Gembound Arena
Privacy Policy
Effective 13 August 2026
The short version. You can play the whole game as a guest with no account, no cookies and nothing stored on our servers. If you sign in, we hold your Google or email identity, your gamertag and your game progress — and you can download all of it or delete your account yourself, from the Account panel in the game, at any time.
1. Who is responsible for your data
Gembound Arena is operated by an independent developer based in California, United States ("we", "us"). We are the data controller for the information described here. Questions, requests and complaints: [email protected].
2. Playing as a guest
You do not need an account to play. When you play as a guest:
- we set no cookies at all;
- we create no account record and store nothing about you on our servers;
- your browser keeps a random device identifier in its own local storage so that the temporary name the server hands you stays the same when you refresh the page. It is generated on your device, it is not an account, and clearing your browser storage erases it.
Because guest play uses no cookies and no tracking of any kind, this site shows no cookie banner. There is nothing to consent to.
3. What we hold when you have an account
Signing in creates an account record. Everything below is held against it:
| Category | What it is | Why we hold it |
|---|---|---|
| Identity | Your email address, display name and profile picture as supplied by Google when you sign in with Google; your email address alone when you sign in with an emailed link. Plus the gamertag you choose. | To create and recognise your account, and to name you to other players. |
| Game records | Currency balances and their full transaction history, heroes and cosmetics you own or have equipped, heroes you have encountered, Battle Pass progress and claims, ranked ratings and per-hero statistics, match history, friendships, and daily-login streaks. | They are your progress. Without them the game has nothing to show you. |
| Purchase records | For each real-money purchase: the amount charged, the bundle bought, the Crystals delivered, the payment provider's transaction id and the purchase status. We never see or store your card details. | Delivering what you paid for, and handling refunds, disputes and our tax records. |
| Sign-in sessions | One row per active sign-in, holding a session token, its expiry, and the IP address and browser user-agent the session was created from. | Keeping you signed in, and letting us end a session or investigate account abuse. |
| Moderation | Whether your account is suspended and why, whether it is blocked from purchases, and any players you have blocked. | Enforcing the Terms of Service and keeping the game usable for everyone. |
| Support and feedback | Anything you write to us, and any feedback you send from inside the game. | Answering you and fixing what you reported. |
About the download. The "Download my data" button in the Account panel returns your identity, game records and purchase records as a JSON file. It deliberately does not include your sign-in session rows (they are listed above under "Sign-in sessions"), and it never includes credentials such as session tokens or OAuth tokens — an export file is the last place a live token should end up. So the download is a very large part of what we hold, but it is not a complete inventory; this section is.
4. Cookies and local storage
We use two cookies, both strictly necessary, and both only when you sign in:
- a session cookie that keeps you signed in. It is HttpOnly, so page scripts cannot read it, and it expires or is deleted when you sign out;
- a short-lived sign-in state cookie set while a Google sign-in is in flight, to verify that the response coming back is the one we asked for. It is discarded immediately afterwards.
We use no advertising cookies, no analytics cookies and no third-party cookies. Separately, your browser's own local storage holds your preferences (volume, reduce-motion, last hero picked), your guest device identifier, and a session token as a fallback for browsers that block cookies. That storage never leaves your device except as part of talking to our own server.
5. Who else sees your data
We use exactly three external processors, and no others:
- Xsolla — our payment provider, acting as the merchant of record for every real-money purchase. Xsolla takes and holds your payment details; we never receive them. Xsolla returns to us only the transaction outcome described above.
- Resend — delivers the one-time sign-in links we email you. Resend handles your email address for that delivery.
- Google — verifies your identity when you choose "Sign in with Google", and returns your email address, name and profile picture to us.
We do not use any third-party analytics or error-reporting service. Crash reports and usage statistics are collected by our own server: crash reports are stored without any user identifier, and usage events carry only a random visit id that is held in memory for the length of one visit, is never written to your device, and cannot be joined back to an account. There is no advertising network, no data broker, no cross-site tracking and no sale of personal data.
Our processors operate internationally, so data they handle on our behalf may be processed outside your own country under their standard contractual protections.
6. Other players
Your gamertag, your rank and the heroes you play are visible to the people you play with, on leaderboards, and to your friends. Your email address is never shown to another player.
7. How long we keep it
- While your account exists — we keep your identity, game records and moderation state, because they are what your account is.
- When you delete your account — your account row and your game progress are erased, and every sign-in session is destroyed immediately. Match history and feedback survive with your account detached from them, so other players' completed matches stay intact.
- Real-money purchase records are kept. Records of real-money purchases are kept, without your name attached, because we are required to keep them. Deletion strips the payer information out of them; it does not erase the fact that a charge happened, what it was for, and what was delivered. The legal basis is our legal obligation to keep financial records (GDPR Art. 17(3)(b)), and a refund or a payment dispute can still arrive after the account is gone.
- Crash reports and usage statistics hold no identifier for you, so they are not affected by deletion and are kept in aggregate.
8. Your rights and your controls
Two of them are self-serve — open the game, open the Account panel, and use:
- Download my data — everything described in section 3 (with the stated exception), as a JSON file, immediately;
- Delete my account — permanent, irreversible, and effective at once. You cannot delete while you are in a match or in a queue, because that would break the match for everyone else in it.
Depending on where you live you may also have the right to correct your data, to object to or restrict how we use it, to receive it in a portable form (that is the download), and to complain to your local data protection authority. To exercise anything not covered by the two buttons above, write to [email protected]. We will answer within one month.
We rely on the following bases: performance of a contract for running your account and delivering purchases, legal obligation for keeping financial records, and our legitimate interests in keeping the game secure, moderated and working.
9. Children
Gembound Arena is a general-audience game. Accounts are for players aged 13 or over, and anyone can play as a guest with no account and nothing stored. We do not ask for your date of birth, and we do not collect one — not at sign-in, not afterwards, and not at checkout. Real-money purchases are open to every account holder; if you are under 18 you need your parent or guardian's permission, which is a rule in the Terms of Service rather than something we ask you to declare to us.
If you believe a child under 13 has an account, write to [email protected] and we will delete the account and everything it holds. That is our response whether the report comes from a parent, from the player, or from anyone else who tells us.
We hold no age information about anyone. Until 12 August 2026 the game asked once for a year of birth and stored only the resulting bracket — never the year. That prompt was retired, and on 13 August 2026 the brackets themselves were deleted from the database along with the columns that held them. There is nothing left to ask us about, nothing to correct, and nothing an account can carry: section 3 is the complete inventory and no row in it is about your age.
10. Changes
We may update this policy. The effective date at the top always tells you which version is current, and material changes will be announced in the game.
11. Contact
The operator of Gembound Arena (independent developer, California, United States) — [email protected].