Privacy policy

Who we are

The Arojen Tarinat game and this website are developed by Juuso Honkonen and Vilho Valkeala, independent developers in Finland. They are the controllers of the personal data described in this policy. For anything about privacy, write to contact@arojentarinat.com.

This policy covers the Arojen Tarinat Android app, the browser version of the game and this website.

In short

We do not sell your personal data. You never need an account to play, and we do not ask for your name, address, phone number, precise location or payment details to play.

Legal bases

We process personal data only for the purposes described in this policy, and only on a legal basis permitted by the GDPR:

• Providing the game and the features you request (accounts, cloud saves, multiplayer, Premium): performance of our agreement with you (Article 6(1)(b)).
• Gameplay analytics: your consent (Article 6(1)(a)), given in the analytics dialog. You can withdraw it in Settings.
• The Moose AI assistant: performance of our agreement with you, at your request (Article 6(1)(b)). The assistant is optional and the rest of the game works without it.
• Advertising: your consent (Article 6(1)(a)), collected through Google's consent dialog where it is required. If you decline, adverts are limited to non-personalised adverts where the law allows.
• Crash reports, shared game content and keeping the service secure and free from abuse: our legitimate interests (Article 6(1)(f)) in fixing errors, keeping the game working and protecting players.
• Notifications: your permission (consent), which you can withdraw through your device settings.
• Purchases and accounting: performance of our agreement with you (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
• Support requests: our legitimate interests in answering you (Article 6(1)(f)), or steps you request before entering into an agreement (Article 6(1)(b)).
• Website operation and security: our legitimate interests (Article 6(1)(f)) in delivering the site and protecting it from misuse.

Data on your device

Your game saves, save slots, settings, achievements and statistics are stored on your phone. We cannot see them. They stay there until you uninstall the game or clear its data. Android may include them in your own device backup, which is under your control.

Accounts and cloud save

Creating an account is optional. You can play everything as a guest. If you sign in with email or with Google, we store:

• your email address, or the identifier and email address Google shares when you choose Sign in with Google;
• a copy of your progress: statistics, unlocked achievements and save games, so you can continue on another phone.

Even without an account, the game creates an anonymous identifier when you first play online, so that the server can tell players apart. The legal basis is the performance of our agreement with you (providing the game you asked for). You can delete your account and this data at any time; see Deleting your data.

Multiplayer, chat and voice messages

When you play online we process the name you choose, the rooms you create or join, your realm and moves, and the messages you send:

• Chat messages are shown to the other players in your match.
• Voice messages of up to 30 seconds are recorded only while you hold the record button. The microphone is used for nothing else, and Android asks for your permission first.
• You can mute players and report messages. Reports are stored so that we can review them and act against abuse.

Please do not share personal information in chat. The legal basis is the performance of our agreement with you, and our legitimate interest in keeping the community safe. If you delete your account, matches in progress go on with the AI leading your realm.

Shared game content

Generated card images and their metadata are stored in Supabase and shown to players in the game. We process this content to provide shared game features and to keep the service secure and free from abuse, based on our legitimate interests. We keep it for as long as it remains in the game and remove it on request where it can be linked to you.

The Moose AI assistant

The Moose is an optional AI assistant that answers questions about the rules. Before you use it for the first time, the game tells you that your messages are sent to OpenAI, and asks you not to share personal information. When you ask the Moose a question, your current message and up to six recent messages from that session are sent through our server, a Supabase Edge Function, to OpenAI to generate the reply. We do not send your name, your account or other personal data with them.

We do not save AI chat transcripts in our database, and we do not use conversations to train our own models. The conversation stays in the app only for the current session. You can report an offensive or harmful AI reply from the chat screen. OpenAI may keep requests for up to 30 days for abuse monitoring and does not use them to train its models by default. Please do not include personal or sensitive information in your messages.

Analytics and crash reports

Gameplay analytics, only with your consent

The first time you open the game we ask whether we may collect pseudonymous usage statistics. If you agree, the game sends a random installation identifier, a session identifier, platform and app version, session length, and gameplay events such as a session starting, a campaign starting or ending, progress, settings changes or an achievement unlocked. They are stored in our Supabase database and, in the Google Play version, also sent to Google Analytics for Firebase. You can change your choice at any time in Settings. Turning analytics off also deletes what is waiting to be sent from your phone. The legal basis is your consent, and withdrawing it does not affect processing that took place before you withdrew.

Crash reports

If the app crashes, Firebase Crashlytics sends a crash report: the technical details of the error, your phone model, Android version and app version, and a random installation identifier. We use it only to find and fix bugs, based on our legitimate interest in a working game.

Adverts and consent

The free version shows banner adverts from Google AdMob. AdMob and its partners may process your advertising ID, IP address, approximate location, device information and interactions with adverts, in order to show and measure adverts and to prevent fraud.

In the European Economic Area, the United Kingdom and Switzerland, Google's User Messaging Platform (UMP) consent dialog appears before any personalised adverts are loaded. It asks how you want adverts to be personalised. If you decline, we show only non-personalised adverts where the law allows. You can change your choice later through the ad consent options in the game or in your phone's settings. You can also reset or delete your advertising ID in your phone's settings. Google acts as an independent controller for some advertising processing; see policies.google.com/technologies/ads.

With Arojen Premium the game loads no adverts at all.

Arojen Premium and purchases

Arojen Premium is an optional monthly subscription that removes adverts. It is sold through Google Play. Google handles the payment; we never see your card or payment details. To confirm that a subscription is active, our server checks the purchase token with Google Play and keeps the subscription status (active, renewing or expired, and when it ends). The legal basis is the performance of our agreement with you and our legal duties for accounting.

Notifications and in-app messages

On Android 13 and newer the game asks for your permission before sending notifications about news and events. To deliver them, Firebase Cloud Messaging gives your installation a random token. In-game announcements are shown with Firebase In-App Messaging. You can turn notifications off at any time in your phone's settings.

This website

This website uses no cookies, no analytics and no trackers, and all of its fonts and images are served from the site itself. Our host, Vercel, processes your IP address and browser details in short-lived server logs to deliver the pages and protect the site. The contact form only opens your own email app; nothing is sent or stored by the site itself.

Service providers and transfers

We use these providers to run the game and this website. They process data on our behalf under contracts that protect it, except where a provider acts as an independent controller as described above:

OpenAI's published API terms state that data sent through the API is not used to train its models by default. Under those terms, OpenAI may keep it for up to 30 days to provide the service and detect abuse. See OpenAI's API data usage documentation for details.

Supabase, OpenAI, Google and Cloudflare may process data in the United States or other countries outside the European Economic Area. Where this happens we rely on the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses. We do not sell your personal data.

How long we keep data

• Game saves and settings on your phone: until you uninstall the game or clear its data.
• Account and cloud save: until you delete your account.
• Chat and voice messages: for as long as the match exists, and deleted with your account.
• Analytics events: at most 14 months, then deleted.
• Shared game content: for as long as it remains in the game; removed on request where it can be linked to you.
• AI assistant messages: not saved by us as chat transcripts; they remain in the app for the current session. OpenAI may keep requests for up to 30 days.
• Crash reports: up to 90 days in Firebase Crashlytics.
• Subscription records: as long as the subscription runs, then as long as accounting law requires.
• Emails to us: up to 12 months after the matter is resolved.
• Advertising data: as set out in Google's own policies.

Deleting your data

In the game: open Settings, go to Account, tap Delete account and confirm. Your account and its data are deleted straight away, and the game carries on as a guest on this phone.

By email: if you no longer have the game installed, email us from the address you signed in with, or tell us which Google account you used. We confirm that the account is yours and delete it within 30 days.

Deleting your account removes the email address or Google sign-in, the cloud copy of your progress, saves and achievements, your chat and voice messages in every match, and your multiplayer name, which becomes "Player". Audio files of voice messages may remain in our private storage, shown to no one, until they are cleaned up; email us to have them removed at once. Pseudonymous gameplay statistics that are not linked to your account remain for at most 14 months. Progress saved on your phone remains until you uninstall the game or clear its data.

Arojen Premium: deleting your account does not cancel your subscription. Cancel it in the Google Play app under Payments & subscriptions, then Subscriptions. Google keeps its own records of purchases.

Full instructions are on the Delete your account page.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before withdrawal. To use these rights, email contact@arojentarinat.com. Include the email address you signed in with or, for an analytics request, the identifier shown in Settings, so that we can find the relevant data. We reply within one month.

You may also lodge a complaint with the Finnish data protection authority, the Office of the Data Protection Ombudsman, or with the supervisory authority in your own country.

Security

We collect as little data as possible and protect the data we hold. Traffic between the app and our services uses HTTPS/TLS, and the app does not allow unencrypted HTTP traffic. Our Supabase tables use Row Level Security, the service-role key is never shipped in the app, and the OpenAI API key is kept only on the server side. Our full measures, how we handle security incidents and how to report a vulnerability are described in the Security policy.

Age limit and children

Arojen Tarinat is intended for adults aged 18 and over, because it includes chat with other players, adverts and an AI assistant. It is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

Changes to this policy

When the game or this website changes how it uses personal data, we update this policy and the date at the top. For significant changes we also tell you in the game or on this website before the change takes effect.