Privacy policy
Short version: you can play without an account, we do not show ads, we do not sell or share your data for advertising, there is no chat, and we keep only what the game needs to work. Below is everything, in plain words.
Who runs this
Aura Battles GG (aurabattles.gg and the Aura Battles apps) is run by VojGin s.r.o., a company incorporated in the Czech Republic, IČO 19630727, VAT ID CZ19630727, with its registered seat at Argentinská 1140/30, Holešovice, 170 00 Praha 7, Czech Republic, registered with the Městský soud v Praze (Prague Municipal Court) under file C 389056. That is the "controller" of your data under the GDPR. Contact for anything in this page, including deletion: [email protected].
Who can play
Aura Battles GG is for people aged 13 and over. We do not knowingly collect data from children under 13. If you think a child under 13 is playing, email us with the fighter's profile link and we will delete the profile (see for parents).
What we store, and why
1. Your fighter (everyone)
When you start, your device creates a guest profile. The server stores:
- a random profile id and a hashed device secret (so only your device can play as that fighter);
- your handle: one is generated for you (like
chill_tiger_4821), and you may change it; - your fighter's look, equipped moves and auras, unlocked items, aura totals, level, wins, losses, badges and settings;
- a hidden skill rating and counts of the choices you make in rated matches (for example, how often you pass), used to pick a fair opponent. If you switch on the "ghost" setting (off by default), a copy of those counts can play other people as your labelled ghost.
Why: to run the game you asked to play (GDPR Art. 6(1)(b)), and to match you fairly and stop cheating (our legitimate interest, Art. 6(1)(f)).
2. Your account (only if you sign up)
Signing up is optional. If you do, we store your email address and your password as a salted scrypt hash (we never see or store the password itself), when the account was created and last used, and a login session (a token we store only as a hash, with your browser's user-agent string so you can tell sessions apart). We send no newsletters and no marketing. The only email we ever send is a password-reset link, and only when you ask for one.
3. Matches
The server runs every match, so it sees every card you play. After a match it saves a recap (both handles, both fighters' looks and the round-by-round play) that anyone with the link can open, and keeps a short record of who played whom in the last 24 hours so you do not meet the same person again and again.
4. Game statistics
We log simple game events tied to your profile id, such as "a match started", "a match finished", "shared a result", whether you are on a phone, and which screen you came in from. We use them to count players and fix the game. This is first-party only: no Google Analytics, no advertising SDKs, no tracking pixels, no fingerprinting.
5. Technical data
- IP address. Your IP address reaches our server like on any website. The game uses it in memory to limit abuse (for example, too many connections or login attempts from one address); it is not saved with your profile. Our server and our CDN (Cloudflare, see below) may keep it in short-lived access and error logs.
- Server logs record match summaries (handles, rounds, result) and errors, for debugging.
What is public
- Your handle, fighter, aura total, wins and losses, badges and rank are shown on your profile page (
/u/…), on the leaderboard on the home screen, to your opponent, to anyone watching a match by code, and on share images. Profile pages can appear in search engines. - Match recaps can be opened by anyone with the link.
- Your email address, rating, device secret and statistics are never public.
There is no chat and no way for players to send each other text. The only text a player can write is their own handle.
On your device
We use no cookies. The game keeps a few things in your browser's local storage: your profile, your device secret, your login token if you signed up, sound and graphics settings, and a few "already seen" flags. A service worker caches the game's files so it loads faster. All of this is needed for the game to work; there is nothing for advertising. Clearing your browser's site data removes it (and, for a guest, the way back into that fighter).
The fonts are served from our own server, so loading a page does not contact Google or any other font service.
Who else gets your data
- Hosting: our own servers, operated by VojGin s.r.o. in the Czech Republic (EU). They run the game and store the database.
- Delivery: the site and the game's connection are delivered through Cloudflare (Cloudflare, Inc., USA), our content delivery network (CDN), which also shields the game from attacks. All traffic passes through it encrypted; like any CDN it handles your IP address and the requests your device makes, only to deliver them.
- Email: if you ask for a password reset, your email address and the reset link go to our email provider, Resend (Resend, Inc., USA), to deliver that one message.
- App stores: if you use the iOS or Android app, Apple or Google handle the download under their own privacy policies.
- Sharing: when you press share, your device's share sheet sends the image and link to whichever app you pick.
We do not sell your data and we do not share it for advertising. Where a provider is outside the EU, the transfer relies on the provider's standard contractual clauses or the EU–US Data Privacy Framework.
How long we keep it
| What | How long |
|---|---|
| Guest profile, rating, choice counts, ghost | Until you delete it (in the game, or by asking us). It disappears from the game at once and is erased for good within 30 days. |
| Account (email, password hash) | Until you delete it. Every login ends at once; the account is erased for good within 30 days. |
| Login sessions | 90 days after last use. |
| Password-reset links | 30 minutes; removed within the hour after use or expiry. |
| Match recaps | 7 days, unless a fighter who played in it chooses to keep it. |
| Who-played-whom record | 24 hours. |
| Game statistics | 180 days. |
| Server logs | No more than 14 days on our servers; Cloudflare keeps its own short-lived logs. |
| Backups | Overwritten on a rolling basis. |
Your rights, and how to delete everything
You can change your handle and your fighter in the game at any time. Under the GDPR you can also ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format.
To delete everything yourself, open the game, tap me, then delete my account, and confirm. It works for guests and for accounts with an email. Your fighter disappears from the game at once (leaderboard, profile page, matchmaking), every login ends, and the device starts again as a new guest. We then erase the profile, the account, its sessions, rating, ghost, statistics and the match recaps you appear in for good, in batches, within 30 days. Step by step: delete your account.
Can't open the game? Email [email protected] from the address on your account, or, for a guest fighter, include your profile link (it looks like aurabattles.gg/u/…) or your handle, and we do the same within 30 days. In-game aura has no cash value, so there is nothing to pay out.
You can also complain to your data protection authority (in the EU, the authority where you live).
Security
Passwords and tokens are stored only as hashes, the connection is encrypted (HTTPS), and the admin panel is password-protected and logged. No system is perfect; if we learn of a breach that affects you, we will tell you and the authority as the law requires.
Changes
If we change what we collect, we update this page and the date above first. Big changes will also be announced in the game.