VORUSH Privacy Policy

Who is responsible

KGKSoft operates VORUSH. For privacy questions and requests, email [email protected]. If you need the operator's formal legal identity or other contact details for a privacy request, ask through that address.

Data we handle

Accounts and sign-in. Registration uses your chosen player name, email address and password. The server stores a password hash, not the password itself. If you choose Google Sign-In, Google supplies an identity token from which we verify your Google account identifier and email address. We do not receive your Google password. We also store an account ID, a hashed server-side session token and settings such as language and sound preference. The app stores the active session token and a cached profile on your device.

Gameplay and social features. We store game progress and account balances, including experience, diamonds, energy, unlocked heroes and spells, wins, losses, match results and reward history. Referrals, friend relationships and in-game notifications are linked to account IDs. Multiplayer rooms exchange player names, game actions and chat messages with the relevant participants. Room and match chat history is held in game-server memory for the room; it is not stored as a MySQL chat archive in the current implementation.

Technical data. Serving the website, API and game connection necessarily involves IP address and request information. The client can send bounded error and connection diagnostics such as event code, platform, browser family, build, timing and sanitized stack locations. On-device storage also holds preferences, tutorial progress, reconnect information and downloaded audio assets. Uninstalling the app or clearing browser storage removes local copies but does not remove a registered server account.

Guest trial play does not create a profile in the account database or award account currency. Normal network delivery and technical diagnostics can still occur when the app connects to online services.

Why we use the data

We use account and gameplay data to register and authenticate players, operate multiplayer matches, maintain progress, deliver requested social features and grant or verify rewards. For users in the EEA, this processing is generally necessary to provide the service you request (GDPR Article 6(1)(b)).

We use limited technical and security records to keep the service available, investigate errors, prevent abuse and protect accounts and reward balances. Our basis is our legitimate interest in operating a reliable and secure game (Article 6(1)(f)), subject to your rights. Where law requires consent for advertising identifiers, local storage or personalized ads, the applicable consent rules must be followed before that processing is enabled. Choosing Google Sign-In is optional; email and password sign-in is also available.

Providers and other players

Other players can see your chosen player name, relevant match information and messages you send to a room or game chat. Depending on the feature, friends and teammates may see invitations and notifications associated with you.

We use Google Identity Services or Android's Google sign-in components when you choose Google Sign-In. The Android package includes the Google Mobile Ads SDK; its data handling is described below. Hosting, database, network and email-delivery providers may process data needed to run VORUSH or send verification and recovery codes. We do not identify a specific hosting or email supplier here because the checked project does not establish a fixed production provider or region. Ask [email protected] for the current supplier and transfer details. Google's own practices are described in its Privacy Policy.

Advertising and AdMob

The current web game does not request live ads. The current Android release code contains Google Mobile Ads but does not enable live rewarded ad requests or award currency for them; Android debug builds can request Google test ads only. If an ad is requested, Google describes its SDK as collecting and sharing IP address, app interactions, diagnostic information and device or account identifiers (which may include the Android advertising ID) for advertising, measurement and fraud prevention. See Google's Mobile Ads data disclosure.

If live ads are enabled later, we will update this notice and the Google Play Data safety declaration before release. Personalized advertising for users in the EEA, UK or Switzerland also requires the applicable disclosures and consent mechanism. This notice does not claim that such a mechanism is already active. A future verified rewarded-ad flow may keep provider transaction IDs, placement, reward and timestamps to prevent duplicate credits; the API has a record type for these claims, but the current Android release does not generate them.

Storage, retention and security

Account details, progress, friendships, notifications and match records are stored in the VORUSH API's MySQL database while the account is in use. The current implementation has no general automatic expiry or deletion schedule for these records, so we cannot promise a fixed retention period. Chat history is temporary in room memory. Verification codes and Google login challenges expire for use after short periods, although expiration does not by itself prove their database rows have been purged. Technical diagnostic files have a 14-day target and size limits; local queued diagnostics may remain on the device until sent or aged out. Backup retention depends on the deployed backup configuration and has not been verified for this notice.

The production Android configuration requires HTTPS for API requests and WSS for game connections. Passwords are salted and hashed, and server-side session tokens are stored as hashes. Access is limited by authentication and server checks. No online service can guarantee absolute security; contact us if you believe your account or data is at risk.

Account and data deletion

To request deletion of your VORUSH account and associated data, email [email protected] with the subject “VORUSH account deletion request”. Please provide your player name and the email associated with the account, if you have one. Do not send your password, sign-in token or verification code. You can use this email route even if you have uninstalled the app.

The current game does not have a self-service account deletion feature or an implemented server-side account purge endpoint. An email starts a request for manual review and identity verification; it is not confirmation that deletion is complete. Signing out, clearing local storage or uninstalling the app does not delete the server account. KGKSoft must confirm the outcome and identify any records it must lawfully retain. Data held by independent providers may require separate handling.

Your rights and choices

Depending on the law that applies to you, you may request access to, correction or deletion of your data, restriction or portability, or object to certain processing. You can change some profile details and preferences in the game. Send privacy requests to [email protected]; we may need to verify that you control the account before disclosing or changing its data. If processing is based on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to your local data protection authority.

Google and other providers may process information in countries outside your own. Contact us for details of a particular VORUSH transfer and the safeguards applicable to it. We will revise this policy if the game's data handling, providers or retention practices change.