Privacy Policy — MG Magnific Games

Effective date: 10 August 2026
Version: 2.3
Controller: MG MAGNIFIC GAMES GmbH, Maratstrasse 29, 12683 Berlin, Germany — HRB 185966 B (Amtsgericht Berlin-Charlottenburg)

1. Who we are

We are MG MAGNIFIC GAMES GmbH ("Magnific Games", "we", "us"), a German studio registered in Berlin. We act as data controller for the personal data described here.

General contact: contact@magnificgames.com
Privacy and data-protection / DPO: privacy@magnificgames.com

2. Scope

This Privacy Policy applies to personal data we process when you use our games and services — currently the mobile game War Alliance on iOS, Android, and Windows, our websites, and our support service.

War Alliance is intended for players aged 13 and over. We do not block younger players, but the game is not designed for, and we do not actively target, young children. Where we determine that a player is under 18, we adapt our data-processing accordingly. See §5 and §10.

How to read the legal references in this policy. Unless we name a different law, "Art." refers to an article of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") — so, for example, "Art. 6(1)(b)" in §4 means GDPR Article 6(1)(b). If you are in the United Kingdom, read those as the corresponding provision of the UK GDPR. Where a legal basis or obligation comes from another instrument we name it in full at that point — the ePrivacy Directive (2002/58/EC) and its German implementation §25 TDDDG in §12, the EU Digital Services Act ("DSA") in §14, and the US Children's Online Privacy Protection Act ("COPPA") in §10 and Appendix A.3. The regional appendices name their own laws.

3. What we collect

Category	Examples
Data you give us	Display name (auto-assigned for young children), clan name and description, chat messages, support correspondence, feedback
Identity-provider data	A user identifier issued to us by Google, Apple, Facebook, or Microsoft when you sign in (no email, no profile, no friend list)
Device & environment	Device model, OS, language, screen, memory, network type, IP address (used for approximate country and rate limiting)
Advertising identifier	Apple IDFA / Google GAID — used for personalized advertising and marketing attribution only with your consent; for non-personalized (contextual) ad serving, frequency capping, and ad-fraud prevention it may be processed by our ad partners under legitimate interest (see §4 and §12)
Account & gameplay	Internal account IDs, progression, league, currency, decks, matches, replays, friends, clan membership, mail, purchase records, ad-interaction events
Inferences	A small set of internal scores used to choose which in-game offers to show you and to attribute marketing installs (profiling under GDPR Art. 4(4); no Art. 22 legal-effect decision)

We do not collect your date of birth, ID-document numbers, health records, financial-account details, biometric data, religious or political beliefs, or other special categories of personal data under GDPR Art. 9. The age-determination flow (§5) returns only an age band; the underlying age value (where collected as a fallback) is discarded immediately.

4. Why we process it, and on what legal basis

Purpose	Legal basis
Run your account and the game; match you with opponents; save your progression	Art. 6(1)(b) — contract
Process in-app purchases	Art. 6(1)(b) — contract
Keep the Service safe and fair (anti-cheat, moderation, investigation of reports)	Art. 6(1)(f) — legitimate interest
Respond to your support tickets	Art. 6(1)(b) / (f)
Measure and improve game performance; crash reporting	Art. 6(1)(f); ePrivacy consent for on-device storage where applicable
Personalize in-game offers; measure marketing attribution	Art. 6(1)(a) — consent; Art. 6(1)(f) for non-personalized measurement
Show personalized advertising	Art. 6(1)(a) — consent
Show non-personalized (contextual) advertising	Art. 6(1)(f) — legitimate interest
Determine your age band (§5) so we can apply age-appropriate processing	Art. 6(1)(c) — legal obligation under GDPR Art. 8, EU Digital Services Act Art. 28, COPPA, and equivalent laws; Art. 6(1)(f)
Comply with legal obligations (tax records, lawful requests, breach notification)	Art. 6(1)(c)
Send promotional emails (only if you opt in)	Art. 6(1)(a) — consent, withdrawable

For users we determine to be under 18, we do not rely on Art. 6(1)(a) consent for personalized advertising, attribution, or behavioral analytics — those processing activities are not carried out for that player. See §10.

5. How we determine your age band

We determine an age band — adult (18 and over), teen (13–17), child (under 13), or unknown — at first launch:

Android, where the Google Play Age Signals API is available: we ask your device through that API. Google Play returns a range, not a date of birth.
iOS 26 and later: we ask your device through Apple's Declared Age Range API for the range you declared on your Apple account. You may decline.
Otherwise, or if you declined: we ask you, in a short in-app question, for your age. We compute the band from your answer and discard the age value immediately — only the band is retained.

The age band is held on your device only. We do not transmit it to our servers and we do not store it on your account. If you re-install the game, the band is determined again. "Unknown" is treated as the most restrictive (child) and is re-checked on every launch.

The age band does not affect your eligibility to use the Service — only how we process data about you — so this is not an automated decision with a legal or similarly significant effect under GDPR Art. 22.

We share personal data only with the processors and third parties below. We do not sell your personal data.

Processors acting on our behalf, under a data-processing agreement:

Provider	Purpose
Google Cloud	Hosting, storage, backups
Google Firebase (Analytics, Crashlytics, Cloud Messaging, Remote Config, Authentication, Performance)	Analytics, crash reporting, push notifications, feature flags, authentication
AppsFlyer	Marketing-attribution measurement (only where you have consented)
Unity LevelPlay, mediating Google AdMob, Meta Audience Network, Unity Ads, and Vungle	Ad serving
Zendesk	Customer-support ticketing

Independent controllers when you interact with them: identity providers (Google, Apple, Facebook, Microsoft) for sign-in; payment platforms (Apple App Store, Google Play Store, Microsoft Store) for purchases; ad networks via LevelPlay mediation, to whom we send consent signals in the IAB Transparency & Consent Framework v2.2 format.

We may also disclose personal data where required by law, to professional advisers under confidentiality, or as part of a corporate transaction with reasonable notice where possible.

7. International transfers

Our processors are based in the EEA, the United Kingdom, the United States, and other jurisdictions. When we transfer personal data outside the EEA or UK to a country not recognized as adequate, we rely on the EU Standard Contractual Clauses (Decision 2021/914) with the UK International Data Transfer Addendum, and on the EU–US Data Privacy Framework where the recipient is certified.

8. How long we keep it

Category	Retention
Account and progression while active	Until the account is deleted or inactive
Account after a deletion request	Removed within 3 to 6 months (covers backups and processor propagation)
Chat, moderation flags, in-game mail	Part of account state; removed with the account
Purchase records	10 years (German tax law §147 AO)
Customer-support tickets	3 years from closure
Crash reports	Firebase default retention
Analytics events exported to BigQuery	26 months
Game server logs	30 days
Advertising-identifier records	Duration of consent; purged within 30 days of withdrawal
Marketing / tracking consent records	Source of truth: Google UMP (Android) and iOS App Tracking Transparency
Age band (§5)	On your device only; not stored on our servers

If you ask us to delete your data and we must keep some for a legal reason (e.g. tax records of purchases), we will tell you which categories must be kept and delete the rest.

9. Your rights

Under GDPR / UK GDPR (and equivalents under the appendices below), you have the right to:

Access the personal data we hold about you. We send it as CSV.
Correct personal data we hold about you that is factually wrong (for example, an outdated email on a support ticket). Most of the data we hold is a record of how you have played the game — that data is generated by the game itself and is not something you can "correct" in this sense.
Delete it. You can start this yourself from the in-game Options → Account Deletion, or by contacting us.
Restrict our processing.
Take it with you (portability).
Object to processing we base on legitimate interest. You have an absolute right to object to direct-marketing profiling.
Withdraw consent at any time. For adult players, you can manage your tracking and advertising consent from in-game Options → Data Preferences. For players we determine to be under 18, our processing is already restricted as described in §10 and there is no Art. 6(1)(a) consent to withdraw — the Data Preferences screen is therefore not shown to them.
Lodge a complaint with your data-protection supervisory authority. In Germany this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (https://www.datenschutz-berlin.de). For other regions, see the appendices.

To exercise any right, contact privacy@magnificgames.com. We respond within one month, extendable by two further months for complex requests. Exercising your rights is free in ordinary cases.

10. Children and teens

War Alliance is intended for players aged 13 and over. We do not block younger players, but we do not actively target them.

How we adapt to age (band determined in §5):

For players we determine to be under 18 (teens and young children):
- No personalized (interest-based) advertising — contextual ads only.
- No marketing-attribution measurement — attribution SDKs are not initialized for any under-18, worldwide.
- The advertising identifier is not transmitted for under-18s in the EEA and UK (and not for under-13s anywhere — see below). For teens (13–17) outside the EEA/UK, the contextual ads above operate on the same non-personalized basis as for adults (§4).
- No behavioral analytics or profiling for offer-selection or marketing.
- We do not solicit consent under GDPR Art. 6(1)(a), because consent obtained directly from a child or younger teen is not legally valid under GDPR Art. 8 in most Member States.

For players we determine to be young children (under 13), additionally:
- Community features (chat, clan, leaderboard, and any other feature that involves free-text or shared personal data of or about other players) are not available.
- The display name is automatically assigned (for example Player_XXXX) and cannot be edited.
- In matches, other players' display names and clan names are shown as anonymized labels.
- No advertising identifier, behavioral-analytics identifier, or marketing-attribution identifier is collected, used, or transmitted. The only identifiers we use for a young child are the internal account ID and the device-vendor identifier (Apple IDFV / Android ID) required to save and restore that child's progress on their device — these are not advertising identifiers and are not used to track across apps. This is consistent with the "internal operations" exception under COPPA (16 CFR 312.5(c)(7)).
- Advertising signals are tagged as child-directed, so ad networks apply their own child-directed restrictions on top of ours.
- Marketing-attribution SDKs are not initialized.
- Where any personal data of a young child is processed by one of our service providers (for example, for save synchronization or anonymous crash diagnostics), that service provider is bound by contract to process the data only on our instructions and not to repurpose it for its own use.

We do not operate a verifiable-parental-consent flow under COPPA, GDPR Art. 8, or equivalent laws. Our approach is to restrict the processing of young children's personal data to what is strictly necessary to provide the game, rather than to seek parental consent to expand it.

If you are a parent or guardian and you believe a young child has provided personal data to us, contact privacy@magnificgames.com and we will look into it and delete what we hold.

11. How we protect it

We apply technical and organizational measures to protect personal data — encryption in transit, role-based access, vendor due diligence, security testing, staff training, and an incident-response process. If a personal-data breach is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours under GDPR Art. 33 and, where the risk is high, notify affected users under Art. 34.

12. Cookies and similar technologies

Our websites at https://www.war-alliance.com and https://www.magnificgames.com run on the Weebly platform; any cookies set there are operated by Weebly under its own terms.

Inside the mobile game, we use SDK identifiers and on-device storage as described in §3. Where this storage and access is not strictly necessary to provide the Service — for example, analytics, personalized-advertising identifiers, or cross-app attribution — we rely on your consent under Art. 5(3) of the EU ePrivacy Directive and its German implementation (§25 TDDDG / former TTDSG). A limited set of advertising-identifier processing — non-personalized (contextual) ad serving, frequency capping, and ad-fraud prevention — is carried out by our ad partners on the basis of legitimate interest (§4); you can limit it through your device's ad-tracking controls (iOS "Allow Apps to Request to Track" / Android "Delete advertising ID"). Strictly-necessary storage (for example, your local progress save or your language setting) does not require consent. Your consent is managed through our in-game consent manager (see §9).

13. Changes to this policy

For non-material changes we will update the effective date. For material changes we will notify you in-game, on the website, and where legally required seek your renewed acceptance before the change takes effect.

14. Contact

Privacy / data-subject rights / DPO: privacy@magnificgames.com
General: contact@magnificgames.com
Legal / DSA point of contact (DSA Art. 11 and Art. 12): legal@magnificgames.com

MG MAGNIFIC GAMES GmbH, Maratstrasse 29, 12683 Berlin, Germany. Our DSA point of contact handles communications in English and German, and can be reached directly by a person — we do not rely solely on automated tools.

Appendices — regional notices

A. United States

A.1 California (CCPA / CPRA)

We collect identifiers, commercial information, internet/network activity, inferences (offer-selection and marketing-attribution scores), and customer-service records; we use them for the purposes in §4 and retain them per §8. We do not sell personal information. We do "share" personal information for cross-context behavioural advertising in the CPRA sense, but only where you have consented. You can opt out at any time via Options → Data Preferences or privacy@magnificgames.com. You have the right to know, delete, correct, opt out of sale/share, limit sensitive PI, and not be retaliated against for exercising these rights. Authorized agents may submit requests with signed authorization.

A.2 Other US states

If you reside in a US state with a comprehensive consumer-privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Montana, Oregon, Iowa, Tennessee, Indiana, Delaware, Florida and others), you have rights broadly similar to those above. Email privacy@magnificgames.com.

A.3 Children — COPPA

War Alliance does not refuse access on age grounds. For users we determine to be under 13 (§5), we restrict the personal information we collect, transmit, or display to what is necessary to support the internal operations of the Service, consistent with 16 CFR 312.5(c)(7). We do not operate a verifiable-parental-consent workflow. If you believe a child under 13 has provided personal information to us beyond what §10 describes, email privacy@magnificgames.com and we will delete it.

B. United Kingdom

The UK GDPR and the Data Protection Act 2018 apply in place of the EU GDPR for users in the UK; your rights and our obligations are materially the same. Supervisory authority: the Information Commissioner's Office, https://ico.org.uk.

C. South Korea (PIPA)

Your separate consent for collection and use, transfer to overseas processors in §6, and optional marketing use is obtained as required. Refusing optional consent does not affect the Service. The personal-information manager can be reached at privacy@magnificgames.com. Supervisory authority: the Personal Information Protection Commission (PIPC), https://www.pipc.go.kr.

D. Brazil (LGPD)

The encarregado can be reached at privacy@magnificgames.com. Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD), https://www.gov.br/anpd.

E. Turkey (KVKK)

Supervisory authority: Kişisel Verileri Koruma Kurumu (KVKK), https://www.kvkk.gov.tr. Where the threshold for VERBIS registration or a local representative is reached, we will complete the registration and update this appendix.

F. Japan (APPI)

Your rights under APPI are broadly equivalent to those in §9. Supervisory authority: Personal Information Protection Commission of Japan (PPC), https://www.ppc.go.jp.

PRIVACY POLICY