Privacy Policy

Last updated: October 3, 2026

The short version

Local Wi-Fi games never reach our servers. Bot matches play fully offline; when you are online, the app reports your bot match score so you earn XP and coins.
Your profile is pseudonymous: a random ID, the unique callsign and look you pick, your progress (level, XP, coins, gems, unlocked items) and match stats.
If you connect Google Play Games, we receive only your Play Games player ID and display name, to restore your profile on other devices.
Gems can be bought through Google Play. Google handles the payment: we never see your card or payment details, only the order details we need to credit your gems.
We do not ask for your email, phone number, location, contacts, photos, microphone or camera.
No ads, no advertising ID, no analytics or tracking SDKs, and we never sell your data.
You can delete your online data at any time from Settings → Online → Delete my online data.

1. Who we are

Battleia (the "app" or the "game") is developed and operated by Tanvir Mahin ("we", "us"). This policy explains what information the game and our online service (the Battleia server, including this website) handle, and why. If you have questions, contact us at tanvirmahin24@gmail.com.

2. What we collect

2.1 Information you choose

Callsign (a unique username of 3 to 16 letters, digits or underscores) and color. They are shown to other players in matches, lobbies and on public leaderboards. Please do not use your real full name.
Your look: the hero, skin, hat and outfit you equip. Other players see them in matches.
Preferences such as sound volume, control size and graphics options, so they follow your profile to your other devices.

2.2 Information created when you play online

The first time you use an online feature, the app creates an anonymous profile on our server:

Player ID: a random identifier, and a secret access token for each device you sign in on, which lets that device prove it owns the profile. We store only a one-way hash (SHA-256) of each token.
Match results: kills, deaths, score, team, win or loss, game mode, map and match duration of online matches (with the room code) and of bot matches you play while online. These feed your lifetime stats, your rewards and the leaderboards.
Progress: your level and XP, your balance of coins (an in-game currency earned by playing; it cannot be bought or cashed out) and of gems (a premium in-game currency bought through Google Play or earned by leveling up; it cannot be cashed out), and the items you have unlocked with them.
Rooms you host: the invite code, when the room opened and closed, and the highest number of players.
Timestamps: when the profile was created and when it was last used.

2.3 Information needed to connect you

IP address: required to connect your device to our relay server. We use it in memory to route game traffic and to limit abuse (for example, how many profiles one network can create per hour). We do not store it in our database. Our hosting provider may record it in access and security logs that are kept for up to 30 days.
Game version: the app sends its network protocol version so that only compatible versions are matched.

2.4 Google Play Games (optional)

If you tap Connect Google Play Games, Google gives the app a one-time code. Our server exchanges it with Google to learn your Play Games player ID and display name, and links them to your profile so you can sign in to the same profile on other devices. We do not receive your email address or any other Google account data, and we do not store Google access tokens. Google's own privacy policy applies to Google Play Games.

2.5 Purchases (optional)

Gems are sold in the app through Google Play. Google processes the payment under its own terms and privacy policy: we never see your card, bank or other payment details. When you buy gems, the app sends the Google Play purchase token to our server, which checks the purchase with Google and stores a purchase record: the Google Play order ID, the product (gem pack), the number of gems, the purchase token, the time of purchase and whether it was a test purchase. So that a purchase can only be credited to the profile that made it, the app also gives Google Play a one-way hash of your player ID at checkout.

We use purchase records to credit your gems exactly once, to prevent fraud and to handle refunds: if a purchase is refunded or charged back, the gems it added are removed from your profile. Purchase records are kept for up to 7 years for accounting and tax purposes. If you delete your profile, they are kept but no longer linked to it.

2.6 Live game traffic

During an online match, gameplay packets (movement, aiming, shots and quick-chat phrases from a fixed list) travel between players through our relay. They are forwarded in real time and are not stored. Battleia has no free-text chat and no voice chat.

2.7 Local Wi-Fi play

To find and join games on the same network, the app sends discovery messages over your local network (UDP broadcast) and connects directly to the host device. This traffic stays on your local network and never reaches our servers. On Android this uses the network, Wi-Fi state and multicast permissions.

2.8 Data stored on your device

Your settings, a copy of your profile for offline use, the server address and your access token are saved on your device. Uninstalling the app removes them.

2.9 What we do not collect

We do not collect precise or approximate location, contacts, photos or files, microphone or camera data, advertising IDs, hardware identifiers, payment card or bank details, or crash and analytics data. The app contains no advertising or third-party analytics SDKs.

3. How we use information

To provide online rooms, invite codes and invite links, and to relay gameplay between players.
To show your callsign, look and stats to other players and on leaderboards.
To calculate XP, levels and coin and gem rewards, and to keep your profile, items and preferences in sync across your devices.
To credit gem purchases, prevent purchase fraud, take back the gems of refunded purchases and keep accounting records.
To keep the service safe: rate limiting, preventing spam and replacing offensive names.
To operate, maintain and fix the service.

We do not use your information for advertising, profiling or automated decisions with legal effects.

4. Legal bases (EEA, UK and similar laws)

Contract: providing the online features you choose to use and the gems you buy.
Legitimate interests: keeping the service secure, preventing abuse and purchase fraud, and running fair leaderboards. You can object at any time.
Legal obligation: keeping purchase records as accounting and tax laws require.

5. Who can see or receive it

Other players see your callsign, color, level, hero and cosmetics, and match stats. Leaderboards are public on this website.
Google: if you connect Google Play Games, our server sends Google the one-time code to verify your sign-in. When you buy gems, our server asks Google Play to confirm the purchase, and regularly asks it which purchases were refunded.
Service providers that host our servers and database process data on our behalf, under contract and only to run the service.
Authorities, only when required by law or to protect the rights and safety of players and the service.

We do not sell, rent or trade personal information.

6. How long we keep it

Profile, progress, items and lifetime stats: until you delete them, or automatically after 2 years without use. Sign-in tokens for a device are removed after 2 years without use.
Match records: 12 months.
Purchase records: up to 7 years for accounting and tax purposes, then deleted. Deleting your profile unlinks them from it.
Room records: 30 days.
Relay game traffic: not stored.
Server and security logs: up to 30 days.

7. Your choices and rights

Delete: in the app open Settings and, under Online, tap Delete my online data. Your profile, tokens, items, coins, gems (including gems you bought), link to Google Play Games and stats are deleted immediately, and your rows are removed from match history. Purchase records are kept for accounting but are no longer linked to you. See how to delete your data for other options.
Change: edit your callsign, color and look in the app at any time.
Access, correction, restriction, objection and portability: email us. Because profiles are anonymous, we may ask for details shown in your app (such as your player ID) to find your data.
Complain to your local data protection authority if you are unhappy with how we handle your data.

We answer requests within 30 days.

8. Children

Battleia is not directed to children under 13, or the minimum age required in your country. We do not knowingly collect personal information from children. If you believe a child has used our online features, contact us and we will delete the data.

9. Security

Online traffic is encrypted in transit (HTTPS and secure WebSockets) when the server is configured with TLS, as it is in production. Access tokens are stored only as hashes, we keep as little data as possible, and access to our systems is restricted. No system is perfectly secure, so please tell us if you discover a vulnerability.

10. International transfers

Our servers may be located in a country other than yours. Where required, we use appropriate safeguards such as standard contractual clauses with our providers.

11. Changes to this policy

If we change this policy we will update the date above. For significant changes we will also tell players in the app or on this website before they take effect.

12. Contact

Tanvir Mahin · tanvirmahin24@gmail.com