Privacy Policy

Effective October 23, 2026 · Applies to the Open Galaxies War app for Android (dev.deam.galaxies_war) and iOS, and its game servers.

1. Who we are

Open Galaxies War is developed and operated by Damian Diaz ("we", "us"), Madrid, Spain. We are the controller of the personal information described here. Contact us at deam.diaz.developer@gmail.com.

2. What we collect

2.1 If you play without signing in (guest)

Your colony, progress and settings are saved only on your device. We don't receive them. The services in section 2.4 (crash reports, usage statistics and device integrity checks) still run.

2.2 If you sign in with Google or Apple

• Google account details. Sign-in goes through Google's Firebase Authentication. It receives your Google account's email address, name and profile picture, and gives us a random account ID. Our game servers store only that account ID and the sign-in method. They don't store your email, name or picture. We see your email only in Firebase's account console, and the app shows it to you in Settings.
• Apple account details. Sign in with Apple also goes through Firebase Authentication. Apple shares an email address, which is a private relay address if you choose Hide My Email, and your name only if you choose to share it. As with Google, our game servers store only the random account ID and the sign-in method. When you delete your account in the app, we also revoke the game's Sign in with Apple access.
• Your commander. The callsign and faction you choose, your portrait choice, your game settings (sound, music, haptics, graphics, which notifications you want), and your device's time zone. We use the time zone to reset daily rewards at your local midnight and to send notifications at reasonable hours.
• Game data. Your colony, buildings, research, ships, resources, Data Cores, missions, battle pass, rankings, raids and battle reports, in-game mail, alliance membership, and a history of the actions your app sent to the server. We need these to run the game and to prevent cheating.
• Alliance chat. The messages you post in your alliance's chat, with your callsign and the time. Members of that alliance can read them.
• Blocks, reports and chat rules. The players you block (their chat messages are hidden from you), the reports you file against players or messages (who, why and when), reports other players file about you, and when you accepted the chat rules.
• Notification token. If you allow notifications, a Firebase Cloud Messaging token for your device, so we can send you game alerts.

2.3 Purchases

Purchases are made through the store you installed the game from: Google Play, or Apple's App Store. We never receive your card or payment details. For each purchase we receive and store:

• the store's order or transaction ID and purchase token;
• the product;
• its status (pending, granted or refunded);
• what it granted.

We also keep a ledger of Data Core changes. We use these records to credit purchases, handle refunds and prevent fraud. On Android, the app passes Google Play a one-way scrambled form of your account ID, so a purchase can only be credited to the account that made it.

2.4 Automatically, on every Android and iOS device

• Crash reports (Firebase Crashlytics): when the app crashes, a report with the error, the app version, device model, operating system version and a random installation ID.
• Usage statistics (Google Analytics for Firebase): events such as first open, sessions and screens viewed, and game events (raids finished and their stars, upgrades started, levels reached, offers viewed, purchases made by product, battle pass tiers claimed), with a random app instance ID, device model, operating system, app version, and approximate location (country or region) derived from your IP address. We have turned off advertising ID collection and don't use this data for advertising.
• Rewarded ads (Google AdMob): only when you tap to watch an ad for a reward. AdMob receives your device's advertising ID, IP address, device and app information to serve a non-personalised ad, count it and prevent fraud. It tells our servers that you finished watching (with your account ID and which reward), so we can grant it. In the EEA and UK you are asked for consent first; you can change your choices any time in Settings → Privacy options. On iOS the game never asks for permission to track you, so AdMob doesn't receive your device's advertising identifier (IDFA).
• Device integrity checks (Firebase App Check, with Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS): a token that tells our servers the request comes from our real app on a genuine device.
• Server logs. Our servers log each request's path, result and timing. Our hosting provider (Google Cloud) may record the IP address and user agent of requests in its platform logs.

2.5 What we don't collect

We don't request or collect your precise or approximate location through device location services. We also don't access your contacts, photos, files, microphone or camera. The game has no ad or tracking SDKs other than those listed above, and no banner or pop-up ads.

3. How we use it

We don't use your information for personalised advertising, profiling for advertising, or automated decisions with legal or similarly significant effects.

4. Who sees it

• Other players see your callsign, faction, portrait, level, experience, public statistics, alliance and VIP badge. Rival commanders see your colony layout when they raid it. Members of your alliance see your chat messages.
• Google runs our infrastructure as our service provider (processor), under its data processing terms: Firebase Authentication, Cloud Firestore, Cloud Run, Cloud Tasks, Cloud Logging, Firebase Cloud Messaging, Crashlytics, Google Analytics for Firebase and App Check. Google Play processes your payments under Google's own privacy policy. Google AdMob serves the rewarded ads under Google's own privacy policy (how Google uses information from apps that use its services).
• Apple handles Sign in with Apple and App Store payments under Apple's own privacy policy, and checks app integrity on iOS (App Attest and DeviceCheck).
• Authorities, if the law requires it, or to protect the rights and safety of players or others.
• If the game is sold or transferred, the buyer, who must honour this policy.

We don't sell your personal information and don't "share" it for cross-context behavioural advertising, as those terms are defined in California law.

5. Where it is stored

Our game servers and database are in the United States (Google Cloud, us-central1, and Firestore's nam5 multi-region). If you live elsewhere, your information is transferred to the United States. For transfers from the EEA, UK or Switzerland, Google relies on the European Commission's Standard Contractual Clauses and equivalent safeguards.

6. How long we keep it

7. Your choices and rights

• Delete your account in the app (Settings → Account → Delete) or by request. We erase your commander, progress, colony, mail, rankings, alliance chat messages, blocks and Google or Apple sign-in record straight away. Only the purchase records in section 6 remain.
• Notifications: switch categories off in Settings → Notifications, or turn them off in your phone's settings.
• Access, correction, portability, objection and restriction: email deam.diaz.developer@gmail.com from the address of your Google or Apple account, with your callsign. If you use Apple's Hide My Email, write from any address and we will confirm the account is yours another way. We will send you a copy of your data in JSON format, or act on your request, within 30 days. You can change your callsign and faction yourself in the app.
• California residents have the right to know, delete and correct personal information, and not to be discriminated against for exercising these rights. We don't sell or share personal information.
• In the EEA or UK you may complain to your data protection authority. We would appreciate the chance to help first.

8. Children

Open Galaxies War is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it. Players under the age of majority, or under the age of digital consent in their country, should have a parent's permission before signing in or making purchases.

9. Security

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS), and our database is encrypted at rest by Google Cloud. Every request is authenticated with a Google-issued sign-in token and checked for app integrity. Our servers verify every purchase with Google, and every raid result is replayed on the server. Access to production data is limited to us. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

10. Changes

If we change this policy, we will update the date above. If a change is significant, we will tell you in the game before it applies.

11. Contact

Damian Diaz · Madrid, Spain · deam.diaz.developer@gmail.com