Document version: 3 November 2026.
1. Who is responsible
The controller of personal data for VAREN: ASHEN VEIL is Damian Władyczuk, an individual publisher based in Poland. LND Corp is the public publisher name and VAREN Games is the project brand. Neither name is a separate registered legal entity.
For support, privacy questions, requests to exercise your rights and account deletion, contact lndcorpgames@gmail.com. You do not need to install the game to contact us. The account-deletion page is account-deletion page.
2. Accounts and game progress
Starting as a guest creates a Supabase Auth account and a session. A guest account has a unique identifier even if you have not supplied an email address. It is not an account that is unidentifiable to the service. If you register with or link an email address, we process that address and its verification status. Password authentication is handled by Supabase Auth.
We process your nickname, account and character identifiers, appearance, level, experience, equipment, inventory, pets, runes, magic, totems, virtual balances, game commands, costs, rewards, battle results, ranking information and transaction records. This information supports gameplay, Cloud Save, recovery, synchronization and verification of legitimate progress. Economic changes are approved by the server; local animations and pending requests do not themselves grant resources.
Where the compliance features are enabled, we also record the version and time of accepted community rules, authenticated deletion requests and their status, reports, moderation decisions and restricted reviewer-access records.
3. Social features
Eligible players may see your nickname, permitted character appearance and combat information, level and ranking. Public profiles do not display passwords, email addresses or session tokens. The service also processes in-game friend requests, friendships, blocks, guild details, memberships and relevant guild actions. It does not need access to your phone address book.
Server and guild chat messages contain their text, author, channel and time. Server chat is for eligible realm participants; guild chat is subject to membership and server-access checks. Friends-restricted private messaging is processed where that feature is available. Messages are not end-to-end encrypted. Do not post sensitive personal information or secrets.
Reports may identify the reporter, the reported account or character, a message, a reason and the moderation action. Use REPORT MESSAGE or REPORT USER to report content or a player, and BLOCK PLAYER to block a player where these controls are available. Contact lndcorpgames@gmail.com for support or an appeal. The community rules appear at the end of this policy.
4. Information stored on your device and voluntary reports
On Android, authentication sessions use a Keystore-backed secure-storage component. App-private storage also contains approved-state caches, pending request identifiers, preferences and bounded local diagnostics. Losing an unlinked guest session can prevent account recovery. Signing out, clearing app data or uninstalling the game does not delete an online account.
Technical diagnostics, including device model, OS and app version, graphics settings, frame rate, load and command timings and recent error categories, are recorded locally. The current beta does not automatically upload this diagnostic history and has no configured advertising, analytics or third-party crash-reporting SDK. A local unclean-shutdown marker is not a captured native crash stack trace.
You may choose to export a bug report, include technical details or a screenshot, or share report text through Android's share chooser. Creating a local file alone does not send it to us. If you send a report to lndcorpgames@gmail.com, we receive the message and attachments you choose to provide. Review them before sending. These features do not request access to your camera, microphone, photo library, location sensors or phone address book. Files you export outside the app remain under your control.
5. Providers, this website and international processing
Supabase supplies account authentication, database and API services. The game worker uses Hetzner infrastructure. These services process request and connection information such as IP addresses, timestamps, requested paths, authentication events and technical errors. Provider security services may derive approximate location from an IP address; the game does not request GPS location for these features.
The legal pages use static Cloudflare Pages hosting. Their supplied source contains no scripts, advertising, third-party analytics, remote fonts or web forms. Cloudflare nevertheless receives connection information when delivering and protecting the pages. A page without analytics is not a page without network-data processing.
The contact mailbox uses Gmail. Google processes the sender address, message and attachments, together with relevant service metadata. Google Play distributes the app and processes platform information under its own terms. No advertisements or real-money purchases are enabled in this closed beta. Earned virtual-resource transactions are part of game progress.
Providers can process information through infrastructure and support outside Poland or the European Economic Area. Their roles and processing arrangements depend on the service and purpose; not every provider activity is performed solely on the publisher's behalf. An EU database location does not establish that all provider processing remains in the EU. Information about applicable provider arrangements and transfer safeguards can be requested from lndcorpgames@gmail.com.
Provider information: Supabase privacy information and data-processing terms are at https://supabase.com/privacy and https://supabase.com/legal/dpa. Hetzner's privacy information is at https://www.hetzner.com/legal/privacy-policy/. Cloudflare's policy is at https://www.cloudflare.com/privacypolicy/. Google's policy and deletion information are at https://policies.google.com/privacy and https://policies.google.com/technologies/retention.
6. Purposes and legal grounds
We use account and gameplay information to provide the online game you request, validate progress, synchronize devices and provide requested social features. Where necessary for the game service, this processing is based on performance of the service contract under Article 6(1)(b) GDPR, subject to the applicable rules on entering into that contract.
Security, fraud and duplicate-request prevention, proportionate moderation and investigation of service problems serve our legitimate interests in operating a safe and reliable game under Article 6(1)(f) GDPR. Those interests must be balanced against your rights, including the particular interests of younger players. Handling data-rights requests and other applicable legal duties can rely on Article 6(1)(c).
Where a particular optional activity requires consent, it must have an appropriate, separate consent basis. Accepting community rules is not blanket consent to all processing. We do not use the information described here for targeted advertising or make decisions about legal eligibility or similar significant effects solely through automated profiling. Game rules and rankings determine in-game outcomes.
7. Retention
Account and approved progress are kept while the account exists and until a valid deletion request has been carried out, subject to the limited purposes described below. Closing the app or an inactive play session does not itself erase an account.
Player-visible chat history is limited to the most recent 30 days. This is a viewing limit: it is not a promise that the underlying database rows, reports or every copy are erased at 30 days. A scheduled purge of all older chat records and server diagnostic files has not been verified for the current beta. We therefore do not state a maximum 30-day storage period for those records.
Game-command records, request identifiers, transaction receipts, replay and audit records are used to settle authorized changes, prevent duplicated rewards, recover interrupted operations and investigate a concrete problem. They must not be removed in a way that allows the same request to award resources again. They are covered by account-deletion handling and any specifically justified exception; they are not an independent permission to retain a complete deleted account indefinitely.
Reports, moderation evidence, support correspondence and a minimal record of a privacy request are kept for the time needed to deal with the matter, any active appeal, an applicable legal duty or a specific legal claim. Any continued retention must have an identified purpose and be limited to the information needed for it. We review that need when the matter is resolved. We do not claim a fixed period that has not been verified or implemented.
Infrastructure and provider logs have separate retention settings. Docker log rotation by file size does not by itself set an expiry date. Supabase log and backup availability depend on the project plan and configuration. Provider-managed security or legal records may follow different schedules. There is no confirmed single 30-day limit covering all these services.
Backup copies are kept to recover from data loss and follow the configured provider cycle or explicit manual deletion. A manually created server snapshot does not expire merely because it is old. A deleted item can remain in an earlier backup until that copy is retired. Completed deletion requests must be reapplied before a restored copy is put back into use. We do not promise instant selective removal from every backup or assign an unverified maximum backup age.
Mail kept in a Gmail inbox is not automatically erased after 30 days. Deleted messages normally remain in Trash for up to 30 days unless permanently removed sooner. Google also describes separate deletion and backup processes. Removing a message from the mailbox is therefore not a promise that every provider copy is immediately gone.
The intended shorter-retention policy will be reflected here when its operation has been verified. The current text does not represent a future 30-day purge as already active.
8. Deletion and your rights
You can request account and associated-data deletion by emailing lndcorpgames@gmail.com. Instructions are at account-deletion page. Where available, the app also provides Privacy / Request account deletion in Settings → About and in the online Account / Copy QA ID panel. If the in-app service is unavailable, the email route remains available.
We need to establish that a request concerns your own account. A valid authenticated in-app request supplies stronger ownership evidence than a publicly visible account ID. When a request arrives by email, we may ask you to confirm it through your existing signed-in account or the normal recovery process associated with the account. An email address or UUID supplied in a message is not sufficient by itself. We request only information necessary for verification and do not ask you to email passwords, tokens or verification links. A lost, unlinked guest account may be impossible to verify from a public ID alone.
For GDPR rights requests, we respond without undue delay and normally within one month of receipt. Where complexity or the number of requests justifies it, the response period can be extended by up to two further months; we inform you within the initial month and explain the reason. This legal response period is not a blanket promise to erase all provider backups within 30 days. Where the right to erasure applies, erasure is handled without undue delay. We explain any applicable refusal or limited retention.
Deletion concerns the account and its associated player data, including authentication and sessions, characters and Cloud Saves, equipment and virtual resources, social connections and memberships, messages and identifying profile/ranking references. Shared records may need removal of identifying references rather than deletion of other players' information. Guild leadership and shared records are reviewed before completing the account's erasure. Submitting a request alone does not erase the account or confirm completion.
Where legally necessary, limited information may remain for a specific obligation, security investigation or establishment, exercise or defence of a legal claim. Such retention must be justified for that record and purpose, rather than an automatic exception for all game data. We explain a relevant exception when responding. Backups, external support records and exported files require separate handling from active account data.
Depending on the applicable law and legal basis, you can request access, correction, deletion, restriction or portability, object to processing, and withdraw consent where processing relies on consent. Withdrawal does not undo earlier lawful processing. You can complain to the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, UODO), or the competent authority for your situation. Information is available at https://uodo.gov.pl/.
9. Younger players
The intended store audience is 13–15, 16–17 and adults. The game is not intended for children under 13. This audience declaration is separate from the game's content rating. The beta does not have a verified parental-consent or date-of-birth verification system.
Rules for a minor entering into the service contract, and the threshold at which a child can consent to an online service, depend on the country and legal basis. Where the law requires authorization from a parent or guardian, it must be obtained before the relevant processing; merely selecting an age group or accepting community rules does not supply it. A parent or guardian can contact lndcorpgames@gmail.com about an account or privacy concern. Do not send unnecessary identity documents or sensitive details in an initial message.
10. Security and policy updates
App/API traffic uses HTTPS. The approved worker database connection uses TLS with certificate and hostname verification. Authentication, session and access checks protect private account information. These measures do not make chat end-to-end encrypted or eliminate all security risks.
We publish updates to this policy on this page and identify their document date. Material changes are communicated as appropriate to their impact and applicable requirements. Contact lndcorpgames@gmail.com if you need further information.
11. Community rules
Respect other players. No harassment, threats, hate, sexual content, exploitation, scams, spam, impersonation or disclosure of personal information. These rules apply to chat, nicknames and guild content.
Messages and player names can be reported. Block a player to stop seeing their messages as supported by the service. Reports are reviewed by authorized moderators, who may remove messages or restrict chat.
Stay safe online: you may encounter people you do not know. Do not share your real name, address, school, contact details, passwords or session tokens. Do not meet strangers from the game. Ask a trusted adult for help if you feel unsafe. Contact and appeals: lndcorpgames@gmail.com.