Privacy Policy
Last updated: 27 July 2026
FableBrawl is an online fantasy auto-battler game available at fablebrawl.com. This policy explains what we collect, why, and who we share it with. We have tried to keep it specific rather than generic — if something here is unclear, please ask.
You can play FableBrawl without an account. Signing in is optional and only required for ranked matchmaking, saved match history, and Premium.
Data we collect when you sign in
On the website, when you choose “Sign in with Google”, we request only the three basic sign-in scopes: openid, email, and profile. We do not request, receive, or have any access to your Gmail, Drive, Contacts, Calendar, Photos, or any other Google service.
| What we receive | Why | Do we store it? |
|---|---|---|
| Your Google account identifier | To recognise you as the same player on your next visit | Yes — this is your permanent account key |
| Your email address | To send monthly season results and to contact you about your account or subscription | Yes |
| Basic profile information | Returned by Google as part of sign-in | No — we do not store your Google name or profile picture |
In the iOS app, Sign in with Apple provides an Apple account identifier and, if you choose to share it, your email address or Apple's private relay address. We use the identifier to recognise your FableBrawl account and use the email for the same account and season communications described above. Apple provides the email only on the first authorization, so we store it with your account.
Your in-game name is one you choose yourself. It is never derived from your email address or provider profile.
Every sign-in exchange is verified on our server. We do not keep Google access tokens or refresh tokens after sign-in completes: once your account is identified, we issue our own session token and never call Google on your behalf again. For Apple, we retain the refresh token in server-only storage solely so we can revoke Sign in with Apple authorization if you delete your account, as Apple requires. It is never exposed to the app or used to access another Apple service.
Data we collect as you play
- Account and progress: your chosen name, rating, monthly season record, tutorial progress, and referral code.
- Match history: completed games, the hero you played, your final board and treasures, your placement, and rating change.
- Gameplay telemetry: in-game events used to find bugs and balance the game.
- Feedback reports: if you submit feedback, we store your message plus a snapshot of your own game state. Names, room codes, email addresses and anything resembling a credential are stripped in your browser and stripped again on our server. Feedback never includes other players' hidden shops or hands.
- Session token: stored in your browser's local storage so you stay signed in. On our side we store only a one-way hash of it, so the token itself cannot be recovered from our database.
Payment data
Premium subscriptions are processed by Stripe. Card numbers and payment details are entered directly into Stripe's own fields and are never seen by, sent to, or stored on FableBrawl's servers. We store only the Stripe customer and subscription identifiers, your subscription status, and its renewal date, so we know whether your Premium benefits are active.
Who we share data with
We do not sell your data, and we do not share it for advertising. We use a small number of service providers to run the game:
- Google — sign-in.
- Apple — sign-in in the iOS app and website.
- Stripe — subscription payments.
- Railway — game server and database hosting.
- Vercel — website hosting.
- Resend — sending email.
We may also disclose data if legally required to do so, or to investigate cheating, fraud, or abuse of the service.
If you have an account, we may email you monthly season results and important notices about your account or subscription. Every non-essential email includes a one-click unsubscribe link, and opting out is honoured permanently.
Retention and deletion
We keep account data for as long as your account exists. In the iOS app you can permanently delete it immediately from Account Settings. This revokes your Sign in with Apple authorization, stops active billing associated with the account, and removes the account and its sign-in links. You may also request deletion of your account and its associated data at any time by emailing hello@fablebrawl.com from the address attached to your account. We will action it within 30 days. Records we are required to keep for tax or accounting purposes (such as payment records held by Stripe) may be retained longer.
You may also request a copy of the data we hold about you at the same address.
Children
FableBrawl is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Security
Traffic is encrypted in transit. Session tokens are stored only as one-way hashes, and payment credentials never reach our servers. No system is perfectly secure, but we aim not to hold data we do not need in the first place.
Changes
If this policy changes materially, we will update the date at the top of this page and, where the change affects how we use your data, notify account holders by email.
Contact
Questions, deletion requests, or privacy concerns: hello@fablebrawl.com.