Privacy Policy

• Account (email sign-up): your email address, your nickname and a hash of your password (never the password itself).
• Account (iDos Games sign-in): your iDos Games user id and the game’s iDos Title id, used to match you to your SPOILS account. We do not receive your iDos password. You can later add an email and password to the same account.
• Guest play: a random session id and a nickname, kept in a session cookie. No email is asked for. Raids you play as a guest are stored under that random id and move into your account if you sign up.
• Gameplay: your raids, kills, deaths and extractions, XP and level, items in your stash and gear, CR (in-game credits), quest and Alpha Pass progress, unlocked cosmetics, and market listings and trades. Every change to items and currencies is written to a journal so we can return lost items and detect cheating.
• Map replays: each map is recorded for the team’s review: player positions, shots, hits and kills, together with each player’s nickname and account id. Replays are visible only to our admins.
• Social features: your friends list and friend requests, parties and party invites, and the time you were last active in the menu (used to show friends who is online).
• Things you send us: bug reports and answers to the in-game alpha survey.
• Optional social tasks (accounts linked to iDos Games): if you complete an X (Twitter) task, the link to your post and the post’s author handle; if you complete a Telegram task, your Telegram user id.
• Technical data: your IP address is used in memory to rate-limit sign-up and sign-in attempts and is not stored in our database. Our web server keeps standard request logs (IP address, time, requested page, browser user agent) for security and troubleshooting.

Your nickname, level, cosmetics and leaderboard results are public to other players. We do not collect your real name, phone number, contacts, precise location, or payment card details.

• Linking a wallet is optional. You prove ownership by signing a Sign-In with Solana message; we store only the wallet’s public address. We never see or store your private keys or seed phrase, and linking moves no funds.
• Seeker perk: if you link a wallet, we read from Solana mainnet whether it holds a Seeker Genesis Token or SKR, and keep the result (the token address and the amount) to grant the free Seeker cosmetic.
• On-chain items and market: when you move an item to your wallet, list it on the SOL market, buy one, or pay for a starter kit from your wallet, you sign a Solana transaction in your own wallet app. We keep the transaction signature and the item it concerns. The game also records some match events on chain as hashes of internal ids.
• Blockchain transactions and wallet addresses are public and permanent. Anyone can see them, and neither we nor anyone else can delete them.

• One session cookie keeps you signed in (or keeps your guest session). It is HTTP-only, encrypted and expires after 7 days. On iDos Games, where browsers block such cookies, the same encrypted session is sent as a token instead.
• Local storage on your device remembers your settings (sound, vibration, reduced motion, HUD layout) and small flags such as whether you have finished the tutorial or seen the latest news. It never leaves your device.
• Two first-party cookies help us count players, only on our own site: a random visitor id (no name, email or IP behind it; 1 year) that tells us how many visitors open the site and press Play, and a platform note (web, Android app or Seeker; 1 year). We count which days you play and on which platform, nothing about what you do elsewhere.
• We use no advertising cookies and no third-party tracking or analytics.

• To run the game: sign you in, save your progress, items and stats, match you to the live map, and show leaderboards.
• To run social features, the market, quests, Alpha Pass rewards and the Seeker perk.
• To keep the game fair and secure: detect cheating, multi-accounting and abuse, and investigate bugs (including with replays).
• To answer your bug reports and requests, and to improve the game from survey answers.

We do not use your data for advertising or profiling, and we do not sell or rent it to anyone.

Some features depend on outside services. They receive only what the feature needs, under their own privacy policies:

• Solana RPC providers receive your wallet address when we check Seeker / SKR holdings or process on-chain transactions.
• Your wallet app (for example Phantom, Solflare or Seed Vault) handles every signature; we never see your keys.
• iDos Games runs its own sign-in and the SPOILS token rewards. If you play through iDos Games or link your account to it, we exchange your iDos user id, session check and reward records with iDos Games.
• X (Twitter) — we look up a post you submit for a social task through X’s public embed service. Telegram — our bot checks whether your Telegram account joined our channel.
• YouTube — the landing page shows the trailer’s preview image from YouTube; the player itself (youtube-nocookie.com) loads only when you press play.

Fonts are served from our own server. We may disclose data if required by law or to protect players and the service.

• Account, gameplay and social data: as long as your account exists.
• Map replays: deleted automatically after 90 days.
• Session cookie: 7 days. Visitor and platform cookies: 1 year. Wallet sign-in challenges and account link codes: minutes, then removed.
• Web server logs: a limited period for security and troubleshooting.
• Blockchain records: permanent, outside our control.

SPOILS is in alpha: at the end of the alpha, items, CR and the test balance are wiped once (see the alpha rules); your account, level and cosmetics stay.

• You can play as a guest without giving an email, and wallet linking and social tasks are optional.
• To get a copy of your data, correct it, or delete your account, email support@spoils.gg from the email on your account (or tell us your nickname and how you sign in). We will verify that the account is yours and answer within 30 days.
• On deletion we remove or anonymize your account and the data linked to it. We may keep records we need to prevent fraud or resolve disputes, and we cannot remove anything already on a blockchain.

Depending on where you live, you may have further rights under local law; contact us to use them.

SPOILS is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has given us data, email support@spoils.gg and we will delete it.

We will update this policy when the game starts collecting something new or uses data differently. The effective date at the top shows the latest version; important changes are also announced in the patch notes.

SPOILS is the operator of the game. Questions or requests about your data: support@spoils.gg.