1. Who is responsible for your information?
Lunqest LTD, registered at Companies House as LUNQEST LIMITED, company number 16823938, is the controller of personal information used to operate keepofthedragon.com, Emberkeep: The Dragon Hatchery, Accounts, the Ember Shop and related support (the Services).
Our registered office is International House, 50 Essex Street, London, WC2R 3JF, United Kingdom. Contact us about privacy, a complaint or your rights at support@keepofthedragon.com, or write to that address marked “Privacy”. A Game or studio name shown in the Services does not replace Lunqest LTD as the controller identified in this notice.
This Policy explains our processing. It is not a request for blanket consent and does not require you to waive any rights. Virtual Items includes Coins, Warmth and other in-game resources, items and functionality described in our Terms and Conditions.
2. A short explanation for younger players
We use information about your Account to let you sign in, save your island and deliver purchases. Technical information helps us keep the Game working and protect Accounts. Optional tracking and promotional messages are separate choices. You can ask us what information we hold, ask for mistakes to be corrected and ask us to delete information where the law allows. You can contact us yourself; you do not have to make every privacy request through a parent.
The Game is for players aged 16 or over. Players under 18 need the parental involvement described in the Terms and Conditions. Do not send us your password or information you do not need to share.
3. Information we collect and its sources
We collect information you provide, information generated when you use the Services and information received from providers involved in sign-in or payment. The categories depend on the features you use:
| Category | Information and source |
|---|---|
| Account and authentication | Email address, optional Keeper name, Account/user identifier and information needed to authenticate or recover access. The registration interface accepts a password or an external sign-in option. |
| External sign-in | If you choose Google sign-in, the sign-in result and identity information Google supplies under the permissions shown, such as an identifier and email address. We do not receive your Google password. |
| Gameplay and saving | Progress, board/save state, unlocked content, gameplay actions needed to operate the Game, Virtual Item balances, save timestamps and records linking a save to an Account. |
| Purchases | Selected pack, quantity, price, currency, purchase identifier, payment status, delivery/grant status, refund history and transaction references received from the payment process. Billing or country information is processed where needed for the transaction or tax requirements. |
| Technical and security | IP address, browser/device information, access times, connection and error logs, authentication events and evidence needed to investigate suspected exploitation, fraud or unauthorised access. |
| Support | Your email, messages, relevant Account and transaction details and any screenshots or other information you choose to provide. |
| Choices and eligibility | Preferences, consent or objection records and, where requested to apply age or purchase rules, proportionate age-band or parental-authorisation information. |
Payment information submitted directly to an external payment provider is handled by that provider. Our transaction records are distinct from the complete payment credentials the provider may need. Do not send full card numbers, card security codes or online-banking credentials to our support team.
We do not ask you to provide sensitive personal information, such as health information, to play. If you voluntarily include such information in a support request, we will limit its use to what is necessary and legally permitted for that request.
4. Why we use information and the lawful bases
The table describes processing where the relevant activity occurs. A reference to an optional activity does not mean that it is enabled for every player.
| Processing purpose | Data involved | UK GDPR/GDPR lawful basis |
|---|---|---|
| Register and authenticate an Account; provide requested access | Account details, identifiers, authentication information | Performance of our contract with you, or steps requested before entering it. |
| Operate the Game and maintain/synchronise progress | Account identifier, save state, progress, balances and gameplay information needed for the feature | Performance of contract. |
| Process orders, grant purchases and administer contractual refunds | Account and transaction details, purchase and delivery status | Performance of contract. Separate legally required tax/accounting processing uses legal obligation. |
| Resolve gameplay, Account or purchase support | Support messages and relevant Account, gameplay and transaction records | Performance of contract where needed to provide contractual support; legitimate interests in responding to other enquiries and resolving problems. |
| Protect Accounts, prevent fraud and investigate cheating or security incidents | Security logs, IP/device information, relevant gameplay and transaction records | Legitimate interests in protecting players, the Services and payments; legal obligation for specific legally required security or disclosures. |
| Diagnose faults and maintain reliable operation | Necessary technical logs and error information | Legitimate interests in detecting faults and maintaining the Services; performance of contract where indispensable to a requested feature. This does not authorise optional device tracking. |
| Optional analytics, if offered and enabled | Analytics identifiers and activity information described when you choose | Consent for optional analytics involving browser storage/access and related personal-data processing under our consent-based approach. |
| Optional promotional emails, if offered and requested | Email and marketing preferences | Consent. Service and security messages are sent on the relevant contractual or security basis, not marketing consent. |
| Apply age and parental-authorisation rules | Minimum necessary eligibility and authorisation records | Legitimate interests in age-appropriate access and preventing unauthorised purchases; legal obligation where a specific law requires it. Any legally required parental data-processing consent is obtained separately. |
| Keep required records and respond to binding legal requirements | Relevant transaction, identity and correspondence records | Legal obligation under applicable law. A foreign request is assessed separately before disclosure. |
| Establish, exercise or defend legal claims | Relevant Account, transaction, security and correspondence records | Legitimate interests in protecting legal rights. Additional conditions apply if sensitive information is necessarily involved. |
Where we rely on legitimate interests, we assess necessity and balance those interests against your rights, giving particular weight to children's interests. You may ask about that assessment or object. We do not use “contract” to justify unrelated tracking or advertising. If someone else contracts on a player's behalf, we assess the appropriate basis for the player's own information rather than assuming the adult's contract automatically covers every use.
Required Account information is needed to create or authenticate an Account. Without the necessary transaction information, we cannot complete or resolve a purchase. Optional information, marketing permission and optional analytics are not required to play the core Game.
5. Children and privacy safeguards
The minimum player age is 16. This is different from the age at which a child can give valid data-processing consent. Where parental consent is legally required for a particular consent-based activity, we will obtain and reasonably verify it before that processing, or leave the activity disabled.
Our approach to younger players is to minimise information, use high privacy settings by default and avoid using their information in ways detrimental to their wellbeing. We do not authorise behavioural advertising profiles of children or precise-geolocation tracking through this Policy. Optional marketing or tracking cannot be enabled merely by a parent accepting the Game Terms.
If we learn that an under-16 player has registered, we will assess the information, restrict inappropriate processing and remove information we have no lawful reason to retain. Limited records may remain where necessary to resolve a purchase, safeguarding issue or legal obligation. Parents and guardians may contact us, but access to a child's information remains subject to the child's rights and appropriate checks.
6. Browser storage, analytics and marketing choices
The Services use browser storage for functions including local saves, linking saves to Accounts and remembering the demo's sound preference. The Cookie Policy describes the technologies identified and how to control them. Necessary authentication and saving technologies are distinct from optional analytics.
If optional analytics or promotional communications are introduced or offered, we will explain the activity and obtain the appropriate choice before starting it. This notice does not authorise undisclosed advertising pixels, cross-site tracking or third-party marketing.
You can withdraw an optional choice without losing the core Game. Withdrawal does not make earlier lawful processing unlawful. Necessary transactional, security and legal notices may still be sent. Browser settings and deletion of local data do not by themselves close an Account or delete cloud records.
7. Who receives information?
We disclose information only where needed for the purposes described, to relevant recipients such as:
providers of hosting, infrastructure, authentication, databases and technical operation; the Website's software includes Google Firebase authentication/database components;
the external sign-in provider you choose;
payment providers handling the transaction, reimbursement, payment authentication or a dispute;
providers assisting with customer support, security or optional analytics, to the extent actually engaged for those activities;
professional advisers, auditors, insurers and parties involved in a legal claim where necessary;
public authorities where disclosure is required or otherwise lawfully justified; and
a proposed or actual business successor and its advisers where necessary for a genuine business transfer, subject to confidentiality, data minimisation and applicable law.
Providers processing information on our behalf must be subject to appropriate contractual restrictions. Some recipients, particularly payment providers and external sign-in providers, may act as independent controllers for their own legal, security or service purposes; their privacy notices explain those activities. We remain responsible for disclosures and processing for which we are controller.
We do not authorise a recipient to use Account or gameplay information for unrelated advertising merely because it supplies a service to us. You may request further information about relevant recipients through our privacy contact.
8. International processing and safeguards
Access from different countries and use of international providers may involve processing outside the UK or EEA. The legal requirements depend on where the information comes from, where it goes and the roles of the organisations involved.
A restricted transfer must have a lawful safeguard before it takes place. Depending on the destination and applicable regime, this may be an applicable UK adequacy regulation or EU adequacy decision, or approved contractual protections supported by the required transfer assessment and supplementary measures. UK contractual options include the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; EEA transfers may use the EU Standard Contractual Clauses. These are possible safeguards, not a statement that every listed instrument applies to every provider.
Contact support@keepofthedragon.com for the destinations and safeguards relevant to your information and to request a copy or description of applicable protections, with confidential details redacted where appropriate. An ordinary decision to play or accept the Terms is not blanket consent to an otherwise unlawful international transfer.
9. Retention
We retain identifiable information only for as long as needed for its purpose:
| Records | Retention criteria |
|---|---|
| Account and progress | While needed to provide your active Account, saving and recovery. On closure, information no longer needed for those purposes is deleted or anonymised, subject to the limited purposes below. |
| Purchases and refunds | For the applicable tax/accounting recordkeeping requirements and periods reasonably needed for payment disputes, consumer claims or legal proceedings. Only the relevant transaction records are retained for those purposes. |
| Security and technical logs | For the shortest operational period reasonably needed to diagnose faults and investigate threats; relevant extracts may be retained longer for an identified incident or claim. |
| Support correspondence | Until the enquiry and reasonable follow-up are resolved, with longer retention only where justified by a dispute, recurring issue or legal obligation. |
| Consent and preference evidence | While the choice is applied and for the period needed to demonstrate compliance. A minimal suppression record may be retained to respect an objection or unsubscribe request. |
| Backups | Until overwritten or deleted under the relevant recovery cycle; deleted information is not restored to ordinary use without reapplying the deletion. |
Retention is reviewed by reference to these purposes, legal requirements, the sensitivity of information and the impact of retaining it. A specific legal hold applies only to relevant records and does not justify keeping an entire Account indefinitely. The Cookie Policy separately explains device-storage persistence.
10. Security
We must use technical and organisational measures appropriate to the risks, including appropriate access restrictions, authentication and protection of transfers and stored information. No internet service can guarantee absolute security. If a breach creates a legal notification obligation, we will notify the relevant authority and affected individuals as required.
Use a password you do not reuse elsewhere, protect your email and external sign-in accounts, and contact support if you suspect compromise.
11. Your rights
Subject to applicable conditions and exceptions, you may:
obtain access to your personal information and a copy;
correct inaccurate or incomplete information;
request erasure or restriction;
receive eligible information in a portable format and request its transmission where technically feasible;
object to processing based on legitimate interests, for reasons relating to your situation;
object to direct marketing at any time;
withdraw consent for processing based on consent; and
exercise applicable safeguards concerning solely automated decisions that have legal or similarly significant effects, including requesting human involvement, making representations and contesting a decision where those safeguards apply.
We do not treat ordinary automatic saving, resource calculations or purchase-crediting as a significant automated decision simply because software performs them. If an Account or purchase restriction affects you, you can request review by support. Any significant solely automated decision would require the applicable legal basis, information and safeguards; the UK and EEA rules are not identical.
Email support@keepofthedragon.com to exercise a right. We will ask only for proportionate verification where needed, and normally respond within one month. Any lawful extension or adjustment to that period will be explained. Requests are normally free; any legally permitted exception will be explained. Deletion may end access to associated Game progress, but does not remove your right to pursue an outstanding purchase remedy.
12. Complaints
Please send privacy complaints to support@keepofthedragon.com or our postal address, explaining your concern and how you would like us to respond. We will facilitate complaints, acknowledge them within 30 days and investigate and respond without undue delay, keeping you appropriately informed.
You may complain to the Information Commissioner's Office (ICO) through ico.org.uk/make-a-complaint. If the EEA GDPR applies, you may also complain to the supervisory authority in the EEA country where you habitually reside, work or believe an infringement occurred. You do not have to give up your right to contact a regulator or seek a judicial remedy while we consider your complaint.
13. Changes to this Policy
We will update this Policy when relevant practices or legal requirements change and display the updated date. Material changes will be brought to your attention appropriately before new processing where required. Updating this Policy does not itself provide consent or another lawful basis for a new use.