Privacy policy

Endless Bastion on Android (Google Play)

• Game progress. Your save — waves reached, upgrades, research, currencies — is written to the app's own storage on your device. If you sign in to Play Games and choose Back up in Settings, the game sends a copy of your progress to Google Play Games Saved Games, associated with your Play Games account. Backup and restore are optional and requested by you; they do not run automatically. Uninstalling or resetting the local save does not delete an existing cloud backup.
• Play Games. The game offers sign-in through Google Play Games Services. Sign-in is optional and can be declined; the game is fully playable without it. Google tells the game whether a player is signed in and gives it your Play Games player ID. We never receive your email address, your password, or your contacts. Play Games also handles achievements, leaderboard submissions and the optional cloud backup.
• Analytics. The Android build includes Google Analytics for Firebase to understand game usage and performance. When enabled, it reports an app-instance identifier, device model, operating system and app version, coarse country or region, session and app-interaction events, and automatic in-app purchase events where available. Purchase events can include the product, price and currency; they do not contain your payment-card details. In version 0.1.9 and later, collection waits for a completed Google privacy flow and an analytics-storage choice that permits collection. Where Google requires consent, refusing analytics keeps collection off. Firebase advertising-ID collection is disabled in these versions; AdMob has separate advertising-ID handling described below. Earlier versions could enable analytics on Play-installed release builds without this startup gate. Gameplay and purchases do not require analytics permission.
• Purchases. The game offers optional one-time in-app purchases through Google Play Billing: a shard doubler, a longer offline window, a skip that pays out ad rewards without showing the ad, and a cosmetic keep. Google takes the payment and holds the record of it against your Google account. We never see your card, your billing address, your name or your email. The game asks Google Play whether your account owns each product and keeps only that yes or no, on your device, so a purchase still works with no network. Google Play supplies purchase status and purchase tokens to the billing integration to confirm, acknowledge and restore purchases. These tokens are not sent as custom analytics parameters. Nothing in the game is locked behind these purchases.
• Ads. The game shows rewarded video ads through Google AdMob, and only when you press a button that offers a reward for watching one. There are no banners and no ads that interrupt play. To serve an ad, AdMob receives the Android advertising ID, your IP address (and the coarse location it implies), device model, operating system, app version, and how you interact with the ad, as well as SDK diagnostic information and other device identifiers such as the app-set ID where applicable. Google uses this to serve and measure ads, to prevent fraud and, where you allow it, to personalise them. In the EEA, the UK and Switzerland the game asks for your consent through Google's consent form before any ad is requested, and you can change that choice later through Privacy options in the game's Settings wherever Google requires that entry point. Declining personalisation does not necessarily prevent every ad request: Google's SDK determines whether limited or non-personalised ads may be requested under your choices. Ad offers can preload when the relevant screen opens. While the ad-skip entitlement is recognised, the game does not request rewarded ads for you. The Google privacy form may still appear at startup, including for analytics choices.
• Not collected. No accounts created by us, no payment details, no precise location, no contacts, no camera, no microphone, no access to your personal files, no messages.

Endless Bastion on Windows (Steam)

Your save is written to your own computer. The game includes no analytics, no ads and nothing to buy inside it. Steam runs the game and records achievements against your Steam account; Valve handles that under the Steam privacy policy. We receive no personal data from Steam beyond what Steamworks reports to every developer, such as sales and aggregate play figures.

This website

The site itself sets no cookies and runs no analytics. It is hosted on GitHub Pages behind Cloudflare, which log requests, including your IP address, to deliver and protect the site, under GitHub's and Cloudflare's privacy policies.

Who else sees it

We do not sell your data. The services above are run by Google (Firebase, Google Play, Play Games Services, Google Play Billing, Google AdMob) and process this data under Google's privacy policy. The Android build shares ad data only with AdMob, which may pass it to the advertisers bidding to show you an ad; how Google handles it is set out in how Google uses information from apps that use its services. We disclose data otherwise only where the law requires it.

Security

The Android integrations send data to Google using encrypted connections. Local progress and cached purchase entitlements stay in the app's private storage. Cloud backups are associated with your Google Play Games account. Keep your device and Google account protected; no storage or transmission system can guarantee absolute security.

Keeping and deleting it

• Device save. Erase it yourself at any time — Settings → Reset all progress inside the game, or uninstall the app. This affects local progress, not Play Games backups, Google's purchase records or analytics already sent to Google.
• Play Games. Use Play Games Settings → Delete Play Games account & data → Delete individual game data to delete this game's Play Games data, including saved games. Revoking access is separate from deleting stored data. Manage the game's account access at myaccount.google.com/permissions.
• Analytics. Change analytics permission through Settings → Privacy options where available to stop further collection. Withdrawal clears queued local analytics and resets the app-instance identifier when Firebase is active; if it is inactive, that local reset is deferred until the next permitted activation. Withdrawal does not erase records already sent to Google. Resetting the Android advertising ID does not delete Firebase's app-instance identifier or analytics history. Email [email protected] to request analytics deletion; we will explain what identifying information is needed and what records we can locate, without requesting your Google password or payment details. Google retains analytics event data according to the property's configured retention period; aggregate reports may persist longer. Contact us for the current configured period and deletion assistance.
• Ads. Held by Google under its own retention rules. Change your consent choice from the game's Settings, opt out of ad personalisation or delete your advertising ID under Android Settings → Privacy → Ads. Not watching an ad is separate from preventing preloading: offers can request an ad when their screen opens. Google determines what advertising data is retained for measurement, security and fraud prevention under its policies. Contact us for help with a data request; we cannot directly erase Google's independent advertising records.
• Purchases. The record of a purchase belongs to your Google account, not to us, and we cannot delete it. Refunds and purchase history live at your Google Play order history. A refunded purchase is withdrawn from the game the next time it reaches the store.

Your rights

Under the GDPR and similar laws you can ask for a copy of the data held about you, ask for it to be corrected or deleted, or object to its processing. Current Android versions use Google's privacy choices to gate analytics; where consent is required, analytics relies on that consent. Personalised ads in the EEA, the UK and Switzerland rely on your consent. Use Settings → Privacy options where available to change your choices, or email us for assistance. Google determines which ad requests are permitted after a refusal; non-personalised advertising is not a promise that no identifiers or local storage are used. You may also complain to your local data protection authority. Email us to exercise your rights; we will respond within the applicable legal deadline, normally one month.

Children's privacy

This game is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child's data reached us, email us and it will be removed.

Changes

When the game starts or stops collecting something, this page changes with it and the date at the top moves. The date above is the version in force.

Contact

Questions, or a request about your data? Reach out at [email protected].