Bloodlines & Banners — Privacy Policy

Effective date: 2026-08-16 · Draft pending a final review by counsel before public launch.

Bloodlines & Banners ("the Game", "we", "us") is operated by Synprax Labs LLC. This policy

explains what we collect, why, and your choices. We collect the minimum needed to run

the Game and keep your campaigns safe.

1. What we collect

Account identity (via Firebase Authentication / Google). When you sign in we receive an

email address and a Firebase user ID. If you use a sign-in provider (e.g. Google, Discord),

we receive the basic profile that provider returns (name, email). We do not store your password —

authentication is handled by Firebase/your provider.

A display name you choose (shown on leaderboards and to other players in multiplayer).
Game data. Your campaigns, turns, settings, and an append-only event log of your games,

stored so you can save and resume. Tied to your account ID.

Basic technical data. Standard server logs (IP address, timestamp, user-agent) for

security, abuse-prevention, and debugging, kept for a limited period.

We do not knowingly collect data from anyone under 13 (or the minimum age in your region).

2. What we do NOT collect

No payment/card data. We do not collect or store your payment or card details ourselves. If

you purchase the Game through a storefront (e.g. itch.io, Steam, or a direct sale via our

payment processor), that transaction is handled by the storefront/processor under its own

No biometric data, no precise location, no third-party advertising/tracking cookies.
We do not sell or rent your personal information to anyone.

3. How we use it

To authenticate you and save/resume your campaigns.
To run multiplayer (show your display name and turn status to players in your game; send an

optional "your turn" notification via Discord webhook if you opt in).

To show leaderboards/Hall of Fame (you can opt out — see §6).
To maintain security, prevent abuse, fix bugs, and improve the Game.

We use reputable providers strictly to operate the Game; they process data on our behalf:

Google Firebase — authentication.
Supabase — database (your account + game data).
Railway — application hosting.
Discord — only if you opt into turn notifications (we send your display name + a turn link).

We do not share your data for these providers' own marketing.

5. Where data is stored

Data is stored on our providers' infrastructure (which may be located in the US/EU). By using the

Game you consent to processing in those regions, with safeguards required by applicable law.

6. Your choices & rights

Leaderboard opt-out: toggle "Hide me from the leaderboard" in Options (/api/user/privacy).
Notifications: turn off Discord turn-pings at any time.
Access / deletion: you may request a copy of your data or deletion of your account and

campaigns by contacting us (see §9). Depending on your region (e.g. GDPR/UK-GDPR, CCPA) you may

have rights to access, correct, delete, port, or object to processing; we honor these.

Deleting your account removes your personal identifiers; anonymized/aggregate game records may

be retained.

7. Retention

We keep account + game data while your account is active and for a reasonable period after, then

delete or anonymize it. Server logs are kept for a short rolling window.

8. Security

We use authentication via Firebase, encrypted transport (HTTPS), and access controls. No system is

perfectly secure, but we take reasonable measures to protect your data and will notify affected

users of a material breach as required by law.

9. Contact & changes

Questions, or to exercise your rights: privacy@bloodlinesandbanners.com. We may update this policy;

material changes will be announced in-game or by email, and the effective date above will change.

*Implementation note (remove before publishing): serve this at /privacy, link it from the

sign-in screen and the Options menu, and require acknowledgement at first sign-in. Fill in the

contact email and have counsel confirm the GDPR/CCPA sections for your launch regions.*