Privacy Policy – Fortify Castle

Last updated: 13 November 2026.

Publisher (data controller): Westnell Holding AB

Contact: gate@fortifycastle.com

The short version

Fortify Castle is a game for children and adults. We built it so that we never need to know who you are.

• No e-mail address, phone number, real name, birthday, photo, contacts or location is ever asked for or stored.
• No advertising, no tracking, no analytics tools from other companies.
• No chat and no free-text names. Player names are put together from two words on the game's own lists.
• No purchases with real money.
• You can delete everything at any time, in the game or on our website.

What is stored on your device

Your settings (language, sound), your chosen squad, your progress and an ongoing match are saved in the app's own storage on your device so that the game can continue where you left off. When the game plays online, a secret sign-in key for your account is saved there too.

What is stored on our server when you play online

• A random account number. It is made up by the server the first time you play. It is not built from your device, and it says nothing about you.
• Your player name and picture. The name is two words you pick from the game's lists (for example "Glada Bulten"). The picture is one of the game's own characters. Other players can see these two things.
• Your game progress. Level, coins, cards, unit levels, mastery, trophies, packs, daily quests and win streak.
• Your matches. The moves you made, the result and the reward, so that the server can decide the outcome fairly and so that a lost connection never costs you anything.
• Your recorded battle plans. Other players can meet a recording of how you played, shown with your player name and picture. You can switch this off under Settings. Only your latest five plans are kept.
• When the account was created and last used. Used to remove old accounts automatically.
• A recovery code, if you create one. Stored only as a one-way checksum. We cannot read it.

What the server handles but does not keep

Your internet address (IP address) reaches the server with every request, as with every internet service. It is used for a moment to stop abuse (too many requests) and is not written to our database or our logs.

What we never do

• We never sell or share data with anyone for advertising or profiling.
• We never combine your game data with data from other sources.
• We never send push notifications, e-mails or messages.
• The game never asks for access to camera, microphone, photos, contacts or location.

Why we are allowed to store this (legal basis)

We store the data above because it is needed to run the game you asked to play (performance of a contract, GDPR Article 6.1 b) and to keep the game fair and safe (legitimate interest, GDPR Article 6.1 f). We do not rely on consent, because we do not collect anything that would need it.

Children

The game is open to children. For that reason it collects no personal information from anyone, whatever their age: there is nothing to type that could reveal who a child is, no way to contact a child through the game, no advertising and no purchases. Links from the game to web pages (such as this one) sit behind a question for grown-ups. Parents and guardians can delete a child's account at any time, as described below, and are welcome to contact us with any question.

How long data is kept

• Moves in a finished match: 30 days.
• Finished matches and reward receipts: 90 days.
• Recorded battle plans: the latest five per player, and never used after 30 days.
• Sign-in keys that are not used: 400 days.
• An account that is not opened for 24 months is deleted completely and automatically.
• Backups are overwritten within 30 days.

Where data is stored and who helps us

The server is located in the European Union. It is run by a hosting company that works on our instructions under a data processing agreement and may not use the data for anything else. No data is transferred outside the EU/EEA. The current hosting company is named on our support page.

Your rights

You can, free of charge:

• See your data: Settings → Privacy → Show my stored data.
• Delete your data: Settings → Privacy → Delete all my data. The account and everything belonging to it is erased from the server and from the device at once. Without the game, use the Delete account page on our website with your recovery code.
• Move your account to a new phone with a recovery code: Settings → New phone.
• Stop sharing your battle plans: Settings → Online.
• Change your name or picture: Profile.
• Ask us anything or object to how we handle data: write to the contact address above.

You also have the right to complain to your data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY), imy.se.

Security

All traffic between the game and the server is encrypted. Sign-in keys and recovery codes are stored only as one-way checksums. Rewards, packs and match results are decided by the server, not by the app.

Changes

If a future version changes what is stored, this policy and the store listings are updated before that version is released. The date at the top shows the latest change.

Svenska

Kort version. Fortify Castle är ett spel för barn och vuxna. Vi har byggt det så att vi aldrig behöver veta vem du är. Vi frågar aldrig efter e-post, telefonnummer, riktigt namn, födelsedag, foto, kontakter eller plats. Spelet har ingen reklam, ingen spårning, ingen chatt, inga fritt skrivna namn och inga köp för riktiga pengar.

På din enhet sparas inställningar, din trupp, dina framsteg, en pågående match och, vid onlinespel, en hemlig inloggningsnyckel.

På vår server sparas, när du spelar online: ett slumpat kontonummer, ditt spelarnamn (två ord ur spelets listor) och din bild, dina framsteg, dina matcher och belöningar, dina fem senaste inspelade stridsplaner, när kontot skapades och senast användes, samt en kontrollsumma av din återställningskod om du skapat en.

Din internetadress (IP) används ett ögonblick för att stoppa missbruk och sparas varken i databasen eller i loggar.

Rättslig grund. Uppgifterna behövs för att köra spelet (avtal, GDPR artikel 6.1 b) och för att hålla det rättvist och säkert (berättigat intresse, artikel 6.1 f).

Barn. Spelet är öppet för barn. Därför samlar det inte in personuppgifter om någon, oavsett ålder. Länkar ut ur spelet ligger bakom en fråga till vuxna. Vårdnadshavare kan när som helst radera ett barns konto.

Lagringstid. Drag i en avslutad match 30 dagar. Matcher och kvitton 90 dagar. Oanvända inloggningsnycklar 400 dagar. Ett konto som inte öppnats på 24 månader raderas helt. Säkerhetskopior skrivs över inom 30 dagar.

Var. Servern står inom EU och sköts av ett värdföretag enligt ett personuppgiftsbiträdesavtal. Inget förs ut ur EU/EES.

Dina rättigheter. Se din data: Inställningar → Integritet → Visa min sparade data. Radera allt: Inställningar → Integritet → Radera all min data, eller sidan Delete account på vår webbplats med din återställningskod. Flytta kontot: Inställningar → Ny telefon. Sluta dela stridsplaner: Inställningar → Online. Du kan också kontakta oss på adressen överst, och klaga hos Integritetsskyddsmyndigheten (imy.se).

Deutsch (Zusammenfassung)

Fortify Castle ist ein Spiel für Kinder und Erwachsene und erhebt keine Angaben darüber, wer du bist: keine E-Mail, kein echter Name, kein Standort, keine Werbung, kein Tracking, kein Chat, keine Käufe mit echtem Geld. Online speichert der Server in der EU eine zufällige Kontonummer, deinen Spielernamen aus den Wortlisten des Spiels, dein Bild, deinen Fortschritt, deine Spiele und deine aufgezeichneten Schlachtpläne. Du löschst alles unter Einstellungen → Datenschutz → Alle meine Daten löschen oder auf unserer Webseite mit deinem Wiederherstellungscode. Ein Konto, das 24 Monate nicht geöffnet wird, wird automatisch gelöscht.

Español (resumen)

Fortify Castle es un juego para niños y adultos y no recoge datos sobre quién eres: sin correo, sin nombre real, sin ubicación, sin anuncios, sin rastreo, sin chat y sin compras con dinero real. En línea, el servidor (en la UE) guarda un número de cuenta aleatorio, tu nombre de jugador formado con las listas del juego, tu imagen, tu progreso, tus partidas y tus planes de batalla grabados. Puedes borrarlo todo en Ajustes → Privacidad → Borrar todos mis datos o en nuestra web con tu código de recuperación. Una cuenta que no se abre en 24 meses se borra automáticamente.