Privacy Policy

Last updated: October 8, 2026

Short version: you can play Kingdom Clobber without giving us your real name, email, phone number or birthday. We keep a random player ID, the display name you pick and your game progress. There is no chat between players. Website payments are handled by Stripeour payment processor and iPhone app purchases by Apple, so we never see your card. We don’t show ads, we don’t use advertising trackers, and we never sell your information. You can delete your account any time in Settings → Delete account.

Who we are

Kingdom Clobber (“we”, “us”) runs the browser game at kingdomclobber.io and its iPhone app (when available). For any privacy question or request, email kingdomclobbersupport@gmail.com.

Children and families

Kingdom Clobber is not directed at children under 13, and our Terms require players to be 13 or older. We do not ask for your age or birth date, and we do not knowingly collect personal information from children under 13. If we learn that we have, we delete it.

Parents and guardians: if you believe your child under 13 has used Kingdom Clobber or given us any information, email kingdomclobbersupport@gmail.com (include the Player ID shown in the game under Settings if you can) and we will delete your child’s data. You can also delete the account directly in the game under Settings → Delete account.

To keep the game safe for everyone: players cannot send each other messages, photos or links. The only thing other players see is your chosen display name and game results. Names are filtered for offensive words, and any player can report or block a name.

What we never collect

Your real name, email address, phone number, home address or birth date (unless you choose to email us).
Precise location, contacts, photos, camera or microphone.
Card numbers or bank details (Apple handles paymentsStripe and Apple handle payments).
Advertising IDs. We have no ads and no ad trackers.

What we store

A random player ID and a secret token. Created automatically the first time you play (a “guest account”, no sign-up) and saved on your device. Our server keeps only a one-way hash of the token, never the token itself. Your backup code is made from these two, so treat it like a password.
Your display name, the name you choose. It is public: it appears on the leaderboards and to other players in rooms you join. Offensive names are replaced automatically. Please don’t use your real full name.
Game data: match results and scores (place, kills, smashes, kingdoms toppled, match length, mode, difficulty), XP and level, quests, achievements, daily rewards and login streaks, cosmetics, store items, and your progress in limited-time events such as Zombie Night.
Gem and purchase history: a record of gems earned, spent and bought, so your balance is correct and every purchase is delivered once.
Invite links: if you share your invite link (?ref=) we store your random invite code and which new accounts joined through it, to give both players their bonus.
Reports and blocks: see “Reporting and blocking” below.
Push reminders (only if you turn them on): see “Push reminders” below.
Store test events: simple events such as “store opened” or “pack viewed”, linked only to your random player ID, to help us make the store clearer.
A hashed IP address. When an account is created we store a one-way hash of the IP address to limit how many accounts one network can create. Failed backup-code restore attempts are logged the same way and deleted after 24 hours. We never store your IP address in readable form in our database.

Information sent automatically

Like every website, your device sends your IP address and basic browser details when it connects. Cloudflare, our host, uses them to deliver the game, block attacks and apply rate limits. Cloudflare keeps short-lived technical logs for our servers (we keep them for about 3 days) and may provide cookieless visit statistics (Cloudflare Web Analytics). We deliberately keep card details, emails, player tokens and push tokens out of our logs.

On your device (local storage and cookies)

The game saves your settings, progress, block list and player token in your browser’s local storage (or the iPhone app’s storage) so you stay signed in and keep your progress. A small background script (a “service worker”) is used only to show push reminders you asked for. We do not use advertising cookies or third-party tracking cookies. Stripe’s checkout page (on stripe.com) may use its own cookies for payment security under Stripe’s policy. Clearing your browser data removes the local copy but does not delete your account on our server; use Settings → Delete account for that.

Multiplayer

Online rooms and quick match run on our servers. Other players in the room see your display name, seat and in-game actions. Room data is temporary.
Playing with friends may connect players directly (peer to peer) with help from the PeerJS connection service and public STUN servers. As with any direct connection, the other players and these services can see your IP address while you play together.
There is no text or voice chat. Computer-controlled bots show pre-written jokes (you can turn this off with Bot chatter in Settings).

Leaderboards

Leaderboards show your display name, level, wins, best score, crowns, a Founder badge if you have one, and your random player ID (used for reporting and blocking). They never show emails, payment details or any contact information. Deleting your account removes you from the leaderboards.

Reporting and blocking

You can report or block another player’s name from the leaderboard. A report stores your player ID, the reported player’s ID, the name at that moment, the reason and where you saw it. Reports are reviewed within 24 hours; a name reported by 3 different players is replaced automatically with a neutral name, and we may replace names or ban accounts that break our rules. Your block list is saved on your device and with your account; you can unblock players in Settings → Blocked players. Questions about a report: kingdomclobbersupport@gmail.com.

Payments

Website (Stripe). Gem purchases on the website are processed by Stripe on Stripe’s secure checkout page. The game never sees or stores your card details. Stripe tells us whether a payment succeeded, which pack was bought, the amount and a payment reference. Stripe collects the billing country and postal code needed to calculate sales tax (Stripe Tax) and may collect an email address for your receipt; it keeps its own records under its privacy policy, and we can see them in our Stripe account for receipts, refunds, tax and fraud prevention.

iPhone app (Apple). Purchases in the iPhone app are processed by Apple under Apple’s privacy policy. We receive the transaction ID, product, date, price and currency, never your payment details or Apple ID.

Payment records are kept as long as tax and accounting laws require. If you delete your account, they are kept with your player ID replaced by an anonymous value.

Push reminders

Daily streak reminders are off unless you turn them on. If you do, we store a push token for your device: a Web Push subscription delivered through your browser maker’s push service (such as Google, Mozilla, Apple or Microsoft), or an Apple Push Notification service (APNs) token in the iPhone app. Reminders are only about your streak; we do not send ads. Turn them off any time in Settings or your device settings; the token is deleted when you turn reminders off or delete your account.

Game Center

If the iPhone app offers Game Center, it is optional and provided by Apple; we do not store your Game Center ID.

How we use information

To run the game, save your progress and show leaderboards and events.
To deliver purchases, keep balances correct and handle refunds and chargebacks.
To keep the game safe and fair: prevent cheating, spam, abuse and fraud, and moderate names.
To send streak reminders you asked for.
To answer support requests and improve the game and store.

Where the GDPR or UK GDPR applies, our legal bases are: performing our agreement with you (running the game and delivering purchases), our legitimate interests (security, abuse prevention, moderation, improving the game), your consent (push reminders), and legal obligations (tax and accounting records).

Who we share it with

We do not sell your personal information and do not share it for advertising. We only use these service providers to run the game:

Cloudflare: hosting, servers, database, security and logs.
Stripe: website payments and sales tax.
Our website payment processor: payments made on our website.
Apple: iPhone app purchases and push notifications.
Browser push services (Google, Mozilla, Apple, Microsoft): delivering reminders you turned on.
PeerJS / STUN servers: connecting friends’ games.

We may also disclose information if the law requires it, or to protect the safety of players or the public.

How long we keep it

Account and game data: until you delete your account (we keep it while you play so your progress isn’t lost).
Failed restore attempts (hashed): 24 hours. Server logs: about 3 days.
Store test events: only while we analyse them.
Payment records: as long as tax and accounting laws require (anonymized if you delete your account).
Reports about a deleted account are kept without the name or a link to the account.

Deleting your account

In the game or the iPhone app: Settings → Delete account, then type DELETE. Deletion is immediate and permanent: it removes your name, scores, leaderboard entries, progress, gems, purchases, streaks, push tokens and reports you made from our server. Deleting does not refund purchases. You can also email kingdomclobbersupport@gmail.com with your Player ID.

Your rights

Wherever you live, you can ask us to access, correct, export or delete your data. Under the GDPR and UK GDPR you can also object to or restrict processing, withdraw consent, and complain to your local data protection authority. Under the CCPA/CPRA (California) and other US state privacy laws you have the right to know, access, correct and delete your personal information, and we will not treat you differently for using these rights. We do not sell or “share” personal information or use it for targeted advertising as those laws define it, so there is nothing to opt out of; we also respect Global Privacy Control signals. If we decline a request, you can reply to appeal and we will review it again.

To make a request, email kingdomclobbersupport@gmail.com and include your Player ID (shown in the game under Settings). We may ask you to show the account is yours. Never send us your backup code. We aim to answer within 30 days.

Security

All traffic uses HTTPS, tokens are stored hashed, admin tools require a secret key, and payments never touch our servers. No system is perfectly secure; if a security incident affects your information, we will notify you and the authorities as the law requires.

International transfers

We are based in the United States and our providers operate worldwide, so your data may be processed outside your country, including in the United States, with the safeguards those providers offer (such as standard contractual clauses).

Changes

If we change this policy we will update the date at the top. For important changes we will also tell you in the game.