Privacy Policy

Last updated: 1 October 2026

Summary

VoidCraft is a multiplayer space-strategy game. To play, you sign in with Google so we can identify your account across devices. Once you're in, the game backend stores everything you'd expect: your planets, ships, battles, messages, and alliances. We do not sell your data, the game shows no ads, and we don't share your gameplay or account information with advertising or analytics third parties. This website (voidcraftgame.com, not the game) uses analytics and advertising pixels to measure our own ads; Section 3a explains what they do and how to turn them off.

1. Who runs VoidCraft

VoidCraft is operated by Hanamori Labs, LLC ("we", "us"). Apple Developer Team ID Y96ZBULSTS. The website you're reading now is hosted at voidcraftgame.com. The game backend lives at api.voidcraftgame.com.

2. What we collect

From your Google account (during sign-in via Firebase Authentication):

• Your email address
• Your Google account display name
• Your Google account profile picture URL (if set)
• A persistent Google account identifier (used internally as your VoidCraft user ID)

From your gameplay (stored on our backend):

• Your in-game display name (which you can change in Settings - this is what other players see)
• The state of your empire: planets, buildings, research, ships, defences
• Fleet missions, battle reports, espionage reports
• Messages you send to other players and alliance members
• Alliance memberships and join requests
• Galactic Trade Centre offers you post and accept
• Aggregate gameplay metrics needed for matchmaking, leaderboards, and balance tuning
• Any custom profile cosmetics or images you choose to upload. Uploaded images may be reviewed - by us, and in future by an automated content-moderation service - and removed if they breach the Terms of Service (which prohibit NSFW or otherwise objectionable content).

From the app itself:

• Crash reports and uncaught errors, sent to Sentry. These include the JavaScript stack trace, the device model, the OS version, and the app build number. We do not attach your email or display name to crash reports.
• If you opt in to push notifications: an opaque push-token assigned by Apple or Google. The token identifies your device for delivery purposes only; it is not tied to anything outside our backend.

From the website (voidcraftgame.com):

• Standard web-server access logs (IP address, browser user-agent, page accessed, timestamp). Retained 30 days for security and abuse prevention.
• Analytics and advertising cookies, as described in Section 3a. In the European Economic Area, the United Kingdom and Switzerland they load only if you accept them.

3. What we don't collect

• We do not access your device's location, GPS, contacts, photo library, microphone, or camera. (Custom profile cosmetics are images you actively choose to upload - see Section 2 - not anything we read from your device.)
• The game contains no advertising and no third-party advertising SDKs.
• The game contains no third-party analytics SDKs (no Google Analytics, no Facebook SDK, no Adjust, no AppsFlyer, no Amplitude, no Mixpanel). This applies to the game itself; the website is covered in Section 3a.
• We do not collect payment information. The game is currently free; if cosmetic purchases launch in the future, payments will be handled by Apple or Google's store and we will update this policy.
• We do not knowingly collect data from children under 13 (United States) or under 16 (European Union). VoidCraft is targeted at teen and adult audiences. If you become aware that a child has provided us with personal information without parental consent, contact us and we will delete the account.

3a. Measurement and advertising on this website

This website (not the game) uses Google Tag Manager to load Google Analytics and the advertising pixels of X, TikTok and Meta. They tell us how people find and use the site and which of our ads bring visitors here, and the ad networks may use them to show our ads to people who visited.

• What they collect: the pages you visit and the page you came from; clicks on the Play now and Wishlist on Steam buttons; your IP address and browser and device details; and identifiers in cookies set by Google, X, TikTok and Meta.
• In the European Economic Area, the United Kingdom and Switzerland, nothing loads until you choose. A banner asks, with Accept and Reject side by side, and Reject loads nothing. Your answer is kept for 12 months in the hc_consent cookie.
• Everywhere else, they load after the page has finished. You can turn them all off with Your privacy choices at the bottom of every page. If your browser sends Global Privacy Control, we treat it as an opt-out from advertising automatically: the X, TikTok and Meta pixels stay off, and Google Analytics still counts visits unless you turn it off too.
• Changing your mind: use Cookie settings at the bottom of every page at any time.
• Where they never run: the delete-account page, and the game itself.
• Who receives the data: Google (Google Tag Manager, Google Analytics), X Corp., TikTok and Meta Platforms each receive it and use it under their own privacy policies, and may process it in the United States.
• Legal basis: your consent in the EEA, UK and Switzerland. Elsewhere, our legitimate interest in measuring our website and ads, with the opt-out above.
• California: we do not sell personal information. These pixels may count as "sharing" for cross-context behavioural advertising; opt out with Your privacy choices or Global Privacy Control.

4. Why we collect what we collect

• To run your account. Without your Google identifier, we cannot sync your progress across devices.
• To run the game. Your empire state, fleets, battles, and messages are the game.
• To prevent abuse. Server logs and rate-limit data are used to spot bots, cheats, and harassment.
• To diagnose crashes. Sentry reports help us find and fix bugs before they affect more players.
• To balance the game. Aggregate metrics (average resource production, battle outcomes, research rates) inform balance changes. This work is done on aggregated data and never tied back to individual accounts in published material.

5. Who we share data with

We use a small number of infrastructure providers. We do not sell your data, and we do not share your account or gameplay data for advertising. The providers process your data on our behalf:

• Google Firebase (Google LLC) - authentication, identity verification
• Railway (Railway Corp.) - hosts the game backend (api.voidcraftgame.com) and the website
• Sentry (Functional Software, Inc.) - crash reporting
• Apple Push Notification Service - delivery of iOS push notifications (if you've opted in)
• Google Firebase Cloud Messaging - delivery of Android push notifications (if you've opted in)
• Cloudflare - DNS and edge caching for static assets
• Google (Google Tag Manager, Google Analytics), X Corp., TikTok and Meta Platforms - website measurement and advertising pixels only, as described in Section 3a. They never receive your account or gameplay data.

Each provider has its own privacy policy and security practices. We pick providers we trust and review what we send to each.

6. Where your data lives

The primary game database is hosted by Railway in the United States. Sentry crash reports are processed in the United States. Firebase Authentication runs in Google data centres globally. If you are accessing VoidCraft from outside the United States, you consent to your data being transferred to and processed in the United States.

7. How long we keep data

• Account data is kept for as long as your account is active.
• Crash reports in Sentry are retained for 90 days by default.
• Web server logs are retained for 30 days.
• Aggregate gameplay metrics (player-count, average battle outcomes, balance telemetry) are retained indefinitely in anonymised form.

8. Your rights

Depending on where you live, you have one or more of the following rights:

• The right to access a copy of your personal data
• The right to correct inaccurate data
• The right to delete your personal data (subject to legal retention requirements)
• The right to object to or restrict certain processing
• The right to data portability (a machine-readable export of your data)
• The right to withdraw consent at any time

To exercise any of these rights, email [email protected] from the email address tied to your VoidCraft account. We respond within 30 days.

9. Account deletion

You can request full account deletion at any time by emailing [email protected]. We delete:

• Your Firebase Authentication record (this severs the link between your Google account and VoidCraft)
• Your in-game empire, ships, planets, alliance memberships, and message history
• Sentry crash reports tied to your sessions (where identifiable - most are not)

What we keep: aggregate gameplay statistics that no longer identify you (e.g. "X battles resolved this month" - your specific battles are removed from such aggregates if individually re-identifiable). We may also keep an audit-log entry confirming the deletion request was honoured, to comply with our own records-retention obligations.

Deletion is final. We cannot restore an account or its history once deleted.

10. Security

We use industry-standard practices to protect your data: TLS in transit for all client-server traffic, encrypted database storage, scoped credentials for every infrastructure provider, and the principle of least privilege for internal access. No system is perfectly secure, so we encourage you to use a unique strong password on the Google account you sign in with.

11. Changes to this policy

If we change how we handle your data in a material way - for example if we add a new third-party processor, or start collecting a new category of data - we will update this page, change the "Last updated" date at the top, and (where the change is significant) notify you in the app.

12. Contact

Privacy questions, deletion requests, or rights enquiries:

• Email: [email protected]
• Operator: Hanamori Labs, LLC