Privacy policy

Last updated 12 November 2026

Warlords of the Three Kingdoms (the game) is made by Gitkonek Studio (we, us). This policy covers the game on iOS and Android and the website at warlord3k.com. Questions: [email protected].

The short version

• We collect what the game needs to run: a random player ID, your warlord's progress, and your purchases. You play without an account; linking Apple or Google is optional.
• No ads, no advertising identifiers, no selling or sharing of data for advertising, no location.
• You can delete your warlord at any time in the game: Settings, Delete account.

What we collect

• Player ID. A random ID created the first time you open the game (anonymous sign in with Firebase).
• Game data. Your warlord's name, level, progress, Generals, artifacts, territories, currencies, raids, bounties, Kingdom War record, messages, and a record of every change to your currencies (it lets us fix mistakes and stop cheating).
• Your portrait, if you upload one. Holders of the Imperial Seal can wear a picture of their own as their portrait. The game squares and shrinks it on your phone, then sends it to us, where Google Cloud Vision checks it before anyone else can see it. A picture it refuses is deleted at once.
• A linked account, if you choose one. Linking Apple or Google shares that account's ID and email address with us (Apple may give a private relay address instead). We use it to restore your warlord on a new device and to match a founder offer to the email you joined the waitlist with.
• Purchases. Which products you bought, when, their price, and the store's transaction IDs, recorded through RevenueCat. Apple and Google handle the payment: we never see your card or bank details.
• Notifications, if you allow them. A device token so the game can tell you when your Energy is full, your territories are ready, or you were raided.
• Usage analytics. Game events such as opening the game, finishing a campaign, or buying Jade, with your player ID, your level and Kingdom, the app version, and the device model and operating system, sent to PostHog. We do not record screens or sessions, and we ask PostHog not to keep your IP address or work out a location from it.
• Where the game was installed from. Once, on the first open: on Android, the campaign tags of the store link you followed, which Google Play passes to the game; on iPhone, whether an Apple Ads search ad led to the install, which Apple answers through its own attribution service from a token the phone makes, with no advertising identifier and no tracking. Kept with your player ID, so we can see which links and ads bring players.
• Crash reports. When the game crashes, Firebase Crashlytics records what the device was doing, the device model and operating system, your player ID, and a crash reporting installation ID.
• The website waitlist. If you join the waitlist, your email address, when you joined, and which link or campaign brought you. Cloudflare Turnstile checks that the form is sent by a person, not a bot.
• Ad measurement on the website, only if you allow it. If you say yes to the cookie question on warlord3k.com, the Meta pixel sets Meta's cookies and tells Meta that you visited and whether you joined the waitlist, so our Instagram and Facebook ads can be measured. Say no, or change your answer under Cookie choices at the foot of any page, and it never loads. It does not run in the game.

We do not collect your contacts, precise or coarse location, or advertising identifiers. The game never reads your photo library: when you upload a portrait, your phone's own picker hands it only the one picture you choose.

What other players see

Your warlord's name, level, Kingdom, portrait, portrait frame, and power appear to other players on leaderboards, raid lists, bounties, and battle logs. Your portrait is the General you wear or, while your Imperial Seal is active, a picture you uploaded. Other players can report an uploaded picture; one reported by three players is taken down and kept where no other player can see it, so we can review it. Nothing else about you is shown to them.

In a clan, its members also see when you were last seen and what you gave the clan. A clan's name, tag, and emblem appear to every player wherever the clan is shown. Its leader may write a short notice that only its members read; the game refuses links and contact details in it, members can report it, and one reported by three members is hidden until we review it.

Chat: you can write to your clan, which only its members read, and to a friend, which only the two of you read. We keep each message 30 days, then it is erased. Messages cannot carry links, email addresses, handles, or long numbers, and any message can be reported or its writer blocked. A reported message is kept, with who wrote it and who reported it, until we review it; we may remove it and stop its writer from chatting for a time or for good.

How we use it

• To run the game and deliver what you buy.
• To keep the game fair: rate limits, and spotting cheating and unusual activity.
• To fix bugs and crashes.
• To understand, in aggregate, which parts of the game work and which do not.
• To send the notifications you allowed, and the waitlist emails you asked for: a welcome, the launch email, one reminder, and occasional news about the game, such as when it opens in a store. Every one has a link to stop them.

Where the law asks for a legal basis (for example in the EEA and the UK): running the game and your purchases is necessary for our contract with you; fairness, security, and analytics are our legitimate interests; notifications, waitlist emails, and ad measurement on the website rest on your consent, which you can withdraw at any time.

Who processes it for us

• Google Firebase: sign in, the game's database and server, file storage for uploaded portraits, notifications, and crash reports (Crashlytics). Game data is stored in Google Cloud's Singapore region.
• Google Cloud Vision: checks an uploaded portrait for adult, violent, or racy content before other players can see it.
• RevenueCat: purchase and subscription records.
• PostHog: usage analytics.
• Resend: waitlist emails.
• Meta: measuring our ads, on the website only and only with your consent.
• Cloudflare: website hosting and the waitlist form's bot check.
• Apple and Google: the app stores, payments, the optional sign in, and telling us which link or Apple Ads search ad led to an install.

They process data only to provide their service to us. Some are based in the United States; where the law requires it, transfers rely on safeguards such as standard contractual clauses.

How long we keep it

• Game data: for as long as your warlord exists.
• An uploaded portrait: until you remove it, replace it, or delete your warlord. One taken down after reports is kept where no other player can see it until we have reviewed it, and is erased with the rest if you delete your warlord.
• When you delete your warlord it leaves the game at once, its uploaded portrait with it, and the rest is erased from our servers within 30 days. The deletion page lists what is erased and what stays.
• Analytics events and crash reports carry the random player ID, never your name or email, and expire under PostHog's and Crashlytics' retention settings.
• A chat message: 30 days from when it was sent, then it is erased. A reported one is kept until we review it.
• A clan notice: until its leader changes or removes it, or deletes their warlord. A clan name or notice that players report is copied, with the reports, for us to review.
• Waitlist entries: until the founder offer ends, or sooner if you ask us to remove yours.

Your choices and rights

• Delete your warlord in the game: Settings, Delete account.
• Turn notifications off in Settings, or in your phone's settings.
• Ask us for a copy of your data, a correction, or its deletion, or object to how we use it: email [email protected]. We answer within 30 days. For a warlord that was never linked we may ask you to act from inside the game, because we have no other way to confirm it is yours.
• You can complain to your data protection authority.

Children

The game is not directed at children under 13 (or the higher age your country sets), and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

Security

Data travels encrypted. Only the game's server can change game data: the app reads, the server writes, and every change to a currency is recorded. Access to the systems is limited to Gitkonek Studio.

Changes

When this policy changes we update it here with a new date, and we announce significant changes in the game before they apply.