Privacy Policy

This policy explains what personal data the game Alchemist’s Apprentice (its home page, the website where it is played, the Telegram bot and Mini App, and the mobile app — together, the “game”) collects, why, how long it is kept, who helps us process it and what your rights are. We keep only what the game needs to work. There are no trackers and no advertising or tracking analytics, ads appear only when you choose to watch one for a reward, and we never sell your data.

1. Who is responsible

The controller of your personal data under the GDPR is:

• Mykola Reznichuk, sole trader (živnostník) registered in the Slovak Republic
• 1. mája 555/6, 907 01 Myjava, Slovakia
• Email: kolya.reznichuk@gmail.com
• Telegram: @reznichuk

Write to us about anything in this policy or to use your rights. We do not have a Data Protection Officer; the controller handles every request personally.

2. What we collect

2.1 Your account

• A random account ID and a display name (generated for you, or one you chose). The name is shown to other players on the leaderboards and to your friends.
• If you create a login: your login name and your password, stored only as a salted scrypt hash — we can never see the password itself.
• The language you picked, when the account was created and last used.
• Your age confirmation from the first launch (16 or older, or younger with a parent’s or guardian’s agreement), the version of this policy it was given for and when.
• Sessions: the time each sign-in was created, last used and expires. The session token itself stays on your device; the server keeps only its hash. One-time login codes (to open your account on another device) are also stored only as hashes and expire after 10 minutes.
• If your account is suspended for breaking the rules (section 5 of the Terms): when, why and until when.

2.2 Telegram

If you play in Telegram or link Telegram to your account, Telegram sends us, and we store: your Telegram user ID, username, first name and language code; whether our bot may message you; your notification settings, time-zone offset and the notifications planned for you. We do not receive or store your phone number, and we do not store your last name or profile photo.

2.3 Your game

• Your save: progress, items, the tower, the village, quests and everything else in the game.
• Results of your runs (wave, kills, duration, reward) and your records on the leaderboards.
• Your friend code, your friends list and the gifts you send and receive.
• When our support fixes or restores your save, copies of it from before the change (at most 30) and a record of what was done, by whom and when.
• Letters our team sends you in the game (Profile → Letters): the title, the text, any gift in it, when it was sent and when you opened it.
• Gift codes you have entered (Profile → A gift code): which code and when.

2.4 Technical data

Your IP address is used for a short time in memory to limit how many requests one visitor can send (protection against abuse); we do not store it in our database. Our hosting providers keep standard server logs (IP address, time, requested address, browser information) for security and operation, for a short period under their own policies.

2.5 Purchases

The game is free to play; some extras can be bought (see the Terms of Use, section 7). For each order we store: the product, its price and currency, the platform you paid on, the order’s status, the payment’s ID at the payment platform, when you agreed that the product is delivered at once (and that you then lose the right of withdrawal), and when the order was created, paid and delivered. What you bought and your stardust balance are also part of your save.

We never see or store your card or bank details. Payments are taken by the platform: Telegram (Telegram Stars) in Telegram, Apple in the iOS app, Google in the Android app, and on the website by an online reseller that sells on our behalf as the merchant of record (its name is shown at checkout). Each of them processes your payment data under its own privacy policy and tells us only that the payment succeeded, its ID and amount.

2.6 Rewarded ads

You can choose to watch a short ad for a bonus (for example, to double what the tower made while you were away). Ads are never shown without you asking, and at most 10 a day. For each view we store where it was offered, when it started and when its reward was paid, and whether it was skipped thanks to the “No ads” purchase — to pay the reward once and keep the daily limit.

At the moment these ads are a placeholder inside the game: no advertising network is involved and no data leaves our servers. Before we start working with an advertising network we will update this policy, name the network, and — where the law requires it — ask for your consent before any personalised ads.

2.7 Complaints and suggestions

When you write to us from the game (Profile → Complaints & suggestions, the pause menu) or with /feedback in the bot, we keep the topic, your message, its status and our answer, and what the game adds by itself: the platform, the game’s version, the language, the screen size, where in the game you were and your hero’s level. If you tick “attach my save”, a copy of your save at that moment is kept with the message to help find the problem. For a payment you may pick one of your orders; for a report about a player, the name you wrote is kept and matched to that player’s account so we can look into it. At most 5 messages a day.

2.8 On your device

The game stores in your browser’s local storage only what it needs to work: your session token, a device ID used to sync the save, the sync counter, your language and sound settings, and which new items and letters you have already seen. We use no cookies for tracking or advertising, so there is no cookie banner. Deleting the site’s data in your browser removes all of this.

2.9 The home page

The game’s home page (the page that describes the game and links to it, with these legal pages) has no accounts, no forms and no cookies, and its fonts and images are served from the site itself. To see how fast it loads, it uses Vercel Speed Insights: for each visit it measures loading performance (the Core Web Vitals) and sends it to Vercel together with the page address, the device type, the browser and the country. It sets no cookies, does not identify you or follow you across sites, and keeps no IP address. The legal basis is our legitimate interest in a fast, working website (Art. 6(1)(f)). The hosting provider also keeps the standard server logs described in section 2.4.

3. Why we use it and on what legal basis

Automated checks only decide whether a game result can be credited (a result that is not possible in the game is not counted). We make no decisions about you with legal or similarly significant effects by automated means, and we do not profile you.

4. Who else processes your data

We do not sell or share your data with anyone for their own purposes. These providers process it on our behalf (as processors) to run the game:

• Vercel Inc. (USA) — hosts the website and delivers it through its global network.
• Render Services, Inc. (USA) — runs our game server in its Frankfurt, Germany region.
• Neon (Databricks, Inc.) (USA) — hosts our database on Amazon Web Services in Frankfurt, Germany.
• Telegram — when you use the game through Telegram, the bot’s messages and the Mini App go through Telegram, and Telegram’s own privacy policy also applies to what you do in Telegram.

When you buy something, the payment platform you use — Telegram, Apple, Google, or the website’s reseller named at checkout — processes the payment as an independent controller under its own terms and privacy policy.

Your data is stored in the European Union (Frankfurt). Because these providers are US companies, some data may be accessed from or transferred to the USA. Such transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and by the European Commission’s Standard Contractual Clauses in their data processing terms.

Other players see only your display name, your records on the leaderboards, and — if you become friends — your friend activity. We may disclose data to authorities only where the law requires it.

5. How long we keep it

• Your account and game data: for as long as your account exists. You can delete it at any time (see section 7); everything is then deleted from our database at once — except the records of paid orders below.
• Paid orders: 10 years from the end of the year of the payment, as the accounting law requires. When you delete your account, they are kept without any link to you (only the product, price, platform, payment ID and dates remain).
• Complaints and suggestions (with an attached save): while your account exists, and 2 years at most after we close them.
• Letters from our team: while your account exists; once you have opened one, 365 days at most.
• Gift codes you have entered: while your account exists.
• Orders that were never paid: 90 days. Ad views: 90 days.
• Sessions: they end 180 days after you last used them.
• One-time login codes: 10 minutes.
• Database backups kept by our provider for recovery may hold deleted data for a short time (up to 30 days) before it disappears from them too.
• Server logs: a short period under our hosting providers’ policies.

6. Children

In Slovakia, where the game is run from, a person can consent to online services on their own from the age of 16. When the game starts for the first time, it asks your age. If you are younger than 16, a parent or guardian must agree to these terms before you play, and must allow every purchase. If we learn that a child under 16 plays without that agreement, we will delete the account. Parents and guardians can contact us at any time to see or delete their child’s data.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it, and data portability — in the game, open Profile → Privacy & data → Download my data (in Telegram, the bot sends you the file); it includes your orders and ad views;
• erasure — Profile → Privacy & data → Delete account deletes your account and all its data immediately;
• rectification — change your name and language in the profile, or write to us;
• restriction of processing and to object to processing based on legitimate interests;
• withdraw consent at any time (e.g. /notify off in the bot), without affecting what was done before;
• lodge a complaint with a supervisory authority — in Slovakia the Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk , or the authority of the EU country where you live.

For anything you cannot do in the game, write to kolya.reznichuk@gmail.com or @reznichuk in Telegram. We answer within one month. We may ask you to prove that the account is yours (for example, by writing from the linked Telegram account or by showing a login code from the game).

8. Security

All traffic is encrypted (HTTPS). Passwords, session tokens and login codes are stored only as hashes. Access to the servers and the database is limited to the controller.

9. Changes to this policy

When this policy changes, we update the date at the top. If the change matters, the game asks you to confirm again the next time you open it.

See also the Terms of Use.