Privacy Policy

Effective date: 4 November 2026

1. Who is responsible for your data

The controller of the personal data described here is LITTLE BYTE STUDIO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Ludźmierska 26A, 34-400 Nowy Targ, Poland, a limited liability company entered in the register of entrepreneurs of the National Court Register kept by Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego, under KRS number 0001277156, NIP 7352945602, REGON 546105621, share capital PLN 15,000 ("we", "us").

You can reach us about anything in this policy at contact@littlebyte.studio.

We have not appointed a data protection officer. The nature and scale of our processing do not require one.

We process personal data under Regulation (EU) 2016/679 (the "GDPR") and Polish data protection law.

2. What this policy covers

This policy covers three things:

the website at https://tiland.app;
the game Tiland for Android and iOS (the "app");
the game server the app plays through, at game-api.tiland.app (together with the app, the "Service").

It also covers the administration panel at admin.tiland.app, through which we alone look at the Service and moderate it (section 6), and the two e-mail lists you can join on the website: the wishlist, for news of Tiland's launch and marketing e-mails about Tiland, and the public beta, to apply to test the app before launch (section 3.2).

It does not cover the App Store or Google Play, nor Google's sign-in or Apple's Game Center. Apple and Google run those under their own policies (section 5).

The game has no sign-up. It asks for no e-mail, password or phone number. An e-mail address you give the website's wishlist or public beta is kept in a list of its own, apart from the game, and is not tied to your game account unless you name that account for the beta gift (section 3.2). On first launch the app asks our server for a guest account, and that account is all the server knows you by. When it starts, the app also asks the sign-in your phone already has, Google on Android and Game Center on iPhone and iPad, to sign you in, which pairs the guest account with it; you may decline and play on as a guest. A new phone signed in the same way can then take the account back (section 4.4). Pairing creates no account with us, and gives us no e-mail address. The name that sign-in knows you by is used only as your display name, and only while you still play under the name the app drew for you (section 4.4).

3. The website

3.1 Visiting the website and cookies

Each page of the website is put together by our own web server when your browser asks for it. Its fonts, pictures and video come from tiland.app itself. The one other service the website can reach is PostHog, the analytics described below, and it reaches it only after you accept analytics in the cookie bar.

What the website keeps in your browser without asking. Two things, both strictly necessary for what you asked of it, both holding no identifier, neither of which ever leaves your browser:

the sign-up forms' flag (section 3.2). The forms send what you typed only when you press the button. Once you have pressed it, they keep one flag in your browser's session storage saying which list you signed up for and whether you have opened the confirmation link, so that the form shows you that instead of an empty field. The flag holds no e-mail address, never leaves your browser and is cleared when you close the tab;
your answer in the cookie bar, in your browser's local storage: whether you accepted or declined analytics, and when. It is kept for 12 months, then we ask again. We also ask again if we change what the analytics collect.

Analytics, if you accept them. We would like to know how the website is used: which pages are viewed, what is clicked, which outside links are followed, how many sign up, and whether our scripts fail. For that we use PostHog, a service of PostHog, Inc. (section 7), in its EU cloud in Frankfurt, Germany. Nothing of it loads, runs or stores anything until you press "Accept analytics" in the cookie bar; "Decline" leaves it off, and the website works exactly the same either way. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not show the bar. You can change your answer at any time with "Cookie settings" in the footer of every page; declining after accepting stops the collection and removes PostHog's cookie and storage from your device.

Once accepted, PostHog records: page views, and when you leave a page; clicks on page elements (which element, its text and position, never what you type into a field); clicks on the links to our networks and to Little Byte Studio's own site (which link, which part of the page); that a sign-up form was sent and that a confirmation link was opened (which list, never the address); technical errors in our scripts (the error message, where it happened, your browser); your browser, operating system, screen size, language and the page you came from; and a country and city level location derived from your IP address, which PostHog then discards and never stores. A random identifier stored on your device lets repeat visits from the same browser count as one visitor. Nobody is identified and no profile is built; we use no session recording, heat maps, surveys or feature flags on this site.

The legal basis is your consent (Article 6(1)(a) GDPR, and Article 399 of the Polish Electronic Communications Law of 12 July 2024 for storing and reading the identifiers on your device). You may withdraw it at any time as above; withdrawing does not make unlawful what was done before. Analytics data is kept for 12 months from collection, then deleted. The identifiers on your device live as the table says.

Name	Kind	Purpose	Lifetime
`tiland.signup`	Necessary, session storage	Which list this tab signed up for and how far it got.	Until you close the tab.
`tiland.consent`	Necessary, local storage	Whether you accepted or declined analytics, and when.	12 months, then we ask again.
`ph_phc_…_posthog`	Analytics, cookie and local storage	PostHog's visitor identifier, session identifier and a few settings.	Cookie: 12 months. Local storage: until you decline or clear your browser data.
`ph_phc_…_posthog` (session storage)	Analytics, session storage	The current session's details.	Until you close the tab.
`__ph_opt_in_out_…`	Necessary, local storage	Set only if you decline after having accepted: tells PostHog's script to stay off.	Until you clear your browser data.

PostHog's script is loaded from, and your events are sent to, its EU servers at eu-assets.i.posthog.com and eu.i.posthog.com; no other third-party script runs on this site.

The web server that serves the website writes no log of requests: a normal visit leaves no trace, not even your IP address. Only a fault of its own is written to its log, and such a line can name the address and the URL of the request that met it; it is kept with the container log (section 4.1, Server logs). When you send a sign-up form or ask for an unsubscribe link, the server holds your IP address in its memory for at most an hour, and never writes it down (section 3.2).

Every connection to tiland.app, game-api.tiland.app and admin.tiland.app first reaches a reverse proxy of ours, where the encrypted connection ends, and is handed on. That proxy may keep an access log. If it does, each line holds your IP address, the address requested, the time, the response status and, where your browser sends them, its identification string (user agent) and the referring page. We keep such a log only to keep the Service secure and to find the cause of failures, our legitimate interest in running a secure and reliable service (Article 6(1)(f) GDPR), and for no longer than 30 days.

3.2 The wishlist and the public beta

On the website you may give us an e-mail address to join one of two lists:

The wishlist, for news of Tiland's launch on the App Store and on Google Play, and marketing e-mails about Tiland.
The public beta, to apply to test the app before launch, for everything about the public beta, and for the same news and marketing e-mails. We choose the testers from those who apply, and not everyone is picked. The testers we pick are invited to testing builds through Apple's TestFlight and Google Play's testing track, under Apple's and Google's own terms. Every tester we pick who takes part receives the beta gift the Terms of Service describe (their section 16).

Joining is your choice, and the game never needs it. You join by ticking the one box on the form, which is never ticked for you. Its sentence names the e-mails you agree to receive, promotional e-mails included, and your acceptance of the Terms of Service and of this policy. Marketing e-mails need your prior consent under the GDPR and the Polish Electronic Communications Law of 12 July 2024.

Data	Details	Why we process it and on what basis	How long we keep it
Sign-up	Your e-mail address, the list you chose, when you signed up, and a random token for the confirmation and unsubscribe links. When you confirm the address, when; when we sent it the welcome e-mail, when; when you unsubscribe, when.	To send you the confirmation e-mail, then one welcome e-mail, and then what you agreed to: news of the launch and marketing e-mails about Tiland, and on the beta list everything about the public beta (whether you are picked, the invitation, what the beta needs). Your consent (Article 6(1)(a) GDPR), which you may withdraw at any time (below).	An address you never confirm: 30 days after you signed up. A confirmed address: until you unsubscribe, or until we stop sending e-mails to that list, whichever comes first. An address you unsubscribed: 30 days after you unsubscribed, so that the unsubscribe holds against an e-mail already on its way; we send it nothing in that time.
Consent record	The version of the consent text you ticked, and when you ticked it, by our server's clock: the sentence that names the e-mails you agreed to and your acceptance of the Terms of Service.	To be able to show that you agreed, and to what, as Article 7(1) GDPR requires of us (Article 6(1)(c)).	With the sign-up it belongs to, as the row above says.
Beta gift	When we ask you, the game account you want the beta gift on, and whether it has been given.	To give you the gift the Terms promise for taking part in the public beta. Necessary to perform the beta agreement with you (Article 6(1)(b)).	With your beta address, as the first row says. Once given, the gift is kept on that game account like anything else it holds (section 4.1).
Network address	Your IP address, when you send a sign-up form or ask for an unsubscribe link.	To limit how many sign-ups and requests one address can send, against floods. Our legitimate interest in protecting the lists from abuse (Article 6(1)(f)).	In the web server's memory only, for at most an hour. It is never written to the database or to a log.

Confirming your address. We send one confirmation e-mail to the address you gave ("Confirm your Tiland wishlist" or "Confirm your Tiland beta application"), with a button to a link. The address is confirmed only when that link is opened, and until then we send it nothing else. If somebody else typed your address, ignore the e-mail: the address is deleted 30 days later. The confirmation e-mail is sent to no list yet, so it carries no unsubscribe link.
The welcome e-mail. When the link confirms your address, we send it one welcome e-mail ("Welcome to Tiland" on the wishlist, "Your Tiland beta application is in" on the public beta): who we are, where the community talks, and the other list. It is the first e-mail of the list you joined, and it is sent once, never again for that address on that list. We note when it was sent with your sign-up.
Unsubscribing. Every e-mail we send to a list, from the welcome e-mail on, carries an unsubscribe link. It marks your address unsubscribed at once, and we send it nothing more from that list. On https://tiland.app/unsubscribe you may also enter the address you signed up with: we then e-mail that address the unsubscribe link of each list it is on. The page answers the same whether or not the address is on a list, and keeps nothing of an address that is not. You may also withdraw your consent by writing to contact@littlebyte.studio. Withdrawing does not make unlawful what we did before.
Where the lists are kept. In a database of the website's own, apart from the game's database, on our servers in Nuremberg, Germany (section 7).
Who sends the e-mails. Resend sends the confirmation and welcome e-mails, the launch news, the marketing and beta e-mails and the unsubscribe links you ask for, on our behalf (sections 7 and 8).
Choosing the testers. We choose the testers of the public beta ourselves from the confirmed addresses of its list; no automated means decide it (section 12).
Inviting the testers. To invite the testers we pick, we export their addresses, and only theirs, and give them to Apple's TestFlight and Google Play's testing track, which send the invitation. From then on Apple and Google process those addresses as independent controllers under their own policies (section 5). We export the confirmed addresses of a list for nothing else than sending the e-mails it is for.

4. The app and the game server

4.1 What we process, why, and for how long

Data	Details	Why we process it and on what basis	How long we keep it
Guest account	A random account identifier. A one-way hash (SHA-256) of each secret your devices hold: one secret per device, at most ten, each with when it was made and last used; the secrets themselves are never stored. The name your app plays under, sent when it connects and when you sit at a table. The gold the account holds. When the account was given the welcome gift for pairing (section 4.4), so that it is given once, and the day (in UTC) of the last game whose first win of the day paid it more, so that a day pays it once. The skin packs and dice it has bought with gold, with what each cost and when it was bought, and the pack and dice it has in use. If we offer packs of gold and you buy one (section 5), the store's receipt or transaction identifier, the pack it names and when it was credited to the account. When the account was created, last seen and first sat at a table.	To recognise your app when it reconnects, so your seats, your gold and what it bought stay yours. Necessary to provide the Service (Article 6(1)(b) GDPR).	Until you delete it in the app (section 10), or until it is merged into the account of the Google account or Game Center you sign in with (section 4.4). Otherwise, a job on our server that runs once an hour deletes an account that never took a seat 24 hours after it was last seen, and any other account 300 days after it was last seen (a room lives at most an hour after its last player, so such an account holds no seat); because the job runs hourly, either may happen up to an hour later. An account paired with Google or Game Center (the next row) is never deleted for inactivity. An account keeps its seats until their rooms are deleted (below). When an eleventh device takes the account back, the secret used longest ago is deleted.
Store identity (only if you sign in)	Which service the account is paired with, Google or Game Center, and the identifier that service gives us for you. With Google: the identifier of your Google account, a number Google assigns, not your e-mail address. With Game Center: the player identifiers Apple gives our games for you (the team player ID and the game player ID). When the pairing was made. No e-mail address, picture or friends list, and no name: the name that service knows you by reaches us only if it becomes your display name (next row).	So that a new or reset phone, signed in to the same Google account or Game Center, can take your account back, with its gold, Inventory and match history. This is also why buying in the Inventory needs a paired account: what you buy must not be lost with one phone (section 4.4). Necessary to provide the Service (Article 6(1)(b)): an account that is not lost with one phone.	Until the account is deleted (section 10). A pairing is not undone on its own, and a paired account is not deleted for inactivity.
Display name	The name you choose in the app's settings. The app lets you type 16 characters; the server accepts up to 24. On first launch the app draws one for you, such as "Player42". While you still play under that drawn name, signing in with Game Center or Google replaces it with the name that service knows you by: your Game Center alias, or the given name of your Google account (section 4.4). A name you typed yourself is never replaced.	To show the other players who is at the table. Necessary to provide the Service (Article 6(1)(b)).	Stored on your guest account, on each seat you take, in each game's record and in the match history of each game you finish. It goes with the account, with each room and with each match history entry, as the rows above and below say. In the archive of each game you played (the next row) it is kept.
Rooms and games	The six-digit room code. Each seat: name, colour, skin pack, dice, seat number, the rank and Renown it was taken at, account, whether it is connected (and which of our server processes holds its connection and speaks for the account), and when it left or was abandoned. The codes of the rooms your account holds a seat in. The island and its seed. The full state of the game, including every player's hand and held court cards, the decrees each seat could draft from (every decree of the game, the same for every seat) and the decrees it drafted, and which of them it played. A log of every game event, such as dice rolls, harvests, builds, trades, cards played, decrees drafted and decrees issued.	To run the game on the server, and to put you back in your seat after a dropped connection, a closed app or a server restart. Necessary to provide the Service (Article 6(1)(b)). Once the room is gone, the game's archive (next column): to look into faults, cheating and disputes about a game. The figures of a game, worked out from its record: to run the game and tune its rules, in the administration panel (section 6). Our legitimate interest in a working, fair and balanced game (Article 6(1)(f)).	The room, with its seats, goes on its own: a lobby 10 minutes after its last player left (at once when the last player leaves it on purpose), a finished game's room 10 minutes after the last player disconnects, and the room of a game nobody returns to 1 hour after the last player left. The game itself is then archived, within about 15 minutes, on the same server: the room code, whether it was an online table, the island and its seed, its last state (everything the state holds, each seat's hand, held court cards and decrees included) and its full event log, with the name and colour of each seat the state holds, but no account and no skin pack or dice. The archive is kept and is not deleted. It is never shown in the app or to other players. When a game is archived, its figures are worked out from it once and kept with the archive, for as long as it is: its counts, such as dice totals, steals, trades, court cards and buildings, for the table and for each seat; for each decree a seat held, when it was drafted and played and the tile it targeted; for each court card a seat bought, whether and when it was played and against which seat; whether that seat won; and, for those decrees and cards, the account the seat belonged to (none for a bot).
Match history	The result of each game played to its end: the room code, whether it was a custom or an online table, when and how it ended, the target, the size of the island, whether the table paid gold and whether a bot sat at it. For each seat of that table: the display name and colour it played under, whether it was a bot, its final score, its place, the gold it earned and whether that gold included the first win of the day, whether it won and whether it was abandoned, and the account it belonged to; at an online table also, for a player's seat, its Renown and rank before and after the game (the next row; a bot has none). This includes the names other players chose. Whether we voided the game, because we found it unfair (Terms, section 6), when, and our note on why; a voided game stays in the history, marked so.	To show each player the games they played, and what each paid, in the app. The decrees drafted in a game are not kept in the match history. Necessary to provide the Service (Article 6(1)(b)).	Kept after the room is deleted. When a guest account is merged into a paired one (section 4.4), its seats in every result move to that account. When an account is deleted (the "Guest account" row), its seats in every result forget it. A result goes once no account of its table is left: the same hourly job deletes it on its next run, whether the last of those accounts expired or was deleted in the app (section 10). Where none of those accounts is paired, that is at the latest 300 days and an hour after the last of its players was last seen; a paired account keeps its results for as long as it exists.
Ranked standing	Your place on the game's ladder, moved by every game you play at an online table: the rating behind your Renown (two numbers, a mean and a spread), how many such games you have played, a running measure of how your last games compared with what the rating expected, the rank you hold, your highest Renown so far, the display name you last played online under and when that was. When we void a game (the "Match history" row), the Renown it moved is taken back out of the standing of every seat at that table, and the game no longer counts among its games; restoring the game puts both back. When we correct an account's Renown (Terms, section 4), the mean moves with it, the rank is read again and the highest Renown is raised if the new one passed it; an account that never played online is given a standing of no games for it.	To rate your online games, show you your Renown and rank, seat you with players near you when you play online, and list the ladder's best players on the leaderboard. Necessary to provide the Service (Article 6(1)(b) GDPR).	Until the account is deleted (section 10). The standing goes with the account; when a guest account is merged into a paired one (section 4.4), the standing of the guest account is kept only where the paired account has none.
Reports	When you report a player from their detail at a table: your account, the account of the player you reported and the display name you saw them under, the room code and the game (none in a lobby), the reason you chose, the text you wrote, if any, and when you sent it. Then how we handled it: whether it is still open, resolved or dismissed, when we handled it, and our own note. When a player reports you, the same is kept about you.	To keep the tables fair: we read every report to act against cheating, collusion, play that spoils the game for others, abusive names and other breaches of the Terms of Service. The same reports limit how many a day one account can send, and keep one report per player and game. Our legitimate interest, and that of the other players, in fair and safe tables (Article 6(1)(f)).	For as long as needed to handle it and to document a suspension it led to. When either account is deleted, the report no longer points to it; the name the reported player was seen under, the reason and the text stay with the report.
Suspensions	If we suspend an account: whether for a time or indefinitely, its reason (one of the reasons a player can report another for: cheating, collusion, griefing, an abusive name, or another breach of the rules of the table), when the suspension began and when it ends, and our note on why; if we lift it early, when and our note on that. While a suspension lasts, the server refuses the account's connection and tells the app until when and for which reason. When we suspend an account that is connected or seated, a short notice through the live store tells our server at once, which closes its connections, gives up its seat and takes it out of the online queue; the notice holds the account identifier, the end of the suspension and its reason, and nothing of it is kept.	To keep an account that broke the Terms of Service away from the tables for as long as we decided, and to answer a complaint about it (Terms, section 13). Necessary to perform our agreement with you and every other player, whose games the Terms protect (Article 6(1)(b)), and our legitimate interest in fair tables (Article 6(1)(f)).	With the account, until it is deleted (section 10). A suspension that ended or was lifted stays with the account as its history.
Our record of moderation	Each thing we do in the administration panel that changes something (section 6): suspending an account or lifting a suspension, voiding a game or restoring it, resolving or dismissing a report, and correcting an account's gold or Renown. For each: when, what it concerned (an account, a game or a report, by its identifier), the kind, length and reason of a suspension, which figure a correction changed and by how much, with that figure before and after, and our note.	To account for every such decision, and to answer a complaint about one. Our legitimate interest in deciding fairly and being able to show it (Article 6(1)(f)).	For as long as needed to document the decisions it records. An account identifier in it points to nothing we hold once that account is deleted.
Online queue	While you wait for a table, your queue ticket: the name you queue under, your Renown, rank and placement, and when you joined the queue. The turn clocks of a running game.	To form a table and to keep the game moving. Necessary to provide the Service (Article 6(1)(b)).	The ticket is held in the server's live store (Redis, on the same server, as the next row says) while you wait, so that a restart of one part of the server does not cost you your place, and is deleted when you leave the queue, your connection ends or you are seated at a table. The turn clocks are never written down; they are held in the server's memory while you play.
Keyed hash of your network address	When a new guest account is created, a keyed hash (HMAC-SHA256 under a secret key held by the server) of your IP address, with the time of the registration. An IPv6 address is cut to its first 64 bits before hashing. The address itself is never stored. It is kept in the server's live store (Redis, on the same server), which writes its log to disk every second so that a restart does not lose it.	To limit how many guest accounts one network address can create: at most 20 in 24 hours as the server is set today. Our legitimate interest in protecting the Service from abuse (Article 6(1)(f)).	24 hours after the last account created from that address; the live store then deletes it by itself. It is stored apart from the account, and we never match the two.
Rate-limit counters	Counters keyed by the keyed hash of your IP address (above), never by the address itself, in the same live store: new guest accounts in a short burst, wrong room codes (10 a minute as set today) and open connections. One more counter, of new guest accounts for the whole server in one minute, holds no address at all. A separate counter limits the messages of each connection; it is kept in the server's memory with the connection, not with your address.	To stop floods and the guessing of room codes. Our legitimate interest in protecting the Service (Article 6(1)(f)).	The guest-account counters and the wrong-code counter are deleted within about a minute of your last attempt, the daily count of new accounts after 24 hours (the row above), and the count of open connections as soon as they close.
Server logs	The game server's own log: a request identifier, the method, the route, the status and the duration of each request. Some lines also carry a connection identifier, a room code, a seat or account identifier, the name of the server process or an error message. It never records what you send, and it does not record your IP address, with one exception: when a machine outside our own proxy sends the game server a forwarding header, the server notes that machine's address once, as a warning, each time it starts; behind our proxy that machine is never a player's phone. The administration panel's server keeps a log of the same shape about our own requests to it. The web server's fault lines (section 3) are kept the same way. The reverse proxy in front of all of them may keep the access log described in section 3.	To keep the Service secure and stable and to find the cause of failures. Our legitimate interest in running a secure and reliable service (Article 6(1)(f)).	For as long as the host keeps the container's log, which we keep to at most 30 days.
Store data	What Apple and Google give us about downloads of the app, as counts by country or region and date, and, if we offer packs of gold and you buy one (section 5), about that in-app purchase: an order or transaction identifier, the date, the country or region, the pack and the amount paid. If you allow it on your phone, crash reports. Reviews you post on the store, under the name the store shows. Source: Apple or Google.	Crediting a pack to your account (Article 6(1)(b)); accounting and tax duties for a purchase (Article 6(1)(c)); answering reviews, fixing faults and seeing how the game is taken up (Article 6(1)(f), our interest in a working game and in talking to players).	Records of a purchase: 5 years from the end of the year of the purchase (Polish tax law). Download counts and crash reports: as the store console keeps them. Reviews: while the store shows them.
Correspondence	E-mails you send us: your address, your name if you give it, and the content. This includes complaints, requests about your data and notices about illegal content.	To answer you and handle your request. Where needed, to establish, exercise or defend legal claims (Article 6(1)(b), (c) and (f)).	As long as the matter needs, then for the limitation period of possible claims: up to six years under Polish law.

Deletion is automatic, run by scheduled jobs: every fifteen minutes for games, every hour for accounts. Each period above can therefore run up to that much longer.

A guest account holds no e-mail, phone number, real name, device identifier, advertising identifier, location or contacts. The app reads none of these, with one exception: when you sign in, it reads the name the sign-in knows you by, on your device, to name you as the "Display name" row says. A paired account adds only the identifier in the "Store identity" row.

4.2 What you must provide

To play, the app needs a guest account and a display name, and the server needs your network address to register the account. Without them there is no seat to sit in. Nothing else is required. Pairing is your choice: you may decline the sign-in the app asks for when it starts, and without it the account lives only on the devices that hold its secret. Playing at a custom table never needs it. Playing online does not need it either as the server is set today; we may require a paired account for the online queue, and would say so here first. Buying in the Inventory does: the app asks you to pair before your first purchase (section 4.4). Without pairing you play, earn and look through the Inventory as before, but cannot buy. Reporting a player is your choice too, and the text of a report is optional for every reason but "Other".

Please do not use your real full name or anything sensitive as your display name. Other players read it (section 6).

4.3 On your device

The app keeps three small files in its private storage:

settings.cfg: your display name; the Sound and Music switches and the volume of each sound; the Haptics, Reduce motion and Quick dice switches; the frame rate, sharpness, anti-aliasing and shadows you chose; whether you answered the tutorial's invitation and whether you finished the tutorial; and, on Android, whether you dismissed Google's sign-in when the app started;
accounts.cfg: your guest account's identifier and its secret, the services it is paired with (only their names, such as "google"), and the last gold total the app read from the server, one entry per game server;
session.cfg: the game server's address, the code of your last room and the name you sat under, so the home screen can offer that seat back.

On a phone the app also keeps a log of its own errors and warnings, and of nothing else (logs/faults.log, the last five runs), so that a fault can be looked into: it may hold the game server's address, room codes and the names at a table, and never your secret. It is not sent anywhere; you may send it to us when you report a fault.

These files stay on your device. The secret is stored in plain text inside the app's private storage.

On Android, the app's data is excluded from backups and removed when you uninstall the app. On iOS, the files live in the app's own container. They are not shown in the Files app. As with other apps, iOS normally includes that container in a backup of your phone, and restores it with the backup. Either way, a paired account is not lost with the phone: a new one takes it back by signing in (section 4.4).

The app uses the clipboard in three ways only. Copy in a lobby puts the room code on it; Copy in Settings puts your account identifier on it, for a request about your data; Paste reads the clipboard only when you tap Paste, and fills in the keypad. Nothing is sent until you tap to join.

The app contains no advertising, analytics or crash-reporting code, and no third-party service that collects data. It talks to one server: ours. The one exception is the sign-in that pairs your account, which your phone's own Google or Game Center service carries out (section 5).

4.4 Pairing your account with Google or Game Center

Pairing is optional for play. On Android you sign in with Google; on iPhone and iPad, with Game Center. Signing in pairs the account, and pairing stores the same identifier however it starts:

When the app starts. While your account is not paired, the app asks your phone to sign you in each time it starts, once the home screen is up (on the very first launch, once you answer the tutorial's invitation, or once the tutorial you started from it ends or you leave it); you never wait for it. On iPhone and iPad, Game Center signs you in without a question if your device is signed in to it, and otherwise Apple may show its own sign-in, which you can cancel. On Android, the app first asks, without showing anything, for a Google account that has already allowed Tiland to sign in; if there is none, Google shows its sign-in sheet once. If you dismiss it, the app does not show it again when it starts.
Later. In the app's settings, or when you first buy something in the Inventory, which only a paired account can do: gold and what it buys are kept on the account, and an account that is not paired is lost with the phone that holds it.

Your phone hands the app a proof of that sign-in: a token from Google, or a signature from Game Center. The app sends it once to our server and keeps none of it. The server checks it against Google's published keys or Apple's certificate, keeps the identifier described in the "Store identity" row of section 4.1, and keeps nothing else. Google's token also names the e-mail address and the name of your Google account; the server does not keep them. So that a proof cannot be shown twice, the server keeps for 20 minutes a one-way hash (SHA-256) of each Game Center signature it has seen, and for 5 minutes, by connection, the random number a Google sign-in is asked to carry; both are kept in the live store (Redis), name nobody, and are deleted by it on time.

Your name. With the sign-in, your phone also tells the app the name that service knows you by: your Game Center alias, or the given name of your Google account. The app reads it on your device; it is not part of the proof. It uses it only while you still play under the name it drew for you (section 4.1, "Display name"), and then as your display name, cut to 16 characters; a name you typed yourself is never replaced. The app sends your display name beside the sign-in, so your account carries it at once. From then on it is your display name like any other: the server receives it when the app connects and when you sit at a table, and you can change it in the app's settings at any time.

A new device. On a new or reset phone, or a tablet, signed in to the same Google account or Game Center, pairing takes your account back. The device then gets a secret of its own.
Several devices. One account may be held by up to ten devices, such as a phone and a tablet. When it is used on a second device, the newest connection takes over: the older device's connection is closed, and it does not reconnect until you ask it to.
Two accounts become one. If the Google account or Game Center you sign in with is already paired with another Tiland account, the device switches to that one, and the guest account the device held before is merged into it. Its gold is added to that account's, and of the two days of a last first win of the day the later is kept, so a day never pays it twice. The skin packs and dice it owns become that account's; what both owned is kept once, and the pack and dice that account had in use stay in use. Its finished games, and their places in the match history, move to that account, except a game both accounts sat at, whose guest seat keeps its name and forgets its account. The guest account is then deleted, with its secret, and nothing of it is left on the server. A guest account is not merged while it holds a seat at a table that has not finished, and two paired accounts are never merged.
The welcome gift. The first time an account holds a pairing, it is given gold, once. The account keeps when that was, so that it is never given again: not for a second pairing, and not when a device switches to it.
For as long as the account lives. A pairing stays with the account until the account is deleted. There is no way to undo it on its own, because an account without it could be lost with a phone, and everything it bought with it. Deleting the account (section 10) deletes the identifier with it.

5. Apple and Google: the download, in-app purchases, signing in and the public beta

Tiland is free to download, from the App Store or from Google Play. Apple or Google handles the download and updates, as an independent controller under its own privacy policy:

Apple: https://www.apple.com/legal/privacy/
Google: https://policies.google.com/privacy

We may offer packs of gold for money, bought through the store's in-app purchase system (Terms of Service, section 4). None is offered as this policy takes effect, and today our game server checks no purchase and knows nothing about who downloaded the app. If you buy a pack, Apple or Google takes the payment, issues the receipt and handles taxes and refunds, under the policies above. We never receive your payment card details. Our game server would receive from the store only what it needs to credit the pack to your account: the store's receipt or transaction identifier and the pack it names. It would keep them with the account's purchases, as the "Guest account" row of section 4.1 says, and the store's own record of the purchase would reach us as the "Store data" row says.

We may also offer an optional premium through the store's in-app purchase system (Terms of Service, section 4, "Premium"). None is offered as this policy takes effect. If you buy it, the same holds as for a pack: Apple or Google takes the payment and handles renewals, cancellation, taxes and refunds, and we would say here, before it is offered, what our game server receives about it.

The sign-in that pairs your account (section 4.4), Google's on Android and Apple's Game Center on iPhone and iPad, is carried out by Google and Apple, again as independent controllers under the policies above. They may keep their own record that you used their sign-in with Tiland, which you manage in your Google account or in Game Center. From that sign-in we keep only the identifier in section 4.1, and your name there only if it becomes your display name (section 4.4). We tell Google and Apple nothing about your games.

The public beta (section 3.2) runs through Apple's TestFlight and Google Play's testing track. If we pick you as a tester and give them your address, Apple or Google sends you the invitation and delivers the testing builds, again as an independent controller under the policies above.

What the stores pass on to us about downloads, purchases, crash reports and reviews is in the "Store data" row of section 4.1.

6. Who can see what

Tiland seats people at a shared table. This is who sees what:

In a lobby, everyone at the table sees each seat's display name, colour, skin pack and dice, and whether it is connected.
In a game, everyone at the table sees each seat's name, colour, skin pack, dice and whether it is connected, away or abandoned. They also see its score, how many resources and court cards it holds, its mercenaries played, road length, harbour points and whether it played a Treasury. Every building, road, trade offer, counter-offer and game event is shown to the whole table, and so is the moment a player starts writing a counter-offer.
No other player sees your hand. Other players see only how many resources you hold (we can, in the administration panel, below). An accept or a counter-offer you send shows the table that you hold the resources it would cost, and if you can no longer pay it, the table sees it turn into a decline. Every seat's score is shown to the whole table throughout the game. When the game ends, everyone at the table sees each seat's place, the gold it earned, and whether that gold included its first win of the day.
Decrees. Every seat drafts from the same decrees, all of the game's, and nothing about a decree is owned or bought. A decree you pick in the draft is hidden until every seat has picked; from then on everyone at the table sees each seat's drafted decrees and which of them it has played, until the room is deleted.
In the match history, each player who sat at a finished game sees its result: every seat's name, colour, final score, place, gold, whose gold included a first win of the day, who won, which seats were bots or abandoned, and whether we voided the game (never our note on why). Only the players of that table see it; nobody else can look it up.
Reports are read by us alone. Nobody at the table is told that a report was sent, and we do not tell a reported player who reported them.
A suspension is shown to the player of the suspended account only, as the date and time it ends, or as indefinite, with its reason (such as cheating or griefing); our note on why is not shown in the app. The other players of a table see the suspended player's seat given up, as they would see any abandoned seat, and are not told why.
Your gold total is shown to you only; nobody else can look them up.
Your rank and your Renown are shown at the table, beside your name, to everybody who sits with you, as your colour is (the rank on your seat's line, both in your player detail); the rank screen shows them to you with your progress. The leaderboard lists the ladder's best players to every player of the game: the display name each last played online under, their rank, their Renown and how many online games they have played. You are on it once you have played your ten placement games and have played online in the last thirty days, and you leave it by not playing online for thirty days. Nothing else of your standing is shown to anyone.
Whether your account is paired, and with which service, is shown to you only. Other players never see it. They see your Game Center alias or your Google given name only if it became your display name (section 4.4), as they see any display name.
The skin packs and dice you own are shown to you only. The pack a seat of yours wears and the dice it rolls are seen by everyone at that table.
Your e-mail address, if you join the wishlist or the public beta, is seen by us and by Resend, which sends the e-mails (section 7), and, if we pick you as a tester of the public beta, by Apple or Google (section 5). No other player ever sees it.
Anyone with a room code can join that room's lobby while it has an empty seat.
Display names are chosen freely and are not filtered. Other players can see whatever name you choose.
The operator can see an account, its games and their figures in an administration panel, to run the game, tune it and keep its tables fair: the account's name, when it was made and last seen and first sat at a table, how many games it played and won, and the table it is sitting at now, its gold, what it owns, its ranked standing, which service it is paired with and since when (never the identifier that service gives us, and never a device's secret), and the match history of its games; every running game as the server holds it, hands included; and every archived game with its figures (section 4.1, "Rooms and games"), with the name and colour of each seat as its result holds them; and the server's counts: live connections, rooms, games and queue tickets, the name of each of our server processes with what it holds, how many games ended or were walked away from and accounts were made today, and how many games the archive holds; every report (section 4.1, "Reports") and every suspension, with our notes. Nobody else can open the panel, and it shows nothing to players. The panel changes only what moderation needs: it suspends an account or lifts a suspension, voids a finished game or restores it (which moves the Renown of that game's seats, section 4.1), marks a report resolved or dismissed, and corrects an account's gold or Renown (Terms, section 4), and each of these is written to our record of moderation. Beyond the suspended player's seat being given up, nothing in it changes a running game, and nothing in it changes what an account owns.

There is no chat. The display name is the only text one player writes that another reads. The text of a report is read by us alone.

7. Recipients

We do not sell or rent personal data. We share it only with the providers below, which process it on our behalf, with public authorities when the law requires it, and, to invite the testers we pick to the public beta, with Apple and Google (section 3.2).

Provider	What they do for us	Where the data is
netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany	Hosts the servers that run the website, the game server, the administration panel, the databases (the game's, and the website's lists), the live store and their logs.	Nuremberg, Germany
MXroute LLC, Hallsville, Texas, United States	Hosts the mailbox behind contact@littlebyte.studio, through which we receive and answer your e-mails.	United States
PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States	Runs the website's analytics, only after you accept them in the cookie bar (section 3.1): it receives the events listed there and keeps them in its EU cloud.	Frankfurt, Germany
Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States	Sends the e-mails of the wishlist and the public beta on our behalf: the confirmation and welcome e-mails, the launch news, the marketing and beta e-mails, and the unsubscribe links you ask for. It receives the address each is sent to and the e-mail itself.	United States

We use no other providers. Apple and Google are not our providers; they act for themselves (section 5), the addresses of the testers we pick included once we give them over.

8. International transfers

The website and its lists, the game server, the administration panel, the database, the live store and their logs are in Germany, in the European Union.

PostHog analytics data (section 3.1) is stored in Frankfurt, Germany. PostHog, Inc. is a US company and may access that data as our processor; such access is covered by the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), which are part of PostHog's data processing agreement, with the supplementary measures described there, and, for as long as PostHog, Inc. holds a valid certification, by the EU-US Data Privacy Framework.

MXroute LLC hosts our e-mail in the United States. E-mail you send to contact@littlebyte.studio is therefore stored there. The transfer is based on the Standard Contractual Clauses adopted by the European Commission. If you would rather your correspondence stayed in the EU, tell us and we will agree another way to talk.

Resend, Inc. sends the e-mails of the wishlist and the public beta from the United States. The address you signed up with, and each e-mail sent to it, therefore reach it there. The transfer is based on the Standard Contractual Clauses adopted by the European Commission.

When we give the addresses of the testers we pick to Apple and Google (section 3.2), they receive it as independent controllers, and their own policies (section 5) say where they process it.

We transfer personal data nowhere else outside the European Economic Area.

9. Security

The app reaches the game server only over an encrypted connection (wss://). The website is served over HTTPS.
The app sends its secret only in the first message of each connection, and never shows or logs it.
The server stores only a hash of each secret and compares it in constant time.
A pairing proof, Google's token or Game Center's signature, is checked against Google's published keys or Apple's certificate, used once and never stored.
Your network address is never stored in clear, and the game server's own log does not record it, save the one warning described in section 4.1 (Server logs), which behind our proxy never names a player's phone.
Every connection to our servers ends its encryption at a reverse proxy of ours (section 3). The databases, the website's lists included, and the live store are not reachable from the internet; the game server is reached only through its public interface, and the administration panel (below) changes only what moderation needs (section 6).
Access to our servers is limited to the operator and protected by key-based authentication.
The administration panel (section 6) is served only over HTTPS, behind a password and a session that lasts 12 hours as the panel is set today, and one address may try five wrong passwords a minute. It reads the database under a role of its own that may not read the hashes of device secrets or the identifiers Google and Game Center give us, and may change only what moderation writes: the handling of reports, suspensions, a game's void and the Renown it moves, an account's gold and Renown when we correct them, and our record of moderation. It writes nothing to the live store but the notice of a suspension (section 4.1, "Suspensions"). Each part of the server, the game server, the panel and the two deletion jobs, has a database role of its own that may do only its own work.

No system is perfectly secure. If a personal data breach is likely to put you at risk, we will notify the supervisory authority and, where required, the people affected, as the GDPR requires.

10. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
rectify inaccurate data: you can change your display name in the app's settings, and the new name is used at the next table you sit at;
erasure of your data (see below);
restriction of processing: while we check data you say is inaccurate or an objection you made, where the processing is unlawful but you prefer restriction to erasure, or where we no longer need the data but you need it for a legal claim;
data portability for the data you gave us, in a machine-readable format;
object to processing based on our legitimate interests, on grounds relating to your situation;
withdraw your consent at any time: to the wishlist or the public beta through the unsubscribe link in every e-mail we send to a list from the welcome e-mail on, on https://tiland.app/unsubscribe, or by writing to us; to the website's analytics with "Cookie settings" in the footer of every page (section 3.1). Withdrawing does not affect what we did before (Article 7(3) GDPR);
lodge a complaint with a supervisory authority (section 14).

Consent is the basis of the website's analytics (section 3.1) and of the wishlist and the public beta (section 3.2) only. Nothing else in this policy relies on it.

How to ask. To delete your account, you need not ask: the app does it (below). For anything else, e-mail contact@littlebyte.studio. A guest account has no e-mail address, so we must find it another way. Tell us your display name, roughly when you last played, and the code of your last room if you still have it. A room code stops helping once its room is deleted (section 4.1). If we cannot tell your account apart from others with confidence, we will say so. We then cannot act on that account (Article 11 GDPR), and it expires on its own schedule. For the wishlist or the public beta, write from the address you signed up with.

We answer within one month. For complex or numerous requests we may extend this by two more months and will tell you if we do. Exercising your rights costs you nothing.

Deleting your account

The page https://tiland.app/delete-account says the same in short.

In the app. Open Settings and tap Delete account, then confirm. The server deletes the account at once: the secret each of your devices holds, its pairing with Google or Game Center, its gold, its ranked standing, the skin packs and dice it owns, and any suspension it carries. No device can use the account again. While the account holds a seat at a table that has not finished, in a lobby or in a running game, the app cannot delete it; leave the lobby, or let the game end, and try again.
Write to us as described above, if you no longer have the app, and we delete the account and confirm. If the account is paired, you can instead take it back on any device signed in to the same Google account or Game Center, and delete it there in the app.

Deletion is final. Nobody, including us, can restore a deleted account.

An account also ends on its own. If it is not paired and you delete the app, its secret goes with it and nobody, including us, can use the account again (on iOS, a phone backup may still hold the secret, section 4.3); the server then deletes it on the schedule in section 4.1. A paired account is not lost with the app and is not deleted for inactivity: it waits for you to sign in again, so delete it in the app or write to us.

A game's record belongs to the whole table. We do not delete a running game that other players are still in. If your account still holds a seat there when you write to us, we delete the account once that room is gone.

The same goes for the match history. When your account is deleted, your seats in it no longer point to you, but the other players of those tables keep their results, your display name included, until none of their accounts is left (section 4.1). If you want your name taken out of those results, write to us and we will replace it.

The archive of the games you played (section 4.1, "Rooms and games") holds no account, so deleting your account does not change it; it keeps the name each seat played under. The figures kept with it (the same row) still carry the identifier of the account a seat belonged to; once the account is deleted, that identifier points to nothing we hold. If you want your name taken out of the archive, or that identifier out of its figures, write to us with the name and roughly when you played, and we will do it.

Reports you sent, and reports about you, no longer point to your account once it is deleted; they keep the name the reported player was seen under, the reason and the text, for as long as section 4.1 ("Reports") says. Our record of moderation keeps the identifier of the account it concerned, which then points to nothing we hold.

11. Children

The Service is not directed at children. You must be at least 16 years old to use it, or to join the wishlist or apply for the public beta, as the Terms of Service say. The app has no age check. We do not knowingly process the data of anyone under 16. If you believe a child has used the Service, contact us and we will delete their data.

12. Automated decision-making

We make no decision about you based solely on automated processing, and we do not profile you.

The game's own rules act automatically: a seat that lets its clock run out loses the turn; when a game ends, each seat is placed and paid by its points; every online game moves your Renown and rank by how you placed and who sat at the table; and the online queue seats you with players whose Renown is near yours, filling the rest with bots. These are rules of the game, the same for every player, and not decisions about you as a person; none of them has a legal effect on you or affects you in a similarly significant way. The figures of finished games (section 4.1, "Rooms and games") are read to tune the rules for everybody, and no decision about a player is made from them.

Suspending an account, voiding a game and handling a report are decided by a person, who reads the reports and the record of the game, never by automated means. So is choosing the testers of the public beta (section 3.2). The server then applies the decision: it refuses the suspended account's connection until the suspension ends, and moves back the Renown of a voided game.

13. Changes to this policy

We may update this policy when the Service, our providers or the law change. We publish the new version at https://tiland.app/privacy with a new effective date. We announce material changes at least 14 days before they take effect, on the website and in the app's release notes on the store.

14. Contact and complaints

For anything about your personal data, write to contact@littlebyte.studio or to LITTLE BYTE STUDIO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Ludźmierska 26A, 34-400 Nowy Targ, Poland.

If you believe we process your data unlawfully, you may complain to a supervisory authority. You can do so in the EU country where you live, work, or where the alleged breach took place. The authority responsible for us is the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl.