TapTale Privacy Policy
Effective date: 31 October 2026
1. Who we are
TapTale is a mobile game published by Gaurav Lamsal, an individual, of 1512 S Beltline Rd, Dallas, TX 75253, United States ("we", "us"). We are responsible for the personal data described here. Contact for privacy questions and requests: support@crowncodex.online.
2. What we collect and why
You do not need to give us your name or e-mail to play. The game creates an account when it first starts.
| What | When | Why we use it |
|---|---|---|
| Player ID and an install ID. A random ID the game creates on your device to sign you in as a guest, and the Player ID of your account | Always | To run your account and save your progress |
| Sign-in ID (Sign in with Google or Sign in with Apple, on Android and iPhone) | Only if you choose one on the title screen or link one in Settings → Account | To sign you in and let you recover your account on another device. We receive an ID from that service, not your password. Google also sends your name, e-mail address and profile picture with the sign-in, and Apple may send an e-mail address (or a private relay address) the first time; our server keeps only the ID and does not store the name, e-mail address or picture |
| World (server) | When you pick a world | Each world (S1, and later others) has its own account and character, rankings, guilds and chat; your account on one world is separate from your account on another |
| Terms acceptance | When you tick the box on the title screen | Which version of the Terms of Service and Privacy Policy you accepted, and when, for each world |
| Display name and guild name | Only if you set them | Shown to other players in the arena, guilds and leaderboards |
| Guild chat messages | When you send them | Shown to the members of your guild; stored so the chat history can be shown |
| World chat messages (public chat) | When you send them | Shown to every player who has World chat on; we keep the last 100 messages of the channel |
| Friends and private messages | When you add a friend or send a message | Your friend list and friend requests are shown to you and to those players; a private message is shown only to the friend it is sent to and to you; we keep the last 50 messages of each pair of friends. Messages can only be sent between players who are both friends |
| Photos you upload (a profile picture or a photo post; only if you told us you are 18 or older) | When you upload one | Before anyone else sees it, the photo is re-encoded on our server: every embedded data block (camera details, date, GPS location, editing software) is removed and it is resized (at most 1080 pixels; a profile picture 512). It is then checked automatically for nudity, violence, hate symbols and self-harm by our moderation provider (Sightengine) and against known child sexual abuse material; it is shown only when it passes. Players can report it; a report hides it again until a moderator decides. Stored with our storage provider (Cloudflare R2) until you delete it, replace your profile picture, or delete your account |
| Posts, likes and comments | When you post, like or comment | Posts (your photos, and picture cards of your game: a pulled hero, a victory, your team, a Spire floor, a scene) are shown on your profile; your likes and comments are shown with the post (comments with your display name). Comments are 1–200 characters; links are removed and a word filter applies. You can delete your posts and your comments, delete comments on your posts, and choose who may comment (everyone, friends, nobody; friends only by default for players who have not told us they are 18 or older). The post's owner is told who liked or commented |
| "Online recently" time | When you use chat | Your friends see a dot when you used the game's chat in the last 10 minutes |
| Age range (Under 13, 13–15, 16–17, 18 or older, or "Prefer not to say") | When you answer the age question | To apply the rules for your age: players under 13 cannot play (see §7); no purchases, no gem summons, no gem offers, no personalised ads and no experiments for anyone under 18 or who prefers not to say |
| Country (from your device's language setting and from your IP address at our network edge) | When you use the game | To apply regional rules (for example, gem summons are off in Belgium and Brazil). We keep the country hint from your device setting; we do not store your IP address in the game database |
| Game data: heroes, items, currencies, progress, missions, mail, purchases and rewards history, summon history, arena, Spire and raid results, when you last played | While you play | To run the game, keep it fair (battles are decided on our server), and support you |
| Purchase records: product, store order and transaction IDs, time, and refunds | When you buy something (players 18 and older only) | To give you what you bought exactly once, and to handle refunds and fraud. Payment details are handled by Google Play (or Apple); we never see your card |
| Gameplay statistics: when you first reached each tutorial step, your first summon and first idle-chest collection, and how many rewards you claimed | While you play | To improve the first minutes of the game |
| Server logs: IP address, Player ID, time and request | Each request | Security, abuse prevention (rate limits) and fixing errors. Kept for 30 days |
| Crash and error reports (only in builds with crash reporting switched on) | When the game crashes or a script error happens | To find and fix bugs. Sent to our crash-reporting provider (Sentry, Functional Software Inc.): the error and where in the code it happened, the app version, the device model, operating system version and language, and a random installation ID. No Player ID, no name or e-mail and no IP address is stored with them (IP storage is switched off). Kept for 90 days |
| Support messages | If you e-mail us | To answer you, including account deletion requests |
Advertising
The game has optional rewarded video ads. When you choose to watch one, Google AdMob (Google LLC / Google Ireland Ltd.) serves it and may collect your device's advertising ID, IP address (approximate location), device information and ad interactions, and use them under Google's own privacy policy (https://policies.google.com/privacy). We tell Google your Player ID only so that the reward can be verified, and which reward you chose.
- Ads are personalised only if you said you are 18 or older and gave consent where consent is required (EEA, UK and Switzerland: through Google's consent message; in US states with an opt-out right, through the same Privacy choices option where Google offers it). Everyone else gets non-personalised ads.
- Players who say they are under 13 cannot play, so they are never shown ads. Ad requests for players who said they are under 18, or preferred not to say, are tagged as under the age of consent.
- You can change your ad consent at any time in Settings → Privacy & safety → Privacy choices: it opens Google's consent options where they apply to you (for example in the EEA, UK and Switzerland), or says that none are needed on your device. A change applies from the next ad. You can reset your advertising ID in your device settings.
Where a US state law treats personalised advertising as "sharing" or a "sale" of personal data, you can opt out through Privacy choices or by writing to support@crowncodex.online; non-personalised ads are then shown.
3. Legal bases (EEA / UK)
Running your account, game and purchases: contract. Security, fraud prevention, abuse limits, purchase records, server logs and gameplay statistics: legitimate interests. Age-based and regional rules: legal obligation and legitimate interests. Personalised ads: consent.
4. Who we share data with
- Other players see your display name, guild name, guild chat messages, World chat messages, team and ranks, your profile picture and your posts (photos only once they passed the check), and your likes and comments on posts; your friends also see the private messages you send them and whether you were online recently. Players you block no longer see your messages, profile or posts (and you no longer see theirs), and a block ends any friendship between you.
- Photo moderation and storage providers: the photo you upload (re-encoded, without its embedded data) is sent to our automatic moderation provider (Sightengine) and checked against known child sexual abuse material; photos are stored with Cloudflare R2. Where the law requires it, a photo that matches known child sexual abuse material is kept apart (never shown) and reported to the authorities (in the US, the NCMEC CyberTipline).
- Service providers who process data for us under contract: our server hosting (Microsoft Azure, West US 2 region, United States), Cloudflare (network edge, the sign-in callback for Sign in with Apple on Android, the ad-reward verification service, photo storage and these web pages) and, in builds that have it, our crash-reporting provider (Sentry, United States).
- Google for purchases (Google Play), sign-in (Sign in with Google, if you use it) and ads (AdMob), as described above.
- Apple for sign-in (Sign in with Apple, if you use it) and, on iPhone, purchases (the App Store).
- Authorities when the law requires it.
We do not sell your personal data for money.
International transfers: our servers are in the United States (Microsoft Azure, West US 2; Cloudflare for the network edge and R2 storage). For players in the EEA, the UK and Switzerland, transfers rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's standard contractual clauses.
5. How long we keep data
- Your account and game data: until you delete your account. Inactive accounts are kept, so you can come back to them.
- Chat: World chat keeps only the last 100 messages of the channel and private messages only the last 50 of each pair of friends; older ones are deleted as new ones arrive. Guild chat history is kept while the guild exists. All of your messages are deleted when you delete your account (below).
- After deletion, we keep only:
- a record of each purchase (product, order and transaction IDs and the Player ID it was credited to) so that it is never credited twice and refunds, chargebacks and tax records can be handled, for as long as the law requires us to keep transaction records;
- a record of each rewarded ad (Player ID, ad network transaction ID, reward) for the same reason and for the same period;
- a one-way fingerprint of a linked sign-in that received the one-time link bonus (it contains no Player ID);
- your raid damage in your guild's current weekly raid until that week ends;
- reports you filed about other players' messages or names, with your Player ID removed; reports other players filed about you are kept as moderation records for up to 1 year.
Deletion also removes your guild chat messages and your guild join / leave notices, your World chat messages, your friend list and friend requests (also from the other players' lists) and the private messages between you and your friends, your posts and every photo you uploaded (deleted from our storage within minutes), your profile picture, your comments on other players' posts and your likes. A photo that matched known child sexual abuse material is kept apart for the period the law requires.
- Photos while your account exists: until you delete the post or replace your profile picture (then deleted from our storage within minutes). A photo that failed the check is not stored; one waiting for a moderator is kept until the decision.
- Backups of our database are kept for 14 days, so deleted data leaves them within 14 days.
- Server logs: 30 days.
- Crash and error reports: 90 days.
6. Your choices and rights
- Delete your account at any time: Settings → Account → Delete account (immediate; it deletes your account on the world you are playing; repeat it on each world you played), or without the app at https://play.crowncodex.online/delete (we delete your accounts on every world). We answer web requests within 30 days.
- See your Player ID in Settings → Account.
- Change your display name in the game; leave a guild at any time.
- Chat controls (Settings → Privacy & safety): turn World chat and friend messages on or off, and choose who can comment on your posts (everyone, friends or no one). For players who have not told us they are 18 or older both start off. Report any message or player; block a player.
- A copy of your chat and friends data (your messages, friends, requests and blocks) and your posts and comments (your posts with their captions and counts, the comments you wrote, your profile picture setting, and links to download your shown photos and your profile picture; links expire after about an hour): ask us at the support address and we send it to you.
- Posts and photos: delete a post (its photo and comments go with it), delete your comments, turn comments on your posts to everyone, friends only or off (Profile → Edit Profile). Photo uploads are only for players who told us they are 18 or older.
- Ad consent: see §2.
- Depending on where you live (for example the EEA, UK, California, Texas and other US states), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict some uses, to opt out of targeted advertising, and to complain to a data protection authority. Write to support@crowncodex.online with your Player ID. To protect your account, we may ask for details only the account holder has (for example a recent in-game event or purchase) before we act on it. We will not treat you differently for using these rights.
- Appeals: if we decline a request, you can appeal by replying to our answer with the word "Appeal". We answer an appeal within 60 days and tell you the result and the reasons. If you live in a US state that gives you this right and you disagree with the result, you can contact your state's Attorney General.
7. Children
TapTale is made for players 16 and older and is not directed at children. Children under 13 may not play. The game asks every player's age range before any purchase, ad or chat. If a player says they are under 13, the game shows a screen saying it is not available and does not let them continue; the answer cannot be changed in the app afterwards.
When a player answers "Under 13", we erase that game account's data at once and keep only a minimal record so that the block holds for that account on that device:
- Kept: the age answer ("under 13"), when it was first and last given, and how many times the answer was changed. No country or region is kept with it.
- Erased at once: guild membership (and the player's guild chat messages and join / leave notices), World chat messages, friends, friend requests and private messages, posts, comments, likes and any uploaded photo (from our storage), leaderboard entries (arena, Spire, guild raid), all other game data we store for the account (progress and heroes, missions, mail, arena record, blocked players, account flags, experiment groups) and its gameplay statistics; the player's ID is removed from any report they filed. The in-game wallet is set to zero and the display name is cleared.
- Still held by our game server until the account is deleted: the account itself (a random username, no display name), its device identifier and any sign-in linked before the answer, and the records of in-game currency changes made before the answer. Server logs are kept as for any request (§5).
From then on the game requests no ads, offers no purchases and refuses chat, names and every other game request for that account. A parent or guardian can have the account deleted completely through support (support@crowncodex.online or https://play.crowncodex.online/delete); deletion inside the app is not available on the block screen. The block screen shows the account's Player ID with a button to copy it: include it in the request so that we delete the right account. If you believe a child under 13 has given us personal data in any other way, contact support@crowncodex.online and we will delete it.
Players aged 13 to 17, and players who prefer not to say, can play but cannot make any purchase, cannot summon with gems or see gem offers, and receive only non-personalised ads.
8. Security
Data travels encrypted (HTTPS). The game server is not reachable directly from the internet except through our edge; the database is not exposed. Access to the servers is limited to us. No method is perfectly secure.
9. Changes
We will post changes here with a new effective date, and tell you in the game when a change is significant (the title screen asks you to accept the new version).
10. Contact
support@crowncodex.online · https://play.crowncodex.online/support · Gaurav Lamsal, 1512 S Beltline Rd, Dallas, TX 75253, United States.