Legal

Privacy Policy

BloodRivals is a location-based game operated by CreatorsJourney AS(Norway), the data controller. We collect as little as the game needs, we host in the EU/EEA, and we never sell your data or share it with advertisers.

Last updated: 27 August 2026

What we collect

Account

Your username and email address, and a securely hashed password. This identifies you and lets you sign in.

Precise location

With your permission, your device’s GPS location while you are using the app. Location is the core of the game — it places you on the live map and lets you claim and defend the turf around you. We do not track your location in the background.

Gameplay data

The turf you claim, your coins and score, team membership, and in-game events. This is what makes the game work and powers the leaderboards.

Visible to other players

BloodRivals is a territory game: the shops and lots you claim are shown on the live map to other players, the way location-based games generally show claimed landmarks. Other players can also spend in-game coins on a “spy” to see your recent moves (claims, takeovers, upgrades, coin collections, attacks and Specials), your score and holdings, and the addresses of the places those moves touched, for a limited time — and you are notified when someone spies you. We never show your live, real-time position; only the fixed places you have claimed. Claim public spots like shops, not your home.

Chat messages

If in-game chat is enabled for you, the messages you send — curated phrases, which every player can use, or text you type yourself, which is for players aged 13 and over — are stored so chat works and so our moderators can act on a report. Every typed message is checked by an automatic filter before it is stored; it is aimed at phone numbers, email and street addresses, links and blocklisted words, and it applies at every age. It is an automatic check, not a guarantee — it will not catch everything, which is why reporting and moderation sit behind it. Any location attached to a chat line is coarsened to a wide grid, never a precise position. You can block another player and report a message at any time. Blocking hides their chat from you and yours from them, including replies, mentions and reactions — and it also hides their name elsewhere in your view of the game (leaderboards, rosters, alerts, world feed and the owner line on their houses). See the Terms for exactly what a block does and does not cover.

Age band

When you create an account with a username and password we ask what year you were born. Your device turns that year into a coarse age band (under 13 / 13–17 / 18+) and sends us only the band — the year itself never leaves your phone, and we never ask for or store a date of birth.

Every sign-in route asks. Signing in with Apple or Google, or with an emailed sign-in link, lands on the age question before the game does — it is a step you cannot pass without answering, not a setting to find later. Accounts made before that step existed may still carry no band; those are treated as the younger one for chat, and are asked the next time they sign in. Once an account has a band, Settings → Your age is where it changes.

We use the band for three things, and nothing else:

·to decide whether you can type your own text in chat — text someone has typed is never delivered to a player under 13, and an account that has not answered the age question is treated as the younger one for this purpose only;
·to keep an under-13 player’s name out of the game’s public world feed. This is live today;
·to hold an under-13 account until a parent or guardian confirms. This is live today — see “Children” below.

Treating an unanswered age question as “younger” is a chat rule: an account that has not told us a band cannot type in chat.

Technical data

Minimal logs and device information needed to operate the service and keep it secure (for example, to investigate crashes and abuse). We also measure how the game is used — which screens and features players open, and where they get stuck — so we can improve it. This is product analytics for our own use only. We do not show ads, do not use advertising or cross-app tracking, never sell your data, and never use it to profile a child.

Why we use it (legal basis)

·To provide the game (GDPR Art. 6(1)(b) — performance of a contract): your account, location and gameplay data.
·Player-versus-player visibility (Art. 6(1)(b) — performance of a contract; and Art. 6(1)(f) — legitimate interest in a competitive game): showing your claimed places on the map and the paid “spy” reveal of a rival’s recent public moves.
·Security & integrity (Art. 6(1)(f) — legitimate interest): preventing cheating, abuse and fraud.
·Location access (consent): you grant the OS location permission, and can revoke it at any time in your device settings.

Who we share it with

We do not sell your data, and we do not share it with advertisers. Never.

We use a small number of trusted processors to run the service, bound by data-processing agreements:

·EU/EEA hosting provider — we run our own application and database servers on infrastructure located in the EU/EEA. The data centre operator provides the physical servers and network only; it does not access your data.
·Cloudflare — the network in front of our websites and our map-tile server. Because every map tile your device loads passes through it, Cloudflare sees your IP address and which map squares you asked for (which indicates the area you are looking at), plus the usual connection details. It delivers and protects that traffic on our instructions and does not use it for its own purposes. Cloudflare is a US company, so this involves a transfer outside the EU/EEA, covered by the EU Standard Contractual Clauses.
·Email delivery provider — to send transactional emails (for example account and security messages), which processes your email address.
·Google Firebase (Google Ireland Ltd.) — push notifications, crash diagnostics, and privacy-safe product analytics (which screens and features are used). Advertising signals are turned off: no ads, no advertising identifiers, no cross-app tracking.
·Google Play (Google Ireland Ltd.) — when you tap a download link on this website, it carries a short label saying which page or channel sent you (for example“recruit” or a referring site such as “reddit.com”), so we can see which of our own pages actually leads to an install. The label is about the link, not about you: it carries no name, no account, no device identifier and no advertising ID, and it is checked and shortened before it is sent. On Android, the app reads that same label once when it first opens and keeps it with your account, so we can tell which page led to a player rather than only to a download. It is still just the label — a word like“recruit” — and it is never shared with anyone outside BloodRivals.
·Kids Web Services (KWS, operated by Epic Games) — our parental-verification partner, and this is in use today (see “Children”). A player who tells us they are under 13 passes their parent or guardian to KWS to confirm consent; KWS processes the grown-up’s contact details for that check and tells us only whether consent was given. It is used for nothing else, and not at all for players 13 and over.

Each processor handles only what its line describes. If we add another processor, we will update this page before relying on it.

One service is not on that list, because it is not ours to instruct.

·Nominatim, run by the OpenStreetMap Foundation — we use it to turn coordinates into place names, so the game can tell you the street or district a property is on, and to answer map searches you type. To do that our server sends it the coordinates of claimed properties and your search text. It never receives your username, email or account, and the request comes from our server rather than your device. It is a free public service, not a contracted processor — there is no data-processing agreement, and the Foundation decides for itself how it handles what it receives. That is why we describe precise location as shared in our app-store declarations, and we would rather tell you plainly than hide it in a list it does not belong in.

How long we keep it

We keep your account and gameplay data for as long as your account is active. When you delete your account (see below), we delete your personal data, except where we must retain limited records to meet a legal obligation. Precise location is used live and we do not build a history of where you go — playing does not leave us a trail of the exact places you have been. There is one exception, and we would rather name it: anti-cheat. When a position looks impossible, or comes from a fake-location app, we record that exact position as evidence so staff can tell a cheat from a long train journey. Those records are kept for up to 180 days and are not used for anything else. Some things you DO are public and dated, and those carry an approximate position: a capture, a world-feed event, a post in a public chat channel. Those are rounded to about a 111 m grid before they leave our server (see “What we collect”). Deleting your account unlinks them from what other players can see: your handle is replaced, your chat lines lose their position, and world-feed events are either deleted or stripped of any link to your account. Staff-only anti-cheat and moderation records are the exception described above, and they age out on their own. The locations of the game objects you create — the places you claim, and where you place a Special — are part of the game itself and are kept as game state and anti-cheat records for as long as they matter to the game.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or port it. To exercise any of these, email [email protected] from your registered address — we respond within 30 days.

You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

Deleting your account

You can delete your account and its associated personal data at any time. See Support → Delete your account for how. We complete deletion within 30 days.

Children

BloodRivals is a general-audience game and is not specifically directed to children under 13. The minimum age for an account is 9. Separately, the app stores rate the game’s content 9+ on the App Store; Google Play’s rating is issued per region by the local board, so the badge on your listing is the one that applies to you. A content rating and a minimum account age are different things, and we state both rather than blurring them.

What happens today. If a player tells us they are under 13, the account is held before play: we do not let them into the game until a parent or guardian confirms through our verification partner, and while the account is held the game refuses the requests that use a player’s position. The app shows the child how to ask. If the child played before telling us their age, we may already hold location data from that time — a parent or guardian can ask us to delete it at any time, and we will. Their answer changes two more things: an under-13 player’s handle is kept out of the game’s public world feed until a parent verifies, and they cannot type their own text in chat at all — typed text is a 13-and-over capability and is never delivered to a player under 13, verified or not. Under-13 players chat with ready-made phrases instead.

How the verification works. The hold and the parental-consent path run through our verification partner (see “Who we share it with”). We pass the parent or guardian’s contact details to them for that check and receive back only whether consent was given. We never receive a date of birth and never ask the child for one — the app collects a birth YEAR, reduces it to a band on the device, and sends only the band. A parent or guardian can withdraw that confirmation at any time by contacting us, and we will hold the account again.

Whatever else happens. A parent or guardian who does not want their child playing can contact us at any time and we will close the account and delete its data. Note that a parent’s confirmation does not hand a child typed chat: it lets the child play, and typed chat stays a 13-and-over capability. What a confirmation also unlocks is a correction — with one on file, a player who declared under 13 may move to the 13–17 band, and that band can type. The terms say the same; a parent reading both should get one answer.

We never show ads and never use advertising or cross-app tracking; we collect only the data the game needs, and we use it only to run, secure and improve the game — never to profile a child or for marketing. If you believe a child has provided us data you would like removed, contact us and we will delete it.

Changes & contact

We may update this policy as the game evolves; we will revise the date at the top and, for material changes, notify you in the app.

Questions? Contact the data controller, CreatorsJourney AS, at [email protected].