Privacy Policy
Effective date: 9 October 2026
This policy explains how the publisher of Cauldron Castle (“we”, “us”), handles personal information when you play the Cauldron Castle mobile game or visit cauldroncastle.com.au (together, the “Game”). We aim to collect only what we need to run a cosy, fair game, and to treat it with care.
1. What we collect
Information you give us
- Account data: your email address, a password (stored only in hashed form), and the Player ID we assign to your account.
- Support messages: anything you send us when you contact support, such as your email address, Player ID, screenshots and a description of your issue.
Information created when you play
- Gameplay progress: levels completed, castle restoration progress, Virtual Item balances (gems, coins, decorations), settings and in-game events.
- Purchase records: when you buy something, Google Play processes the payment and sends us a record of the transaction (for example the product bought, order ID, purchase token, date, and subscription status). We never receive your card or bank details.
- Device and diagnostic data: device model, operating system version, app version, language, approximate country (from your device settings or IP address), IP address, crash logs and performance data.
- Advertising identifiers (only if ads or ad-attribution SDKs are used): your device's advertising ID, which you can reset or delete in your Android settings.
We don't collect your precise location, contacts, photos, microphone or camera data. If you visit our website, our hosting provider may log basic technical information (such as IP address and browser type) for security. The website does not use advertising cookies.
2. How we use your information
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, save and sync your progress | Account data, gameplay progress | Performing our contract with you |
| Deliver purchases and subscriptions, prevent fraud | Purchase records, Player ID, device data | Contract; legitimate interests (fraud prevention) |
| Send password-reset and essential account emails | Email address | Contract |
| Fix bugs, crashes and performance problems | Device and diagnostic data | Legitimate interests (keeping the Game working) |
| Understand how the Game is played and improve it | Gameplay and diagnostic data (aggregated where possible) | Legitimate interests, or consent where required |
| Show ads, including optional rewarded ads | Advertising ID, device data | Consent where required (e.g. personalised ads in the EU/UK); otherwise legitimate interests |
| Answer support requests | Support messages, account data | Contract; legitimate interests |
| Meet legal, tax and accounting obligations | Purchase records | Legal obligation |
We won't send you marketing emails unless you opt in, and every marketing email will include an unsubscribe link. We don't sell your personal information.
3. Service providers, analytics & ads
We use trusted providers to run the Game. They may only use your information to provide their services to us (or, for ad networks, as described in their own policies):
- Google Play (Google LLC): app distribution and payment processing. Google Privacy Policy
- Backend, hosting & account services: our secure cloud hosting provider, used to store your account and saved progress
- Email delivery (for password-reset emails): a transactional email service, used only to send account emails such as password resets
- Analytics: none at present
- Crash reporting: none at present
- Advertising: Google AdMob, for optional rewarded videos you choose to watch
- Website hosting: Netlify
Where ads are shown, we ask ad partners to serve only non-personalised ads unless you have given any consent required by law. You can opt out of personalised ads at any time in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads).
4. When we share information
We share personal information only:
- with the service providers listed above, to run the Game;
- if required by law, a court, or a government authority, or to protect the rights, safety and property of our players, ourselves or others;
- with a buyer or successor if the Game is sold or transferred, in which case this policy will continue to protect your information, and we will tell you before it changes.
5. Overseas transfers
We're based in Australia, but some of our providers store or process information overseas, including in the United States and other countries where our providers operate. When we send personal information overseas we take reasonable steps, as required by Australian Privacy Principle 8, to make sure it is handled consistently with the APPs. For players in the EU, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.
6. Security
We protect your information with reasonable technical and organisational measures, including encrypted connections (HTTPS/TLS), hashed passwords, access controls and limiting access to the people and providers who need it. No system is perfectly secure, so please use a unique password. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
7. How long we keep information
- Account data and progress: while your account is active. If an account is inactive for 24 months, we may delete it after trying to warn you by email.
- Purchase records: for as long as needed for tax and accounting law (generally 5 years in Australia), then deleted.
- Diagnostic and crash data: up to 90 days, unless aggregated so it no longer identifies you.
- Support emails: up to 2 years after your issue is resolved.
- Password-reset links: expire after 60 minutes and can only be used once.
8. Deleting your account
You can ask us to delete your account and associated data at any time, by emailing cauldroncastle@outlook.com from the email address on your account with the subject “Delete my account”. We'll verify the request and delete your account, progress and associated personal data within 30 days, except records we must keep by law (such as purchase records, see section 7). Instructions are also on our Support page.
Uninstalling the Game does not delete your account, and deleting your account does not cancel a Moonlit Circle subscription. Please cancel that in Google Play.
9. Your privacy rights
Everyone, including under the Australian Privacy Act 1988
We handle personal information in line with the Australian Privacy Principles (APPs). You can ask to access the personal information we hold about you and ask us to correct it. You can also deal with us anonymously or with a pseudonym (for example, by playing as a guest) where practicable. We'll respond within 30 days and won't charge you for making a request. If we refuse a request, we'll tell you why and how to complain.
Players in the EU, EEA, UK or Switzerland (GDPR)
You also have the right to: request erasure of your data; restrict or object to our processing (including processing based on legitimate interests); receive your data in a portable format; and withdraw consent at any time where we rely on consent (this doesn't affect processing before you withdrew). You may lodge a complaint with your local data protection authority. The data controller is the publisher of Cauldron Castle, contactable at the email below.
Players in California (CCPA / CPRA)
In the past 12 months we have collected these categories of personal information: identifiers (email, Player ID, IP address, advertising ID), commercial information (purchase records), internet or other electronic network activity (gameplay and diagnostic data), and approximate geolocation (country). We use them for the purposes in section 2 and disclose them to the service providers in section 3. We do not sell personal information. You can turn off personalised ads at any time in your device settings (Android: Settings → Google → Ads), and we honour Global Privacy Control signals on our website. You have the right to know, access, correct and delete your personal information, and to not be discriminated against for exercising these rights. We do not knowingly sell or share the personal information of consumers under 16.
To exercise any of these rights, email cauldroncastle@outlook.com. We may need to verify your identity, usually by confirming you control the email address on the account.
10. Children
Cauldron Castle is designed for a general audience and is not directed at children under 13. We don't knowingly collect personal information from children under 13 (or the higher age of digital consent in your country, such as 16 in some EU countries) without verifiable parental consent. If you believe a child has given us personal information, please contact us and we will delete it promptly. Parents can also contact us to review or delete their child's information.
11. Changes to this policy
We may update this policy as the Game or the law changes. We'll post the new version here with a new effective date and, for significant changes, tell you in the Game or by email before they take effect.
12. Contact & complaints
For privacy questions, requests or complaints, email cauldroncastle@outlook.com.
The Cauldron Castle team
We'll aim to respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), or to your local data protection authority if you live outside Australia.