ForgeRival Game Privacy Policy

You can sign in with Apple or Google, or play the offline Tour as a guest. A guest has no account, and guest progress stays on the phone. Phone sign-in is not available.

When you sign in, our sign-in service, Supabase, stores your account ID with Apple or Google, which of them you used, and your email address. If you use Apple’s Hide My Email, we get the relay address Apple makes instead of your real address. Google also sends the name and profile photo link on your Google account. We do not use or show them in the game.

Your profile holds the online player name the game makes for you, your year of birth if you give it, your language and the dates of your account. We use your year of birth only to apply the protections for younger players. If you skip the question, we treat you as under 18. A year of birth can be set once. To correct it, email support.

The game does not ask for access to your photos, contacts, camera, microphone or location.

Your phone stores your game progress, settings and sign-in session. The session is kept in the iOS Keychain or Android secure storage.

When you are signed in, we keep a cloud save so your progress follows your account to another phone. It holds your progress, coins, bots, upgrades, builds, looks, bot nicknames, Tour results, stars, missions, Forge Pass progress, Lucky Box tickets, rewards, game totals and which offers you have seen. It also notes the save’s version, when it changed, and a random ID and the type (iPhone or Android) of each phone that saved it.

For players aged 18 and over, the phone also keeps a short log of game events. It stays on the phone and is never sent to us. Your settings and this log are never part of the cloud save.

Online fights run on our match server, on Google Cloud in Oregon, USA. Online play needs an account.

The match server keeps a record of your online pilot: your account ID, the player name the game made for you, your rating, your wins, losses and draws, and when you joined and last played. For each match it keeps both players’ IDs, the bots, the result, how the match ended, how long it took and the rating changes. Your controls and the state of the fight pass through the server while you play.

Opponents see your player name, bot, looks and rank. Our match server also publishes a public list of the top 50 online players: player name, rating, games played, wins and rank. Anyone on the internet can see it. The game does not show this list.

If the same phone has a guest online record, it moves to your account (name, rating and history) the first time you play online after signing in.

When you delete your account, the match server deletes your online record within about 10 minutes and removes your ID from past matches. Your opponents keep their own side of those matches.

Real money buys gem packs and one-time bonus packs. Forge Club, a monthly subscription, is not on sale yet. Apple’s App Store or Google Play takes the payment. RevenueCat, our purchase service, checks each purchase and links it to your ForgeRival account ID so it follows your account.

For each purchase or refund, we keep the store, the product, the transaction and event IDs, the price and currency, the store country, the dates, the subscription status where there is one, and the store’s event details. Your gem history records each credit, spend and refund, with the reason and your balance.

We never receive your card number, UPI details or bank details. Apple and Google handle payment details under their own privacy policies.

ForgeRival Live is an optional sign-up for news about a possible real-world robot championship. Signing up needs an account. The form asks for your email and, if you want, your name, your city or state and your team name. It also asks whether you would compete, build, volunteer or watch. We store your answers, when you agreed, and whether you confirmed or withdrew. Your city or state is only what you type; the game does not use GPS.

If you are under 18, or have not given your year of birth, you must also give a parent’s or guardian’s email, and they must agree.

We email a link to confirm the address: yours, or your parent’s or guardian’s for an under-18 entry. Until that link is used, we send nothing else about ForgeRival Live. Confirmation emails are not switched on yet. Until they are, your entry is saved and no email is sent.

Signing up does not enter you in any contest and does not promise an event, a place or a prize. You can withdraw or erase your details at any time in the game: Settings → ForgeRival Live.

If you email us, we use what you send only to answer you. Please send only what we need. Email to support@forgerival.com is forwarded by Cloudflare Email Routing to our Gmail inbox, where we read and answer it. Email to our Grievance Officer goes straight to Gmail. We keep support emails only as long as we need them to handle your request.

Our account deletion page, forgerival.com/delete-account, is hosted by Cloudflare. It signs you in through Supabase and keeps your session only while the page is open. During Google sign-in it keeps a one-time code in your browser’s storage and removes it when you return.

Supabase, RevenueCat, Google Cloud and Cloudflare see your IP address when your phone or browser connects to them. They may keep it in short-term technical and security logs under their own settings. Our match server’s log records match events with player names. Rarely, it also records the IP address of a connection it closes for sending too many messages. That log is cleared whenever the server is updated. Our account functions log only counts and random IDs, never your email.

We do not use your IP address to work out where you are.

We use your data to:

• sign you in and keep your progress safe in the cloud;
• run online fights and ratings, and publish the top-50 list;
• deliver what you buy, restore purchases and handle refunds;
• apply the protections for younger players;
• stop cheating and keep the game secure;
• send the ForgeRival Live emails you asked for;
• answer support requests and show that we handled deletion requests.

For players aged 18 and over, the game uses your purchase history to choose which offers to show first. Prices are the same for everyone.

We do not sell your data. We do not use or share it for advertising. The game has no ads and no advertising tracking.

Where India’s Digital Personal Data Protection Act, 2023 applies, we rely on your consent. You give it when you create an account or sign up for ForgeRival Live. You can withdraw it at any time: delete your account (Settings → Account → Delete account, or forgerival.com/delete-account), withdraw from ForgeRival Live (Settings → ForgeRival Live), or email support@forgerival.com. Withdrawing does not affect what we did before.

Where the EU or UK GDPR applies, we use your data to provide the game you asked for (contract), to keep the game fair and secure (legitimate interests), to keep records the law requires (legal obligation), and for ForgeRival Live emails (consent).

These providers process data for us to run ForgeRival. Apart from Gmail, we share data only with providers whose contracts or data protection terms require them to protect it at least as well as this policy does, and to use it only to provide their service. Apple and Google also act on their own for their sign-in and store services, and Google does so for Gmail, which hosts our support inbox, under their own privacy policies. RevenueCat’s software in the app also receives basic technical details, such as the app version, device type and store country, to handle purchases. We do not ask it to collect advertising IDs.

We may also share data when the law requires it.

Supabase stores our account data in Sydney, Australia. The match server runs on Google Cloud in Oregon, USA. RevenueCat is based in the USA. Apple, Google and Cloudflare run their services in many countries. So your data may be processed outside your country, including outside India.

Where the law requires safeguards for these transfers, we rely on the data protection terms these providers offer, including standard contractual clauses where they apply. Email support@forgerival.com to ask about them.

• The app, our website and our match server use encrypted connections (HTTPS and secure WebSockets).
• Your sign-in session is kept in the iOS Keychain or Android secure storage.
• Our database lets each signed-in player read only their own records.
• Our service keys stay on our servers. They are never part of the app.
• We never receive your card, UPI or bank details.

No system is perfectly secure. If a data breach affects you, we will tell you and the authorities as the law requires.

• Account, profile, cloud save, gems, purchase records and items: until you delete your account. Then they are deleted straight away, or within 30 days if one of our services is down.
• Online record: until you delete your account. Past matches stay, with your ID removed.
• ForgeRival Live entry: until you erase it in the game or delete your account. Withdrawing stops the emails; your details stay until you erase them.
• Deletion record: a random account ID and the time of each step, kept while ForgeRival runs to show the deletion was done. The match server also keeps the deleted account ID, so an old sign-in cannot bring your online record back.
• Support emails: as long as we need them to handle your request.
• Store records: Apple and Google keep their own records of your purchases under their own policies.
• Backups: if a provider keeps backups, deleted data stays in them only until those backups are replaced.

We do not delete inactive accounts. Your account and cloud save stay until you delete your account.

ForgeRival is for players aged 13 and over. Players under 18, and players who have not given a year of birth, get extra protections:

• no pop-up offers, no offer countdowns and no offers chosen from purchase history;
• no gem packs or one-time packs above ₹199 in the app (or the same price level in other currencies);
• no Forge Club;
• a reminder when their spending in a month reaches ₹500, and again at ₹1,000 (or a similar amount in other currencies);
• no game-event log on the phone.

The game does not ask for a parent’s or guardian’s consent at sign-up yet. Before we switch this on, we will update this policy. ForgeRival Live is different: it needs a parent’s or guardian’s email and agreement, as described above.

If a player’s year of birth shows they are under 13, the game asks them to play together with a parent or guardian. Parents can limit purchases with Screen Time on iPhone or Family Link on Android. A parent who wants a child’s account deleted can use forgerival.com/delete-account or email support@forgerival.com.

Depending on where you live, you can ask to see your data, correct it, delete it, ask us to limit (restrict) how we use it, or get a copy. You can also withdraw your consent and object to some uses. In India, you can also nominate someone to use these rights for you if you die or become unable to.

To make a request, email support@forgerival.com. You, or someone you authorise, can make a request. To protect your account, we will ask you to write from the email address on your account, or to sign in on our deletion page. If someone asks for you, we will also ask for proof that you authorised them. We acknowledge requests within 24 hours and reply within 15 days. Using your rights is free, and we will not treat you differently for using them.

In the EU or UK, you can also complain to your local data protection authority. In California, you have the right to know, delete and correct your data. We do not sell or share personal information for advertising.

In India, please contact our Grievance Officer first (see below).

In the game, open Settings → Account → Delete account, read what will be deleted, then tap Delete account again. Or use our deletion page, forgerival.com/delete-account: sign in with Google or with a code sent to your email, then confirm. If you cannot use either, email support@forgerival.com from the address on your account.

Deleting your account removes your sign-in, your profile (player name, year of birth, language), your cloud save, your gems and their history, your purchase records and items, and your ForgeRival Live entry. It also deletes your customer record at RevenueCat, our purchase service. The match server deletes your online record within about 10 minutes. Deletion normally happens straight away. If one of our services is down, we finish it within 30 days. We keep a deletion record (a random account ID and the time of each step) to show it was done.

Deleting your account does not cancel a store subscription; cancel it in the App Store or Google Play. Progress saved on your phone stays there. To remove it, uninstall ForgeRival. Your phone’s own backups (iCloud on iPhone, Google backup on Android) may keep a copy until those backups are replaced or you delete them in your phone’s settings.

For any privacy question or request, email support@forgerival.com.

Under India’s Information Technology Rules, 2021 and the Digital Personal Data Protection Act, 2023, our Grievance Officer handles complaints about ForgeRival and about how we handle your data.

Grievance Officer: Lakshay Bhati
Email: lakshayybhati06@gmail.com
Location: New Delhi, Delhi, India

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are in India and are not satisfied, you may complain to the Data Protection Board of India once it accepts complaints.

We will update this policy when the game or the law changes, and post the new version here with a new date. For an important change, we will tell you in the game or by email before it applies, and ask for your consent again where the law requires it.