Privacy Policy

1. Information we collect

We collect information needed to provide the Service, plus optional advertising-measurement data when you give permission as described below:

• Account data — the email address, username and password (stored only in hashed form) you provide when you register.
• Gameplay data — your characters, progress, items, in-game chat and actions needed to run the world.
• Technical data — device, browser, approximate region and connection details, and logs used for security and debugging.
• Payment data — if you buy a Premium subscription, our payment processor handles your card or payment details; we receive only a confirmation and limited billing information, never your full card number.
• Support data — messages you send us and any information you include in them.

2. How we use your data

We use your data to:

• Create and manage your account and characters, and run the game world.
• Process Premium subscriptions and other purchases.
• Keep the Service safe — detecting cheating, fraud, abuse and technical problems.
• Provide support and respond to your requests.
• Improve and balance the game, and understand how it is used.
• Send occasional play reminders if you opted in at registration and have been inactive — you can unsubscribe anytime via the link in those emails.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal bases

Where the GDPR or similar laws apply, we process your data to perform our contract with you (providing the game), on the basis of our legitimate interests (security, abuse prevention and improving the Service), to comply with legal obligations, and — where required — with your consent, which you can withdraw at any time.

4. How we share data

We do not sell your personal data. We share it only with trusted service providers who help us run the Service — such as hosting, content delivery and payment processing — under contracts that require them to protect it; with authorities when required by law or to protect our rights and players' safety; and in connection with a business transfer such as a merger or acquisition. Note that in-game information such as your character name and public chat is visible to other players.

We use Meta App Events and our server to measure ads that bring players to Tikal Online. Android measurement starts automatically and can be turned off in Options. On iOS, Apple’s tracking permission controls measurement. Meta receives app-instance and technical app information, installation/activation, registration, and verified first Premium upgrades and paid coin-pack purchases (product, amount and currency). Android does not collect advertising identifiers; iOS may share its advertising identifier when Apple permits it. A real ad-click code can pass from our website through Play Store installation. The app shares matching information only while measurement is enabled. Server matching information is kept for 30 days, purchase matching claims for 7 days, and conversion delivery records for 90 days; account deletion removes them. We do not send Meta account names, emails, Apple or Google login tokens, character data, chat or store receipt identifiers. See Meta’s Privacy Policy. Turning measurement off does not prevent login, play or purchases. On iOS, change permission in Settings → Privacy & Security → Tracking. In the browser, Meta measurement starts automatically and can be turned off in Options. While enabled, we store a real Meta ad-click code in a first-party cookie for up to 30 days and send browser user-agent information with server-confirmed registrations and verified purchases. Turning it off clears the click cookie and removes server matching on the next authenticated connection, without affecting play. We do not create click codes for organic visits.

We use Google Analytics and Firebase Analytics to measure completed registrations, paid Premium activations and purchases in Tikal Online. Google receives app or browser installation identifiers and verified product, transaction, amount and currency details. Conversion measurement follows the campaign measurement preference. Ad personalization stays off. Android advertising identifier collection is disabled, and advertising storage stays denied on web and Android. On iOS, this integration runs only after Apple tracking permission is granted; it does not collect IDFA. No email, password, chat or payment card details are sent by this integration. Apple permission can be withdrawn in iOS Settings. Purchases and gameplay remain available without tracking.

5. Cookies & local storage

The website and game use cookies and local storage to remember your chosen language, keep you signed in and provide essential features. The optional Meta measurement described above requires a separate iOS tracking permission. Clearing browser storage does not change that iOS permission. You can clear or block browser storage, though some features may then stop working.

6. Data retention

We keep your data for as long as your account is active and for as long as needed for the purposes above — for example to comply with legal, accounting or security obligations. When you delete your account, we remove or anonymise your personal data within a reasonable period, except where we must keep some of it by law.

7. Security

We use reasonable technical and organisational measures to protect your data — including hashed passwords and encrypted connections. No system is perfectly secure, however, so we cannot guarantee absolute security. Please use a strong, unique password and keep it private.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and request a copy.
• Correct data that is inaccurate or incomplete.
• Delete your account and personal data.
• Object to or restrict certain processing, and withdraw consent.
• Request portability of the data you provided to us.

To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with your local data-protection authority.

9. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with data without appropriate consent, contact us and we will delete it.

10. International transfers

Tikal is played worldwide, so your data may be processed in countries other than your own, including where our servers and service providers are located. Where required, we use appropriate safeguards to protect your data when it is transferred internationally.

11. Changes to this Policy

We may update this Policy from time to time. We will update the "last updated" date and, for material changes, notify you in-game or on the website. Please review it periodically.

12. Contact us

For any privacy question or request, contact us at privacy@tikal.online.