Privacy Policy

1. Scope and controller

This policy applies to the Magic Tower mobile game, its online leaderboards, custom-map library and editor, and the related website and support services (together, the “Service”). Magic Tower is operated by Loming (“we”, “us”, or “our”), which is the controller of personal data described here.

You can play the original tower offline without creating an account. Online rankings, publishing or liking maps, reporting content, and account privacy tools require an online connection, and some features require an account.

2. Data we collect

Data you provide

• Account information, such as email address, display name, authentication records, and account settings.
• Custom-map drafts, published maps, descriptions, uploaded assets, likes, reports, moderation appeals, and messages you send to support.
• Requests to access, export, correct, or delete account data.

Game and device data

• Ranked-run commands, checkpoints, scores, gameplay statistics, map identifiers, game version, and verification results needed to validate leaderboard entries.
• Installation identifiers, installation public keys, platform, app version, and security or integrity results used to protect ranked play and accounts.
• Custom-map popularity totals. Player totals count distinct signed-in players who start ranked runs; public pages do not reveal who those players are.
• Limited diagnostic, security, and service logs, which may include network address, request time, route, response status, and privacy-reduced abuse-prevention signals.

Store purchases

Apple or Google processes optional in-app purchases. We receive product, transaction, entitlement, and verification information needed to unlock or restore the purchase. We do not receive your full payment-card details.

3. How we use data

• Provide accounts, saved online state, custom maps, and verified leaderboards.
• Validate ranked runs, detect tampering or abuse, secure the Service, and investigate incidents.
• Review map publications and assets, respond to player reports, and enforce community and ranking rules.
• Process purchases, restore entitlements, provide support, and answer privacy requests.
• Measure reliability and aggregate feature use so we can maintain and improve the Service.
• Meet legal, tax, accounting, safety, and regulatory obligations.

We do not sell personal data, and we do not use gameplay or ranked evidence for third-party advertising.

4. Custom content and automated screening

Public map metadata and uploaded images are checked for safety before entering a human moderation queue. Text or normalized image content may be sent to OpenAI for automated safety classification. We retain the resulting workflow status, not the provider’s raw response. Automated screening alone does not publish or permanently remove a map; human review and player reporting remain available.

Approved map titles, descriptions, creator display names, versions, likes, player totals, and map content are public. Do not put personal or confidential information in content you publish.

5. When we share data

We share only what is reasonably necessary with:

• Hosting, database, authentication, storage, content-delivery, monitoring, email, support, integrity-checking, and content-safety providers acting for us.
• Apple and Google for app distribution, purchase verification, and store support.
• Professional advisers, authorities, or other parties when required by law or needed to protect users, the public, our rights, or the security of the Service.
• A successor organisation if the Service is involved in a merger, financing, reorganisation, or sale, subject to appropriate safeguards.

Providers may process data in countries other than your own. Where required, we use recognised transfer safeguards and contractual protections.

6. Retention and security

We keep data only for as long as needed for the purposes above. Raw network logs are normally kept for no more than 7 days, rotating pseudonymous abuse-prevention keys for 30 days, rejected upload or validation payloads for 30 days, and moderation, audit, and security evidence for up to 24 months. Backups normally expire within 30 days.

Published map versions, anonymous integrity hashes, and verified ranking facts may be retained longer to preserve public records, prevent fraud, and keep leaderboards consistent. A legal, safety, security, or appeal hold may extend a relevant record’s retention.

We use encryption in transit, access controls, private storage, short-lived upload links, rate limits, audit trails, isolated run verification, and recovery testing. However, no service can guarantee absolute security.

7. Your choices and rights

• You can use offline play without an online account.
• You can choose whether to publish a map or submit a ranked run.
• Signed-in users can request a machine-readable export or account deletion through the Privacy & Data area. Deletion has a 7-day cancellation period.
• You may ask us to access, correct, delete, restrict, or provide a copy of your data, and may object to certain processing or withdraw consent where applicable.
• You can appeal eligible enforcement decisions and complain to your local data protection authority.

We may need to verify your identity before acting on a request. Some data may be kept where required for security, legal obligations, dispute resolution, or the integrity of anonymous public ranking records.

8. Children

Online account and community features are not directed to children under 13, or the higher minimum age required to consent to online data processing where they live. A younger player may use offline play with a parent or guardian. If you believe a child provided personal data without appropriate permission, contact us so we can investigate and remove it.

9. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. We will post the revised date here and provide an in-app or other prominent notice when a change is material.

10. Contact

For privacy questions or requests, email [email protected]. Please do not include passwords, payment-card details, or sensitive authentication information.

For App Store and Google Play submissions, the canonical privacy-policy URL is:
https://magic-tower.loming.com/privacy