Battle Minis privacy policy
Updated October 11, 2026. Battle Minis is provided by Tappy Games. Contact support@tappygames.com about your data or to request assistance.
Data used to run the game
We store your account and installation identifiers, commander name and avatar, game progress, inventory, matchmaking ratings, battle records, and saved artwork. If you verify an email, we store it for account recovery and security messages. Verification codes are stored as keyed hashes and expire after ten minutes. App credentials are stored in the iOS Keychain or encrypted Android storage on supported builds.
If you enable notifications we may store a device push token. Server requests include network information used for delivery, security and abuse prevention. We do not need your contacts or precise location.
Visibility and service providers
Your commander name, avatar, ranking and battle activity may be visible to opponents and on leaderboards. Email and authentication secrets are not public. Fly.io hosts the game server and database; Upstash provides Redis; Tigris stores game assets and saved artwork. Postmark delivers account emails. Security emails have open and link tracking disabled. Apple and Google provide app distribution, purchase processing, and platform services.
Retention and deletion
Account data is retained while the account is active. You can request deletion in Settings. Access ends immediately; removal waits for any live battle to finish. Shared battle records are de-identified to preserve opponents' results. Saved-artwork removal is retried if storage is temporarily unavailable. Operational backups may retain prior data until their retention period expires; the current database snapshot policy is five days. We retain a minimal account-ID deletion receipt in separate storage to prevent restoration from bringing back a deleted account. It contains no email, artwork or game progress. A restore must reapply these receipts before returning to service.
Gameplay measurements
For authenticated online players, we record active UTC dates and whether the tutorial was completed. We use these minimal records to measure onboarding and return visits. They are retained for 30 days and removed when the account is deleted. Connection events and their match IDs are retained for the same period to diagnose interrupted games. We do not send raw local analytics, advertising identifiers, or message contents to this service.
Operational diagnostics
We retain numeric service-health samples, error categories, app build numbers, and currency-change audit records for up to 30 days to diagnose failures and prevent abuse. Diagnostics do not include raw error messages, receipt payloads, passwords or verification codes. Currency audit records are deleted with the account. Staff access is role-restricted and audited.
Your choices
Protect your account with a verified email, turn notifications off in Settings or device settings, and contact support for access, correction, or deletion assistance. Account-security emails are separate from optional promotional messages. We do not subscribe verified players to marketing campaigns by default.
Purchases and advertising
Where purchases or ads are enabled, the platform or advertising provider handles the payment or ad interaction. We do not receive full payment-card details. Available ad privacy choices appear in Settings; device privacy controls also apply. Google AdMob may process IP address, device and advertising identifiers, interactions and diagnostics to deliver and measure ads and prevent fraud. Where required, we request consent before requesting ads; privacy choices can be revisited in Settings. Tracking authorization is requested separately on iOS. See Google's privacy policy. We verify Apple App Store and Google Play purchase records and Google ad reward callbacks on our server. RevenueCat processes verified App Store and Google Play transactions, pseudonymous player IDs, product IDs, prices, currencies and refunds for purchase reporting and lifecycle monitoring. We do not send RevenueCat your email, artwork, advertising ID or payment-card details. Signed transaction proofs are encrypted while awaiting delivery and removed from the delivery queue after acknowledgment. See RevenueCat’s privacy policy. Minimal transaction IDs, pseudonymous account IDs, product/reward identity and fulfillment/revocation records are retained after account deletion to prevent duplicate grants and payment fraud; they contain no payment-card details or email.