Elementals — Privacy Policy

Version 2.1 — effective from 2026-09-03. Last updated: 2026-10-10.

Languages: English (this page) · Polski — Polityka prywatności · Português — Política de Privacidade · Español — Política de privacidad See also: Terms of Service (EN) · Regulamin (PL) · Termos de Serviço (PT) · Términos de servicio (ES)

Consumers in Poland: the Polish version (Polityka prywatności) governs. This English text is a convenience translation; if the two differ, the Polish text prevails. Everyone else: this English text is the reference version. Where the Polish, Portuguese or Spanish translation differs from it, the English text prevails, unless the mandatory law of the country where you live requires otherwise.

Elementals (the "Game", "the app") is a monster-battling game for Android. This policy explains what personal data we collect, why, what we do with it, how long we keep it, and what you can tell us to do about it. It is written to be read, not to be survived — if anything in it is unclear, write to us and we will explain it.

The short version. To play, you need an account, so we store your email address (or your Google Play Games profile) and your game progress on our server. If you buy something or watch a rewarded ad, we keep a record of it. Crash reports help us fix bugs. Analytics and ads only run if you agree to them in the consent form the app shows you. We do not sell your data, we show no ads unless you tap to watch one, and you can delete your account from inside the app at any time.

1. Who we are

1.1. The controller of your personal data is Krzysztof Gruszczyński, a sole trader registered in Poland (CEIDG), ul. Powstańców Śląskich 176/30, 53-139 Wrocław, Poland, NIP 6351826533, REGON 525095630 (the "Provider", "we", "us").

1.2. You can reach us at support@elementals.pl. Use that address for anything in this policy: questions, data requests, complaints.

1.3. We are a one-person operation and are not required to appoint a Data Protection Officer, so we have not appointed one. Your requests go to the address above and are handled by the developer personally.

2. What we collect, why, and on what legal basis

Everything we collect is listed below. Where a legal basis is named, it refers to Article 6(1) of the GDPR (Regulation (EU) 2016/679).

2.1. Account data — to give you an account

Your email address and a hash of your password (we never store the password itself), or — if you use Google Play Games sign-in — your Play Games player ID (section 2.1.1); plus the username you choose.

Signing in with a Google account is no longer offered. If you linked a Google account to your Elementals account before the option was withdrawn, we still hold your Google account identifier and the email address on it. They are used for nothing new, and we keep them only until you delete your account (section 8).

Account emails (address verification, password reset, change of email address) are sent on our behalf by Brevo (section 5).

Purpose: creating your account, signing you in, recovering access, and contacting you about your account. Legal basis: Art. 6(1)(b) — performance of the contract you enter into by accepting the Terms of Service.

2.1.1. Google Play Games sign-in. If you use Google Play Games sign-in, we receive your Play Games player ID and display name from Google. We use the player ID to sign you in and to restore your account on a new device, and the display name only to suggest a username when you create your account. We receive no email address through Play Games. You can unlink Play Games in Profile → ACCOUNT → UNLINK PLAY GAMES at any time you have another way to sign in (a password), and the player ID is removed when you delete your account (section 8).

2.2. Gameplay data — to run the game

Your pets and their nicknames, levels and stats; fights and their outcomes; breeding history; in-game currency; quests and daily-reward streaks; your activity feed; zone progress.

The Game is server-authoritative, which means this data has to live on our server: it is the game state, not a copy of it.

Purpose: providing the Game. Legal basis: Art. 6(1)(b) — performance of the contract.

2.3. Purchase records — to deliver what you bought, and to keep books

For each purchase made through Google Play Billing: the Google Play order identifier, a reference to the purchase token, the product bought, and the status of the purchase (verified, refunded, revoked). We never see or store your card number, bank details or billing address — those stay with Google.

Purpose: verifying the purchase server-side, granting the item, handling refunds and chargebacks, and keeping the accounting records we are obliged to keep. Legal basis: Art. 6(1)(b) — performance of the contract; and Art. 6(1)(c) — compliance with a legal obligation (Polish tax and accounting law).

2.4. Rewarded-ad grants — to pay out the reward once

For each rewarded ad you choose to watch: the AdMob transaction identifier, the ad placement, the reward amount and the time it was granted.

Purpose: making sure the reward is granted exactly once, enforcing the daily cap, and detecting attempts to farm rewards fraudulently. Legal basis: Art. 6(1)(b) — performance of the contract (we owe you the reward); and Art. 6(1)(f) — our legitimate interest in preventing fraud and abuse of the reward system.

2.5. Crash reports and device information — to fix what breaks

When the app crashes, Google Firebase Crashlytics sends us a crash report: the stack trace, the device model, the Android version, the app version, the amount of free memory and similar technical state, together with a Crashlytics installation identifier.

Purpose: finding and fixing crashes and bugs. Legal basis: Art. 6(1)(f) — our legitimate interest in keeping the Game working. We have weighed this against your interests: a crash report describes what the software did, not what you did, and it is not used to build a profile of you or to target you with anything. You can object to this processing (section 7).

2.6. Usage analytics — to see which parts of the Game are used

Google Firebase Analytics records events such as signing up, starting and finishing a fight, breeding, and completing a purchase, together with a pseudonymous app-instance identifier, your player account ID (a random identifier, set as the Analytics user ID while you are signed in) and coarse technical context (device model, OS version, country). No names and no email addresses are sent to Analytics.

Purpose: understanding which features are used and where players get stuck, so we can improve the Game. Legal basis: Art. 6(1)(a) — your consent. Analytics is collected only when you consent: the app reads your answer in the in-app consent form (Google's User Messaging Platform) and collects analytics only if you agreed to the purpose it falls under. If you decline, no analytics is collected. You can change your mind at any time (section 7).

2.7. Advertising — only the ads you ask for

The Game shows rewarded ads only, and only when you explicitly tap to watch one in exchange for an in-game reward. No banners, no interstitials, nothing that interrupts play. Every reward available through an ad is also reachable without watching one.

When you tap to watch, Google AdMob serves the ad and may process your device's advertising ID, device and network information, and your interaction with the ad, in order to select, deliver, cap and measure it. In the EEA, the UK and Switzerland, personalised ads are shown only if you agreed to them in the consent form; if you did not, you get non-personalised ads, which still use limited data to serve and measure the ad and to prevent fraud.

Purpose: delivering and measuring the rewarded ad you asked for, and financing the Game. Legal basis: Art. 6(1)(a) — your consent, given in the consent form and withdrawable at any time (section 7).

See Google's Privacy Policy and AdMob's data disclosure for what Google does as part of serving ads.

2.8. Your age bracket — to keep advertising age-appropriate

At sign-up we ask which age bracket you are in: Under 13, 13–17, or 18+. Under 13 cannot create an account. The answer is stored on your account, alongside your username and email address.

Purpose: tagging ad requests as directed to a minor where that applies, so that Google serves only ads suitable for a teenager. Keeping the answer on the account rather than on one phone is what makes that tagging survive a reinstall or a move to a second device.

Legal basis: Art. 6(1)(f) — our legitimate interest in age-appropriate advertising and in protecting minors. That interest is what the Google Play Families policy and the AdMob programme policies require of us as the app's publisher, so the same processing also serves a legal obligation under Art. 6(1)(c).

How we handle it:

• it is shown only to you, on your own profile — never to another player;
• it is part of the copy of your data you can export (section 7);
• it is erased with your account (section 8), like your username and address;
• it can only be made more restrictive, never less: an account marked 13–17 cannot be moved to 18+ from the app;
• once your account carries an answer, we do not ask again: a reinstall or a second device reuses it. If your account was created before we started asking, the app asks you once per installation after you sign in — and you can decline; declining is remembered on that device only.

2.9. Summary table

3. Do you have to give us this data?

3.1. Account data and gameplay data: yes, if you want to play. Providing them is a contractual requirement. Without an email address (or a Google Play Games profile) we cannot create an account, and without an account the Game does not work — it has no offline mode.

3.2. Purchase records: yes, if you buy something. We are legally required to keep them once a purchase happens.

3.3. Analytics and advertising: no. Both are optional and consent-based. If you decline them the Game works exactly the same; you simply cannot earn the optional ad rewards, because there is no ad to watch.

3.4. Crash reports: collected on our legitimate interest, and you can object (section 7).

4. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws such as the California CPRA. Nobody pays us for your data. The only money involved is the ad revenue Google pays us for ads you chose to watch, and Google's own use of the advertising ID for that is described in section 2.7 and happens, in the EEA, the UK and Switzerland, only with your consent.
• We do not send push notifications from a server. We run no messaging campaigns and hold no push token for you. The app does show a few reminders scheduled on your own device — a breeding that is ready to hatch, your daily reward, the weekend event — but only if you allow notifications: on Android 13 and later the app asks for the notification permission (POST_NOTIFICATIONS), and if you decline or later switch it off in Android's settings, no reminder is shown. These reminders are created and shown locally; nothing about them is sent to us or to anyone else.
• We make no automated decisions that produce legal or similarly significant effects about you, and we do not profile you within the meaning of Art. 22 GDPR. Nothing in the Game decides anything about you outside the Game.
• We do not use your data to train machine-learning models.
• We do not collect your precise location, your contacts, your photos, your microphone or your camera. The app asks for none of those permissions.

5. Who else sees your data

5.1. We do not disclose your data to anyone except the service providers (processors) we need in order to run the Game:

5.2. Apart from the providers in the table above there are no other recipients. We do not pass your data to advertisers, data brokers, analytics networks or anyone else. We would disclose data to a public authority only where the law obliges us to, and only to the extent it obliges us.

5.3. Transfers outside the EEA. Our server and database are hosted in the region named above. Railway Corp. is a company established in the United States, so hosting with it can involve a transfer of personal data to the United States even though the servers are in the EU; we rely on the data processing agreement with Railway, which incorporates the European Commission's Standard Contractual Clauses and, to the extent Railway is certified, the EU–US Data Privacy Framework, as the safeguard. Brevo is a French company and processes account emails in the EU. Your contract for the Google services listed here is with Google Ireland Ltd., in the EU, but Google may transfer data to the United States and other countries as part of running them. Google relies on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses as the safeguard for those transfers. You can ask us for more detail, and Google's own transfer terms are published at https://business.safety.google/privacy/.

6. How long we keep it

6.1. We keep data only as long as the purpose it was collected for lasts. A job runs every night at 03:00 and deletes whatever has passed its window.

6.2. The event history. Under the hood, the Game records every action as an append-only event log — that log is the state of the game, and it is not rewritten when you delete your account. What it holds about you is this:

• a random player identifier, which after deletion no longer resolves to a person;
• no email address. Early versions of the Game (before July 2026) wrote the email address into the account-creation event; a one-off data migration removed it from every stored event, and current versions never write it;
• the username you chose, inside the account-creation event;
• no pet nicknames. The fight-start record keeps each side's line-up, and the nicknames you gave your pets were written into it (and into the rename event and fight snapshots). When you delete your account, those nicknames are now also removed from the stored events, so the history keeps the pets' species and stats but not the names you typed. Accounts deleted before this change were cleaned in the same way by a one-off data migration (October 2026). Detailed turn-by-turn fight events are pruned after a short period; the start and end records are not.

The readable copies — your profile, credentials, pets, activity feed and mail records — are anonymised or deleted as described in section 8. We treat what remains in the event history as a proportionate application of Art. 17(3) GDPR — erasure that would require destroying the integrity of the record itself — and it is why we describe the outcome as anonymisation of your account rather than deletion of every byte. If the username in that history worries you, write to us and we will look at it.

6.3. The purchase and reward ledgers deliberately outlive the account, for the tax and chargeback reasons in section 2.3. Once your account is anonymised they no longer identify you.

7. Your rights

Under the GDPR you have the following rights. All of them are free, and we answer within one month.

• Access (Art. 15) — ask what we hold about you and get a copy. Write to support@elementals.pl and we send it.
• Rectification (Art. 16) — have wrong or incomplete data corrected. You can change your username and pet nicknames yourself in the app.
• Erasure (Art. 17) — have your data deleted; see section 8, and see 6.2 for what happens to the event history.
• Restriction (Art. 18) — have us pause processing while a dispute about accuracy or lawfulness is resolved.
• Portability (Art. 20) — get the data you gave us in a machine-readable form. Open Profile → PRIVACY & DATA → EXPORT MY DATA in the app: it prepares a JSON file with your account data and hands it to the share sheet, so you can save or send it wherever you like. You can also ask us by email and we send the same file.
• Objection (Art. 21) — object to processing based on our legitimate interest, which here means crash reporting, the fraud checks on ad rewards, and the age bracket held for ad tagging (section 2.8). Tell us why and we will stop unless we have compelling grounds that override your interests.
• Withdraw consent (Art. 7(3)) — for analytics and ads, at any time, without affecting what was lawful before you withdrew it. Open Profile → PRIVACY & DATA → AD PRIVACY SETTINGS in the app to reopen the consent form and change or revoke your answers. You can also reset or delete your advertising ID in Android's own settings (Settings → Google → Ads).

Complaints. If you think we have handled your data unlawfully you can complain to the Polish supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych ul. Stawki 2, 00-193 Warszawa, Poland https://uodo.gov.pl

You may also complain to the supervisory authority of the EU country where you live or work.

To exercise any right, write to support@elementals.pl. We may ask you to confirm you control the account's email address, so that we do not hand your data to someone else.

8. Delete your account

8.1. In the app: open Profile → PRIVACY & DATA → DELETE ACCOUNT and confirm. The deletion runs immediately; no waiting period, no email exchange, no need to contact us.

8.2. By email: write to support@elementals.pl from the address on your account and ask us to delete it. We will do it and confirm.

8.3. What is deleted:

• your username and email address, in both your profile and your credentials, are replaced with a meaningless placeholder (the event history is covered in section 6.2);
• your password hash is blanked and any link to your Google account or Play Games profile is severed;
• every sign-in token you hold is invalidated and the token rows are deleted, so the account cannot be signed into again;
• every nickname you gave a pet is cleared, in your roster and in the stored event history;
• the age bracket you answered (section 2.8) is cleared;
• your whole activity history is deleted;
• the delivery records of every account email we sent you — verification, password reset, change of address — are deleted, including any that had not been sent yet, so nothing goes out to the address after you have left.

8.4. What is kept, and why:

• Purchase records, rewarded-ad grants and daily-reward claims, for 5 years, as evidence for tax enquiries and chargebacks. They are keyed to the anonymised account and no longer identify you.
• Fight records, for 730 days after the fight, because they are also part of your opponents' history.
• Pets and game state, in anonymised form, because the fight history refers to them. They carry no name or free text once nicknames are cleared.
• The append-only event history, as described in section 6.2: a random identifier and your past username. It holds no email address and, since nicknames are scrubbed on deletion, no pet nicknames.

8.5. The same erasure runs automatically on any account left unused for 730 days, on exactly the same code path.

8.6. Deleting your account does not refund purchases. Refunds are handled by Google Play — see section 9 of the Terms of Service.

9. Children

9.1. The Game is not directed at children under 13 and we do not knowingly collect personal data from them. If you are under 13, do not create an account.

9.2. Users aged 13 to 17 may use the Game only with the consent of a parent or guardian, who must accept the Terms of Service on their behalf — the same rule as section 4 of the Terms of Service.

9.3. At sign-up the app asks which age bracket you are in (section 2.8), and the answer is kept on your account. If you answer 13–17, ad requests are tagged as directed to a minor so that only age-appropriate, non-personalised advertising is served — on every device you sign in on, not only the one you answered on. If your account is older than the question, the app asks you once after you sign in.

9.4. If you are a parent or guardian and believe a child under 13 has created an account, write to support@elementals.pl and we will delete it.

10. How we protect your data

• All traffic between the app and our server runs over TLS (HTTPS/WSS).
• Passwords are stored only as a hash — we cannot read them, and a copy of the database would not reveal them.
• Sign-in tokens are held in encrypted storage on your device, not in plain files.
• Access to the production database and server is limited to the developer, over authenticated connections.
• Deleting an account invalidates every token already issued for it, so old sessions cannot survive the deletion.

No system is perfect. If a breach ever puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

11. Changes to this policy

11.1. We may update this policy — when the Game gains a feature, when a provider changes, or when the law does. The version number and the "last updated" date at the top always tell you which text you are reading.

11.2. Material changes are announced in the app and in the release notes before they take effect. If a change requires your consent, we will ask for it rather than assume it.

12. Contact

Questions, data requests, complaints: support@elementals.pl. You can write to us in English, Polish, Portuguese or Spanish, and we answer in the same language.

13. Users outside the European Union

13.1. The rights in section 7 are yours wherever you live. The law of your country may give you the same rights under its own name, or additional ones — in Brazil the rights in art. 18 of the Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018); in Mexico the rights of access, rectification, cancellation and objection (ARCO) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. You exercise all of them the same way: write to support@elementals.pl.

13.2. Complaints. You may also complain to the data protection authority of your country — in Brazil the Autoridade Nacional de Proteção de Dados (ANPD, https://www.gov.br/anpd/pt-br); in Mexico the Secretaría Anticorrupción y Buen Gobierno (https://www.gob.mx/anticorrupcion), which took over the functions of the INAI in 2025; in Argentina the Agencia de Acceso a la Información Pública (AAIP, https://www.argentina.gob.ar/aaip); in Colombia the Superintendencia de Industria y Comercio (SIC, https://www.sic.gov.co/).

13.3. Brazil. We are a small-scale processing agent (agente de tratamento de pequeno porte, Resolução CD/ANPD nº 2/2022), so we have not appointed an encarregado; support@elementals.pl is the communication channel art. 11 of that Resolution requires. A security incident that may cause you relevant risk or harm is notified to the ANPD and to you within the deadline set by Resolução CD/ANPD nº 15/2024 (art. 48 LGPD). The data of players aged 13 to 17 is processed in their best interest (art. 14 LGPD). Transferring the data needed to provide the Game to the providers listed in section 5 is necessary to perform the contract with you (art. 33, IX, together with art. 7º, V, LGPD).

13.4. Mexico. For users in Mexico this policy is our aviso de privacidad (art. 15 LFPDPPP): the identity and address of the responsable are in section 1; the data and purposes in section 2 — we process no sensitive personal data; the means to limit use or disclosure in section 7; the ARCO mechanism in section 13.1; and the way we announce changes in section 11.

Version 2.1, effective 2026-09-03, last updated 2026-10-10. Controller: Krzysztof Gruszczyński, sole trader registered in Poland (CEIDG), ul. Powstańców Śląskich 176/30, 53-139 Wrocław, Poland, NIP 6351826533, REGON 525095630. Contact: support@elementals.pl. This policy is available free of charge at https://elementals.pl/privacy, in a form that allows you to download, save and print it.

Editorial update 2026-10-04: the contact address is now support@elementals.pl and this policy is now published at elementals.pl. Nothing changes in how your data is processed.

Editorial update 2026-10-10: we added the Provider's postal address (section 1 and this footer), a section for users outside the European Union (section 13) and support in English, Polish, Portuguese and Spanish; corrected the in-app paths; and removed a dead link to the version history. Nothing changes in how your data is processed.