer the agreement and address relevant contractual disputes, without keeping a complete profile solely as proof of acceptance.

5. Security, combat verification and diagnostics

We process session and operation identifiers, revisions, request timing, app/build information, integrity checks and transaction receipts to protect accounts and recover interrupted actions. Firebase App Check and Google Play Integrity help establish whether requests come from an expected app and environment.

For supported combat verification, we process relevant game inputs, timing, run/checkpoint information and verification results to check outcomes and protect rewards and rankings. This concerns activity within the game, not your unrelated files, applications or general keyboard use. We use proportionate security processing for our legitimate interests in preventing abuse and providing fair, reliable play. Security checks can make mistakes: contact Support to request review of an incorrect hold or restriction.

Server diagnostics record request/error references, timing, validation outcomes and limited account-linked security information. Hosting services may also process network request metadata. Some support diagnostics stay on your device and are sent to us if you choose to share them. These can include device/OS, graphics, display, performance and connection-check information. The local event report uses a bounded, rotating record; it is not an automatic analytics feed. Firebase Analytics collection is disabled in the current game configuration.

6. Google Play purchases

If you make a purchase when purchases are available, Google Play processes checkout and payment details. Arcage Studios does not receive your full card number or payment credentials through Google Play Billing. We receive technical information needed to verify and fulfil a purchase, including product identifiers, purchase tokens, order/provider status, account binding and entitlement, acknowledgement, consumption, refund and restoration records.

Permanent ownership is recorded separately from resettable gameplay progression. Consumable records distinguish the original purchase from value already used. We use these records to fulfil purchases and restoration requests, prevent duplicate or fraudulent claims, handle refunds and meet applicable legal obligations. Relevant accounting records and restricted evidence may need to remain after other game data is deleted; this does not justify retaining an entire gameplay history indefinitely.

7. Optional rewarded advertisements

When rewarded advertising is available, Lumen Anchorage uses Google AdMob and Google’s User Messaging Platform (UMP). Watching an advertisement is optional. Google may process device and network information, advertising or other identifiers where permitted, ad-interaction information and information used for ad delivery, measurement and fraud prevention. Test and non-personalised advertisements must not be assumed to involve no data processing.

Where required, privacy choices and consent are requested before advertising can be requested. Available privacy settings let you revisit those choices. Advertising consent is separate from agreeing to game terms. UMP manages the current privacy choices on the device; its ability to request an ad is not treated as consent to every advertising purpose. New choices supersede earlier choices for subsequent processing. We do not keep an additional archive of raw advertising-consent strings in ordinary support logs. Refusing optional consent does not itself delete your account. Applicable age and regional restrictions may limit advertising features.

Arcage Studios processes the reward attempt, placement and relevant game action, time and provider verification transaction to validate the correct benefit and prevent duplicate or replayed claims. We use necessary reward records to deliver the requested benefit and proportionate fraud checks for legitimate security interests. Optional advertising processing and access to device information use consent where required. Learn more about Google’s use of information from partner services.

8. Community and competition features

If in-game Global or Fleet chat is enabled, using it involves your public nickname, room-specific identity, supporter display status, messages and timestamps, Fleet membership, and moderation information. Messages are visible to the relevant room or group. Reports, supporting content, block/mute preferences and moderation decisions are processed to address abuse and manage safety. Supporter status never gives an exemption from moderation.

If ranked League participation is enabled, relevant verified scores, season/run and reward receipts, eligibility/review state and a public nickname are used to maintain rankings and protect competition. Valuable public payouts are not currently enabled. Social and competitive processing is limited to providing the feature you choose and our legitimate interests in safe, fair participation; we do not treat agreement to community rules as advertising or privacy consent.

The official Lumen Anchorage Discord community and the Arcage Studios Facebook page are hosted on external services with their own terms, age requirements and privacy practices. A website link does not connect your game account or give us access to private activity on those platforms. Information you send directly to our community or support channels is handled to respond and moderate as appropriate.

9. Support, rights requests and communications

If you contact us, we receive your email/contact details, the information you provide and any relevant attachments. We use Gmail for correspondence. Include only information relevant to the issue; do not send passwords, recovery codes or full payment-card details.

We handle service requests to provide the requested service, other enquiries and appeals for our legitimate interests in responding and resolving disputes, and data-rights requests to meet our legal obligations. We do not use a support request or tester application as permission to send marketing. You can object to unwanted communications by contacting us.

10. Services that handle information

Relevant providers include Cloudflare for website delivery/security; Google Play and Play Games for distribution and authentication; Firebase and Google Cloud for authentication, storage, requests and game verification; Google Play Billing for purchases; AdMob and UMP for available advertising/privacy choices; and Google Forms, Sheets and Gmail for applications and correspondence.

Some providers process information on our behalf under the applicable service terms; others also determine their own processing, such as Google’s account, payment or advertising services. Their role depends on the particular service and information involved.

We may disclose limited information where needed to meet a legal obligation, investigate fraud, protect rights or resolve a dispute. We do not sell players’ personal information. External service information is available in Google’s Privacy Policy, Firebase’s privacy information and Cloudflare’s Privacy Policy.

11. International processing

Our providers operate internationally, so information may be processed within and outside the European Economic Area, including in the United States. The applicable provider and service arrangements determine the locations and transfer safeguards. Transfers may rely on an applicable adequacy decision. Where no adequacy decision covers a transfer, another permitted transfer mechanism is required, such as approved standard contractual clauses. We do not promise that all processing stays in Ireland or the EEA.

Contact us for information about the arrangements relevant to your data and how to obtain available safeguards. See Google’s transfer frameworks and Cloudflare’s data-processing terms.

12. How long information is kept

Different records serve different purposes. A login token or test invitation expiring does not, by itself, mean the associated record has been deleted.

Accounts and recovery

We retain the information needed for the account and service relationship. An inactivity review begins after 12 months; it is not an automatic account reset. Unresolved saves, rewards and recovery receipts remain protected until their dependencies are resolved.

Terms acceptance and privacy choices

Minimum agreement evidence is kept while the relationship remains active. After closure, any continued contractual-evidence retention must have a documented legal need and expiry, assessed against the applicable limitation period. For ordinary Irish simple-contract claims that is generally six years from when the claim arose, not an automatic six-year period for every account field. Current advertising choices remain under the privacy provider’s lifecycle; any necessary dispute evidence is handled as a separate restricted case.

Tester applications

Unsuccessful or withdrawn applications: within six months of the decision or withdrawal. Selected applicants’ recruitment details: while needed for organising testing, with removal within 30 days after participation ends, unless an earlier valid erasure request or specific legal need applies.

Paid ownership and financial records

Minimum entitlement and remaining paid-value records are kept for as long as we still owe that ownership or value. Necessary Irish financial/accounting records normally follow the applicable six-year period. Full technical purchase-token histories are reduced once no longer needed for provider verification, restoration, refunds or financial obligations; minimum ownership and anti-replay evidence remains protected.

Combat and security evidence

Settled detailed combat traces: 30 days after terminal reconciliation, or a later final League result. Unresolved recovery dependencies are excluded. Security case evidence: while the case is open and for 90 days after final resolution, unless a specific documented hold is needed.

Chat and moderation

Ordinary chat content: 30 days from posting. Full moderation-report and appeal evidence: 90 days after final resolution. Where needed for repeat abuse, enforcement or appeals, only minimal case/sanction metadata remains for up to 12 months after resolution. Active restrictions may remain while active, with annual review.

Support and privacy requests

Ordinary support correspondence: six months after closure; unnecessary diagnostic attachments are removed sooner, with a 30-day post-closure limit. Minimum privacy-request and account-deletion completion records: 12 months after resolution. Identity-check evidence is removed when no longer needed, with a seven-day administrative maximum.

Device and server diagnostics

Our retention target for on-device support events is 30 days or the existing size cap, whichever removes entries sooner. Ordinary server diagnostic records have a 30-day target. A relevant export may instead enter a documented support or security case. Older installed app versions and provider-controlled storage may require an update or separate technical action before expiry can be physically enforced; expired material must not be used or exported. An export needed for a specific support or security case follows that case’s retention period.

Provider records and backups

The backup target is a rolling 30 days, but this is not a universal maximum for existing archives or provider copies. Necessary deletion-suppression records remain until the last copy capable of restoring erased data has expired or been removed. Cloudflare controls its request/security processing; this static website creates no separate application request-log database. Google’s mandatory Cloud audit-log category has a fixed 400-day retention period. We do not claim to shorten mandatory provider periods.

These periods describe how long each category should be kept. Automatic expiry is not yet available across every existing device version or storage service, and older archives can remain beyond the rolling backup period. We do not promise immediate erasure from every historical copy. Where physical deletion is temporarily unavailable, expired content must be excluded from use or export and deleted at the next technical opportunity. We explain any record-specific retention or deletion limitation when responding to a request.

A legal, security or fraud hold must record its reason, scope, start date, responsible owner and next review. It is reviewed at least every 90 days and released promptly when the reason ends. An unresolved genuine matter can extend a period; “no fixed maximum” is not a default permission to retain everything.

We can explain the retention affecting a particular record when you contact us. Where information must be retained after an erasure request, we will explain the category, reason and applicable period or criterion, subject to lawful limitations.

13. Younger players

The game’s content rating, account eligibility and the legal requirements for processing children’s data are separate matters. A content rating or Google sign-in does not establish parental consent. Lumen Anchorage is not currently open for unrestricted public account registration. Eligibility for a test is confirmed with an invitation; applying alone does not create a game account.

If you are a parent or guardian with a question about a young person’s information, contact us. We will review the circumstances and any applicable consent, access or deletion requirements. Any public availability for younger players must have appropriate privacy, advertising, purchasing and social safeguards before it opens.

14. Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, portability or object to processing. You can withdraw consent where processing relies on it, without affecting the lawfulness of earlier processing. Rights are subject to their legal conditions; we will explain any applicable exception.

Email [email protected]. We may ask for proportionate information to establish identity and the correct account. You do not need the app installed to begin. We respond without undue delay and normally provide information about action taken within one month. Where the law permits an extension for complexity or the number of requests, we explain it within that first month.

You may complain to the Irish Data Protection Commission, or another competent supervisory authority. The Account Deletion page explains the manual request process. Contact us for human review if you believe a security or moderation decision is wrong.

15. Changes to this policy

We update this policy when our services or data practices change. Material changes will be brought to players’ attention where appropriate, and new consent will be requested when required. A policy update does not itself activate an unavailable game feature.