1. Scope and contact
Tikal Online operates Tikal Sunbound and the website at tikalsunbound.com. This policy applies to the website, web game, account services and any Tikal Sunbound mobile application that links to it.
Questions, privacy requests and complaints may be sent to contact@tikal.online. To help us protect your account, we may need to verify that a request comes from you.
2. Information we process
Account and identity information
- Email address, generated account identifier, account status and verification history.
- A securely derived password hash when you use email and password. We do not store your plain-text password.
- When you choose Google or Apple sign-in, the provider's account identifier and verified email address, including an Apple private relay address if you choose Hide My Email. We do not receive your Google or Apple password.
- For Sign in with Apple, an encrypted provider refresh token is stored on our server so that we can revoke the connection when you delete your account.
- Short-lived session, verification, recovery and game-join tokens.
Game and social information
- Character names and profiles, calling, appearance selections, location, progression, inventory, equipment, quests, skills, guilds, friends, rankings, trades and other gameplay state.
- Messages sent through nearby, direct, party or guild chat and actions such as invites, blocks and moderation outcomes. Other players may see information that you choose to make visible in the game.
- Support, safety and administration records, including suspension reasons and audit records where needed to operate and protect the service.
Purchase information
For in-app purchases, we process your game account identifier, purchase history, product and transaction identifiers, receipts or purchase tokens, entitlements, subscription status, refunds and disputes. Apple or Google handles payment, and RevenueCat validates purchases and helps us manage entitlements and purchase analytics. We do not send your email address to RevenueCat as a customer attribute. Payment card details are handled by the payment provider or app store, not stored directly by Tikal Sunbound.
Technical information
We and our infrastructure providers may process IP address, request time, browser or device details, error information and security events. We use IP addresses for connection handling, abuse prevention and rate limiting. When our infrastructure supplies a country code derived from a connection, we may store that country and sign-in activity with your account for aggregate operational reporting. We do not request GPS or precise device location.
3. How we use information
We use information to:
- Create and secure accounts; verify email addresses; provide sign-in and recovery.
- Save characters and progression, synchronize the game world and deliver multiplayer, guild, ranking, chat and commerce features.
- Process purchases and manage entitlements when those features are available.
- Respond to support requests, investigate abuse, enforce game rules and protect players and the service.
- Maintain, troubleshoot and improve reliability, compatibility and game balance.
- Meet legal, accounting, security and compliance obligations.
Where applicable law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and protecting the game, compliance with legal obligations, and consent where the law requires it. You may withdraw consent at any time, but this does not affect processing already completed.
Analytics and campaign sharing
Basic, nonpersonalized campaign measurement is enabled by default. Google Analytics or Firebase may receive random browser/app installation identifiers, completed registrations, verified paid Premium upgrades and purchases with their product, amount and currency. Conversion measurement follows the campaign measurement preference. Advertising storage remains denied unless you explicitly allow advertising matching; ad personalization remains disabled. Basic measurement does not send your game account ID to Google. iOS advertising measurement also requires Apple tracking permission. There is no additional campaign-sharing dialog in the game. Existing opt-outs and system tracking permissions are honored; already delivered events cannot be recalled.
For campaign measurement, we may share ad click identifiers, successful registrations and confirmed paid upgrades (including price, currency and product) with Meta through its Conversions API. Campaign handoff codes can carry this consented attribution into a downloaded client. Downloaded apps may use Meta’s native SDK to report installation/activation and share a random SDK installation ID and, when permitted, the device advertising ID for matching. Registration and verified paid-upgrade events remain server-confirmed. We do not send email addresses, passwords or card details through this integration. iOS additionally requires Apple tracking permission. Declining stops future sharing from that installation; already sent events cannot be recalled by this control. Purchases with no consented matching information stay in our internal reports.
With campaign sharing enabled, we use Google Analytics on the website and Firebase Analytics in configured mobile apps to understand how players discover Tikal. We collect campaign labels, referring website domains, approximate country, platform and random installation identifiers. When you sign in, campaign information may be associated with your game account and confirmed purchases. We do not send your email, password, account recovery tokens or payment card details to analytics services.
Campaign measurement is enabled by default without an additional campaign-sharing screen. Existing disabled choices remain disabled, and iOS tracking requires Apple’s system permission. Website and other device preferences are stored separately. Unlinked campaign visits expire after 180 days; campaign handoff codes expire after 24 hours. Account deletion removes linked acquisition analytics. Payment records needed to fulfill purchases and manage refunds are maintained separately.
Firebase analytics remains configured without advertising identifiers; the Meta integration may use them when system permissions allow. Apple’s SKAdNetwork may produce aggregate install and registration reports without advertising IDs. These reports cannot identify individual Tikal accounts. Some mobile campaign results are available only as aggregated statistics. Download clicks are not completed installations. Confirmed purchase reporting comes from payment providers and may remain available without campaign attribution.
Optional rewarded ads
Mobile builds that support rewarded ads may offer a video to unlock daily supplies and a clearly stated character XP bonus. Watching is optional: you can skip and keep playing, and normal quest rewards remain available. Jade Circle members collect daily supplies without videos. Google AdMob may process device and advertising identifiers, IP addresses, ad interactions and diagnostic information to serve and measure ads and prevent fraud. The game requests non-personalized ads and uses Google’s consent form where required; non-personalized ads can still use device storage and process personal data. Ad privacy choices are available from the daily supplies screen.
We send Google a random reward-request token, not your email address or character name. We keep account-linked reward receipts and daily experiment participation to deliver rewards once, prevent duplicate claims and assess the feature. These records are removed when your account is deleted. Google’s handling of information is explained in its Privacy Policy.
6. How long we keep information
We keep account and character information while your account remains active and for a reasonable period afterward when needed to complete deletion, preserve service integrity, resolve disputes or meet legal obligations. Short-lived sessions and account-action tokens expire automatically.
Chat availability is limited within active game systems, but some social or guild information may be included in saved game state. Security, moderation, purchase, audit and backup records may be kept longer where reasonably necessary for fraud prevention, accounting, dispute handling, recovery and legal compliance. Backup copies are removed or overwritten on the service's normal backup cycle.
When you submit a player report, we store your description, the reporter and reported account/character references, and any message you choose to attach for staff review. Player reports and attached evidence are automatically removed after 180 days, including when retained after account deletion to prevent abuse or handle disputes. Moderation decision audit records may be kept longer as described above. Do not include passwords or payment details in reports. For report follow-up or an appeal, contact contact@tikal.online.
7. Your choices and rights
Depending on where you live, you may have the right to request access, correction, deletion, restriction, portability or objection, and to appeal or complain to a data-protection authority. You may also sign out, avoid optional social features, block other players and manage a purchase subscription through the provider that processed it.
You can permanently delete your account from the signed-in account screen using “Delete account.” Instructions and an alternative email request are on our account deletion page. Deletion removes your account, adventurers, saved progress and active sessions, and revokes the stored Sign in with Apple authorization. It does not cancel app-store subscriptions; cancel those separately through Apple or Google. For any other privacy request, email contact@tikal.online. We may retain limited pseudonymous transaction, security and audit records when required by law or reasonably necessary for fraud prevention, disputes or the rights of others. Payment providers may retain their own records under their policies.
8. Children
Tikal Sunbound is not directed to children under 13. If you are under the age at which you may consent to online services in your country, a parent or legal guardian must review and accept the Terms for you. If we learn that we collected personal information from a child in a way that is not permitted by law, we will take reasonable steps to delete it.
9. Security and international transfers
We use administrative, technical and organizational safeguards designed for the sensitivity of the information we process, including encrypted transport, hashed passwords, short-lived tokens, access controls, rate limits and provider safeguards. No method of transmission or storage is completely secure.
Our providers may process information in countries other than your own. Where required, we use recognized safeguards for international transfers and limit providers to the information needed for their work.
10. Changes to this policy
We may update this policy when the game, providers or legal requirements change. We will post the revised policy here and update the date above. If a change materially affects your rights, we will provide additional notice when reasonably appropriate.
Contact: contact@tikal.online.