The short version
- The web and Discord game have no advertising, no analytics and no tracking. The Android app offers optional reward videos from Google AdMob: you see one only when you choose to watch it for gems or time off a chest, and Google collects some device data to show it — see Reward videos in the Android app. Nothing else about you is sent to any third party.
- The game takes no payments. There is no payment processor and no card or billing data anywhere in it. Gold and gems are in-game numbers only.
- You sign in with Google or Discord, or with an email address and password. From Google or Discord we receive your account id, display name and email address, and nothing else.
- You can delete your account yourself, at any time, in the game or on this website — see Delete your account.
- Your display name, portrait, account level and trophy count are public on the leaderboard. Your email address is never shown to anyone.
Who runs this
Vanguard Realm is a game made and run independently by one person. It is not a company. Where this policy says “we”, that is who it means.
Contact: our Discord server for anything about the game, or support@vanguardrealm.com for privacy requests, data access and account deletion.
What we collect, and why
You cannot play online without an account, because the game has to know whose trophies and cards are whose. Everything below is stored on our own server.
From signing in
We ask Google for the scopes openid profile email and Discord for
identify email. Inside the Discord Activity, the same Discord grant is requested
as ["identify", "email"]. From that we keep:
| What | Why it is needed |
|---|---|
The provider (google or discord) and your account id at that provider | To recognise you as the same player next time. This is the only thing that identifies your account. |
| Your display name | Shown on your nameplate in matches, on the leaderboard, and in the match history of anyone you have played. You can change it in the game. |
| Your email address, and whether the provider says it is verified | Used only to enforce one account per address. It is never displayed, never used for marketing, and never emailed to — there is no mail system in this project at all. |
| If you make an account with an email address instead: that address, and a PBKDF2 record of your password | To let you sign in. The password itself is never stored, and the record cannot be turned back into it. |
We do not receive or store your password, your contacts, your friends list, your servers, or anything else from Google or Discord.
From playing
- When your account was created and when it was last seen.
- Your trophies, account level, experience, gold and gems.
- Which cards, portraits and tower skins you own and their levels, and the deck you have saved.
- Your chests: which you hold and when each finishes unlocking.
- A record of each in-game purchase — what kind it was and how much in-game currency moved.
- For each match: when it started and ended, who played, the crowns, the result, and the match’s random seed together with the list of card plays. Those few hundred bytes are enough to replay the match exactly, which is how a bug report or a disputed result gets investigated.
- Also for each match, for both sides: the deck that was dealt and the level of each card in it, the account level and trophies when the match began, and what the match changed — the trophies it moved and the gold it paid. This is what your match history shows you.
Technical data
Our web server keeps ordinary request logs, which include IP addresses, for security and for diagnosing faults. Your IP address is also used briefly, in memory, for rate limiting so that one client cannot make the game unusable for everybody else. It is not linked to your account in the database.
Reward videos in the Android app
The Android app, and only the Android app, offers short videos you can choose to watch for a reward: a few gems, or time off a chest that is unlocking, a few times a day. A video is never shown during a match, never shown unless you tap to watch it, and never needed to play.
The videos come from Google AdMob. To show one, Google’s Mobile Ads SDK in the app collects information from your device, including your IP address, your device’s advertising ID and how you interact with the video. The app loads a video in the background once you reach the lobby, so that one is ready when you choose to watch it, and loading one sends Google the same kind of information. Google describes what it collects in its data disclosure for the Mobile Ads SDK, and how it uses it in How Google uses information from sites or apps that use its services.
If you are in the European Economic Area, the UK or Switzerland, Google’s consent form asks for your choice before any video is requested, and you can change it at any time with AD PRIVACY CHOICES, under the free gems offer in the shop’s SPECIAL tab. On any Android device you can also reset your advertising ID, or turn off ad personalisation, in the device’s own settings.
From Google we receive only a signed confirmation that a video was watched to the end. It carries a random reference number our server made up for that one video, which of our video slots it came from, and Google’s id for the reward — nothing that identifies you or your device. We keep, with your account, which videos you started, what each was for, when it was watched and what it paid: that is how the daily limit is counted. It is deleted with your account.
Cookies and browser storage
One cookie. When you begin a sign-in we set a single cookie, scoped to
/auth, marked HttpOnly, Secure and
SameSite=Lax, which expires when that sign-in attempt does. It exists so that the
sign-in can only be completed by the browser that started it — without it, somebody could send
you a link and collect the resulting session for themselves. It is strictly necessary and it
does not track you.
There are no analytics or advertising cookies.
The game also uses your browser’s own local storage on your device: a note of which build you are running, so an update applies once rather than looping, and your settings. That data stays on your device and is never sent to us.
What is public
The leaderboard shows a display name, its style, a portrait, an account level and a trophy count for accounts with more than zero trophies. Your opponent sees your display name, portrait and trophy count during a match. Afterwards, in their own match history, they can see the match again: your display name and portrait as they are now, your account level and trophies when the match began, and the deck you played with the level of each card. Only the two players see a match in their history. That is the whole of what anybody else can see. Your email address, your collection and your purchase history are not public.
How long we keep it
| Data | Kept for |
|---|---|
| Your account and everything attached to it | Until you delete it, or ask us to. |
| Sign-in sessions | 90 days, then they expire. Only your ten most recent are kept — signing in on an eleventh device ends the oldest. |
| Match records, including the replay data and each side’s deck | Indefinitely. If your account is deleted, your id is removed from those rows and the match remains as an anonymous record, which holds no name. |
| Server logs, which can include your display name and IP address | Web request logs, 14 days. The game server’s own log is removed automatically as it fills, oldest first. |
Your rights
Wherever you live, you can ask us to do any of the following, and we will:
- See what we hold about you — we will send you the rows that concern you.
- Correct it — a display name can be changed in the game; anything else, ask.
- Delete your account — this removes your account and, with it, your cards, portraits, skins, chests, purchase history, the record of reward videos and your sessions.
- Object, or withdraw consent — the practical form of this is deleting the account, since the game cannot be played online without one.
Deleting your account is self-service. In the game, open settings from the lobby and choose ACCOUNT, then DELETE ACCOUNT; on this website, sign in on your account page and use the delete panel at the bottom. It happens immediately and cannot be undone. Delete your account has the steps, and says exactly what is removed and what is kept.
For anything else, or if you cannot sign in: email support@vanguardrealm.com from the address on your account, or ask in the Discord server, and it will be done by hand. We aim to reply within 30 days.
The Terms of Service cover the rest of the rules for playing.
If you are in the EEA or the UK: the lawful basis for storing your account is performance of a contract — you cannot have a persistent game account without one — and for security logging and rate limiting it is our legitimate interest in keeping the service available and uncompromised.
Where your data goes
Onto one rented server, and nowhere else. The only third parties involved at all are Google and Discord, and only because you chose one of them to sign in with; the sign-in exchange happens between our server and theirs. Their own privacy policies cover what they do with your use of their sign-in.
In the Android app, Google is also the source of the optional reward videos. What its SDK collects goes from your device to Google directly, not through us — see Reward videos in the Android app.
We do not sell, rent or share the data we hold about you.
Children
The game is not intended for children under 13, and we do not knowingly collect anything from them. We do not ask your age and cannot verify it. If you believe a child has created an account, tell us and we will remove it.
Security
The site is served over HTTPS only. Sign-in tokens are stored hashed rather than in the clear, so the sessions table cannot be used to impersonate anybody even if it were read. Passwords, where an account has one, are stored using PBKDF2 and never in a recoverable form.
No system is perfect and it would be dishonest to promise otherwise. If something goes wrong that affects you, we will say so.
Changes
If this policy changes, the date at the top changes with it. If a change materially affects what we collect or what we do with it, it will also be announced in the game’s What’s New panel and in the Discord server.