Privacy Policy

Last updated: November 6, 2026 · Describes the store versions of the iOS and Android apps and the Diamonds store on the website.

Diyar Online is operated by Minata Entertainment, LLC ("we"), a limited liability company organized in Delaware (USA); Minata Entertainment, LLC is responsible for the personal data described here.

In short

You can play Diyar Online as a guest, without an account: you are then known only by a random ID stored on your device, and no email is asked. If you create an optional account (email + password) you can use the Diamonds store, get the premium Season Path and continue your character on other devices; in that case the account and purchase data below is processed. The app has only rewarded ads that you choose to watch; the ads are not personalized and no tracking permission is asked (details). To keep out fake clients and cheating, the app proves itself to the server with device verification and uses a random ID specific to the installation for it; this ID is not for ads or tracking and is not tied to your account (details). The promo pages and the wiki do no visitor tracking and show no ads; in your browser they store only what is necessary (your cookie choice included, details). Diamonds can be bought inside the app through the App Store or Google Play; your card and payment details never reach us. We do not sell your data. When you download and play the app through the App Store or Google Play, Apple's and Google's own terms and privacy policies apply as well (details).

You can also create your account with Sign in with Apple or Sign in with Google instead of an email and password, or link one of them to an existing account: for that the account ID the provider gives and your email address are stored, but not your name or photo. You can remove the link at any time in Settings › Account (details).

If you play with an account, your achievements and season score record can also appear in Game Center on iOS and Google Play Games on Android: for that your account is linked to your player account on the platform, and you can remove the link at any time (details).

Your account holds only a two-letter code for the country you last used the app from; it is there to send announcements that fit your region and is neither a location nor an IP address (details).

Who controls your data?

The data controller, who decides the purposes and means of processing your personal data, is the company that operates and publishes the game:

The company that publishes the web edition and this site (diyar.itemgold.com):

Noventra is the publisher of the web edition and of this site only; it is responsible, in its own name, for the technical records made when it serves the site and for its own services such as the Itemgold membership. The publisher and seller of the mobile apps (App Store, Google Play), the operator of the game service and the only controller of the account and game data is Minata Entertainment, LLC.

For privacy and data requests: privacy@playdiyar.com; for general contact: hello@playdiyar.com or the support page. The company has no establishment in the European Economic Area or the United Kingdom and has not appointed a representative for them; people living there send their requests to the same address and get the answer directly from the company.

The promo site and the wiki

• In this policy, "the site" means diyar.itemgold.com and the other addresses the game and the mobile apps use to provide the service. The promo pages, the legal pages are published on diyar.itemgold.com.
• The promo pages and the wiki do no visitor tracking by cookie, fingerprinting or any other means; there is no form, account or login on these pages. Only what is necessary is stored in the browser: your cookie choice (Cookies and local storage).
• Fonts, images (the app store badges included) and scripts come from this site; there are no third-party analytics, ads or social network plugins. The Itemgold bar at the top of the page and the Itemgold links in the footer are plain links: unless you press one, your browser makes no request to itemgold.com and the bar leaves no cookie or local storage; on Itemgold's own pages Itemgold's own terms and privacy policy apply.
• The site is published on Cloudflare's infrastructure (Workers), and so is the game client. The servers that process account, game and purchase data (the account service and the game server) are at OVH and are reached through the Cloudflare network (details). While serving a page Cloudflare may process the IP address and browser information of a request as a technical record; we do not track anyone with these records. This site is hosted in Itemgold's Cloudflare account: the technical records made while its pages are served are in that account and are the responsibility of its publisher Noventra (who is responsible for what).
• The site does not let you play the game. When we link to an app store, that store's own policy applies on its page.

Playing as a guest

The game keeps your settings and progress in the app's local storage areas on your device (localStorage and IndexedDB); these stay on your device and are lost when you clear the app's data or remove the app:

• Guest ID (token): a random code the server generates when you first connect; your character is tied to it. Whoever knows the code opens the character, so do not share it. If you clear the app's data or remove the app you lose access to the code and your character; if you have linked it to an account you can reach it again with your account.
• Your character creation choices, interface scale, sound and tutorial progress. If you play without connecting to a server (local mode), saves and backups stay in IndexedDB.
• Guest characters get no Diamonds or store rights; the store works only with an account.
• The Game Center / Play Games link also works only with an account; nothing is written to the platform for guest characters.

If you create an account

The server stores:

Emails (verification, password reset and, if you consented, news emails) are sent through Cloudflare's email service; to deliver the message the service processes your address and the content of the message.

Email news and events (optional): If you turn on "Email news and events" in the app with your explicit consent, we send news about new events, seasons and compensation to the email address on your account. It is off by default; you can turn it off any time with the "Unsubscribe" link in every email (no sign-in needed, one click) or in the app under Settings › Notification preferences. We may email service announcements (maintenance, terms changes, account and security notices) regardless of this choice. We keep the time and wording version of your consent (and, if you withdraw it, the time and way of the withdrawal) and a suppression record of your address that lets us honor your opt-out until your account is deleted; addresses that cannot be delivered to permanently, or that report a message as unwanted, are added to this record too and we send them no email. The send record, which shows which announcement was sent to or skipped for which account, holds no address and is deleted after 180 days. When you delete your account your consent and suppression records are deleted too.

Last seen country: Your account holds a two-letter country code that shows the country you last used the app from. The code is the country information Cloudflare gives for the IP address of your request; this field holds no IP address, city, region or other location. It is not shown to you on screen; only our authorized administrators see it, in the admin panel and under audited permissions. If the app registers your device for push notifications, the same code is kept in that registration too. Its only purpose is to send announcements that fit your region (events, maintenance, compensation) to the players concerned, in the game, by email or as a notification; it is not used for advertising, profiling or sale, and it is not sent to the email service, the notification service, the ads SDK or any other third party. It is kept as long as the account is open, is replaced by the new value when it changes or at most every 6 hours, and is deleted (with the device registration) when you delete your account. If you want to object to it being stored, write to privacy@playdiyar.com.

Sign in with Apple and Sign in with Google

You can create your account with Sign in with Apple or Sign in with Google instead of an email and password, or link one or both of them to an existing account. These ways to sign in are optional: you can also create an account with an email and password. You sign in on the provider's own screen; we never see, receive or store the password of your Apple or Google account. The provider gives us a signed identity token; our server checks the signature and reads only the information below from it. The token itself is not stored; neither the token, your email nor the provider ID is written to a log. The server stores:

• What we do not take: only the email permission is requested from Apple, and only identity and email from Google; your name, surname and profile photo are not requested, not stored on our server and not used. The password of your Apple or Google account never reaches us either.
• What for, and where: to verify your sign-in, recognise your account and match the sign-in with it; it is kept with the rest of your account on our own server (the server and the database are in OVH's data center in France; encrypted cloud backups are kept at Cloudflare, details and retention periods). It is not used for advertising, profiling or sale.
• Matching an account: if the email address that Apple or Google has verified is the same as that of an existing account of ours whose email is verified, no new account is created; the sign-in method is added to that account and you sign in to it. Apple relay addresses are never used for this matching. If the account with the same address has not verified its email, no matching is done and the sign-in is refused, so that nobody can open an account in advance and lock you out.
• Password: an account you created with Apple or Google has no password until you add one (Settings › Account › Sign-in methods › Add password). On an account without a password no password is asked to delete the account either; you only confirm.
• What goes to Apple and Google: when you sign in, your device talks to the provider through the provider's own sign-in screen; that is the provider's service. Our server sends Google no user data: Sign in with Google is only to verify your identity; to check the signature we download Google's public keys, we do not ask Google for a refresh token and we do not reach any other data in your Google account. From Apple we also download the public keys for the signature (those requests hold none of your data); we send Apple only, to turn the one-time authorization code we got at sign-in into a refresh token and later to revoke that token, a request signed with the company's Apple key; we do not send your email, your name or other account data.
• Third parties: we do not share this information with any third party for advertising, analytics or sale; only the infrastructure providers that run the service (OVH and Cloudflare, Who is it shared with?) process it, in the same way as the rest of your account. Apple and Google, as the parties that provide the sign-in, process data in their own name; for that Apple's and Google's own terms of service and privacy policies apply (Apple: Sign in with Apple and privacy, Apple Privacy Policy, Google Terms of Service, Google Privacy Policy).
• Removing the link: in Settings › Account tab › Sign-in methods tap Remove on the linked Apple or Google row and confirm. The record of the link (the provider account ID, the email the provider reported and, if any, the encrypted Apple token) is deleted at once; for an Apple link an attempt is also made to revoke the token at Apple. Your account is not deleted and your account's email address stays on the account. You cannot remove your only way to sign in: first add a password or link another account. You can link again later.
• If you delete your account: when the 14-day wait is over, if you signed in with Apple the stored Apple token is revoked at Apple and all your sign-in records (the provider account ID, the email, the encrypted token) are deleted; even if Apple does not answer the revocation, the records we hold are deleted. During the wait the records stay; if you sign in to the account (with Apple or Google too) the deletion is cancelled.
• How long it is kept: until you remove the link or delete your account; there is no separate retention period. The hand-over record of Apple sign-in on Android is valid for 60 seconds at most.

Game Center and Google Play Games link

If you play with an account, your achievements and season score record can also appear in Apple's Game Center on iOS and in Google's Play Games service on Android. For that we link your account to your player account on the platform. The link is optional: if you are signed in to the platform and play with your account, the app sets the link up itself; signing in to the platform, or declining the sign-in request, is up to you, and you can remove the link at any time in the game's Settings. Guest characters cannot be linked; nothing is written to the platform for them. Achievements and rankings on the platform are only a showcase: they give no reward, Diamonds or power in the game, and the game reads nothing from your status on the platform. Once linked, the server stores:

• What goes to the platform: your achievement progress (which achievement, how far) and your season score record; the highest values of the characters on your account are combined. Your character name, level, email, account ID, IP address and other game data are not sent. On the platform these values appear with your platform profile (the name Apple or Google manages for you) and can be seen by others on the platform's friends and ranking screens; your Diyar character name is not given to the platform.
• Apple (iOS): when you link, the device gets Game Center's identity signature from Apple; our server downloads Apple's certificate from Apple to check the signature against it (that request holds none of your data). When writing, our server sends Apple's App Store Connect API the app's bundle ID, your game player ID, the achievement or leaderboard ID, and the percentage or score; we sign the request with the company's Apple key and no other information that identifies you is sent.
• Google (Android): when you link, the device creates a one-time server access code that Google gives; our server sends the code to Google to get the token and reads only the player ID from Google. When writing, our server sends Google's Games API, with the token, the achievement or leaderboard ID and the steps or score.
• Game Center and Play Games are the platforms' own services; for the data held on the platform Apple's and Google's terms and privacy policies also apply (Apple Privacy Policy, Google Privacy Policy).
• Removing the link: you can remove it at any time with "Unlink" in Settings › Achievements and leaderboard; your link record, all your write records and (on Android) the token are deleted at once, and for Google an attempt is also made to revoke the token. Achievements and scores already written to the platform are not deleted: they are in your account on the platform and are managed in that platform's own settings. After you remove it the app does not link you again on its own; to link again you tap "Connect" in Settings. The fact that you removed it is kept on this device: if you clear the app's data or play with your account on another device, the app may try to set the link up again; you can remove it again in Settings. If you link again, the current state is written again.
• If you delete your account: once the deletion is final (after the 14-day wait) your link, write records and token are deleted; during the wait nothing is written to the platform.
• How long it is kept: until you remove the link or delete your account; there is no separate retention period.

Device verification and the install ID

When the app connects to the server it proves that it is a genuine, unmodified app. The purpose is to keep out fake or modified clients, cheating and abuse (mass fake accounts, automated requests). This verification is not used for advertising, tracking or analytics, is not sold to third parties and does not link you with your data in other apps and websites. It runs inside the app whether you are a guest or have an account; the promo pages do not use it. The server stores:

This record holds no IP address, browser or device model, operating system version, account or character information.

• The install ID is a random ID the app makes itself the first time it opens; it is not a hardware number, an advertising ID, or an account or character ID, and it is not tied to your account or character. It is kept in the app's own secure storage (the Keychain on iOS, encrypted preferences on Android) and is renewed when you delete and reinstall the app.
• Apple and Google: on iOS the device itself gets the proof from Apple's App Attest system service; our server sends nothing to Apple and checks the proof itself against the root certificate Apple publishes. On Android, the encrypted integrity token that Google Play services create on the device and the app's package name are sent from our server to Google Play Integrity; your install ID, account, email or IP address are not sent (Google sees our server's address). Google returns a verdict on the integrity of the device and the app. Apple's and Google's own policies also apply to these platform operations.
• If verification fails the server may reject the request or the game connection, and you are asked to update or reopen the app. The result creates no record on your account or character.
• How long it is kept: the install record is deleted automatically 90 days after the last verification. Because the record is not tied to an account or a character, deleting your account does not delete it; if you want it deleted sooner, write to privacy@playdiyar.com and, if you give us the install ID, we delete the record by hand (if you do not know the ID the record cannot be matched to you and deletes itself after 90 days). The verification challenge (a one-time random text) is deleted after 5 minutes. Rate limit counters hold the IP address as a digest, not raw, and are deleted after 24 hours. The technical log records only the result, platform, app, build number, level and the first 8 characters of the install ID; no IP address and no token.

Purchase records and the app stores

Inside the app, Diamonds and other purchases are made only through the App Store (Apple) or Google Play (Google). The store processes the payment and the payment details (card, billing address, your Apple or Google account); these never reach us. The store also processes data in its own name for the payment and its own obligations; Apple's and Google's own terms and privacy policies apply to that: Apple Privacy Policy, Google Privacy Policy. We store what is needed to verify a purchase and to credit the Diamonds to your account:

• Order records: the product (package), amount and currency, status, order time, the transaction and receipt IDs the store gives, and the store's signed transaction data (evidence for disputes and audits).
• Refund and dispute records: when the store reports a refund or a dispute, and their effect on the account.
• The Diamonds ledger: every increase and decrease of your balance (purchase, bonus, free earnings, spending, reversals) and your entitlement records (the cosmetics, passes, timed and counted items you bought).
• Administrator actions: if an administrator acts on an account, it is written with its reason to an audit log that cannot be altered.

Ads and consent

• The app has only rewarded ads that you choose to watch (Google AdMob). There are no banner or interstitial ads. The reward is credited to your account after the server verifies it.
• Ads are not personalized: on iOS the tracking permission (App Tracking Transparency) is not asked and ad requests are made as non-personalized requests; we do not link you with data from other apps and websites and do not give it to data brokers.
• To serve, secure and measure the ad, Google's ads SDK may collect from your device the IP address (and the approximate location derived from it), device and advertising identifiers, ad and interaction data, and performance and crash information; Google processes these under its own policy (Google advertising policy). We do not have access to this data.
• To verify the reward, a random digest derived from your account and a ticket code are sent to Google; your email and character name are not.
• Consent: in the European Economic Area, the United Kingdom and other places that require it, Google's consent tool (UMP) shows a form before an ad. Without consent no ad is requested at all; the rest of the game is not affected. You can change your choice later from the Ad privacy options row in the Diamonds store (it appears only where it is required).
• You can reset or limit your device's advertising ID in the operating system settings.

Support requests

When you open a support request (guests can too) we store what you write, the image / video / text files you attach, your account or character ID, the app version, the device model, the operating system version, your language, the map / level context and, if you agree, the latest error log (at most 16 KB). If you report a player, the reported character and your chat excerpt are added. Location and device details are stripped from images; videos may keep device details. Attachments are visible only to you and our authorized support team, have no public address, and are deleted 30 days after the request is closed; the request text is deleted 24 months after it is closed. When you delete your account the attachments are deleted at once and what you wrote is anonymized.

Game data and logs

• Where it is kept: the servers that process account, character, order and support data (the api and the game server) and our databases (PostgreSQL) run on our server in OVH's data center in France; support attachments and the server logs are kept on that server too. Traffic from the app and the website to our servers (the game's WebSocket connection included) passes through the Cloudflare network: Cloudflare receives the request, checks it for attacks and abuse (firewall, rate limits) and forwards it to our server through an encrypted tunnel; while doing so it processes the IP address and the content of the request in transit. Encrypted database backups are written to Cloudflare R2 (How long is it kept?).
• Character data: the character name; class, weapon, looks, level, XP, stats, bag and gold, profession levels, quest and tutorial progress, map and position, the people you blocked, your cosmetic choices and your season progress. For a guest this data is tied to the SHA-256 hash of the ID.
• World data: the house you built, the village and its treasury, corpses, boss timers, ranking and Hall of Honor records. The server database is backed up regularly.
• Chat messages are passed on to the players concerned in real time and are not written to the database (a whisper to someone who is offline may be left for them as a notification). A profanity filter masks messages on the server automatically.
• Server log: when a player connects the log records the IP address, character name, map and online count; errors and performance measurements are logged too. Session and ID codes are never logged. The IP address is also counted briefly in memory to limit how many new characters / accounts one address can open.

Purposes and legal bases

• Performance of the contract: account, character, order, delivery and refund; providing the game to you.
• Legal obligation: keeping order and payment records that tax and accounting rules require.
• Legitimate interest: security, preventing fraud and account takeover, verifying that the app is genuine and unmodified (device verification), defending against payment disputes (session and order records), verifying rewarded ads, and running the service and delivering announcements that fit your region (last seen country).
• Consent: where required, the consent you give for ads through Google's consent tool; the "Email news and events" choice you turn on in the app with your explicit consent (off by default, details). We send no other marketing email. You can withdraw your consent at any time.
• Performance of the contract (platform link): reflecting your achievements and season score record in Game Center / Play Games is an optional feature the game offers you; you can remove the link at any time (details).
• Performance of the contract (Sign in with Apple / Sign in with Google): creating your account with the provider's identity, verifying your sign-in and matching it with your existing account is an optional way to sign in that the game offers you; you can remove the link at any time (details). Revoking the Apple token when your account is deleted is required by Apple's rule for Sign in with Apple.

Who is it shared with?

• Apple and Google (the app stores): transaction information is exchanged with the store to verify purchases and to receive refund notices; the store also processes data in its own name (above).
• Google (AdMob, ad and consent tools): to serve, verify and measure the rewarded ad (Ads and consent).
• Apple and Google (device verification): on iOS the device uses Apple's App Attest service and our server sends no data to Apple; on Android our server sends Google Play Integrity the integrity token the device created and the package name (Device verification).
• Apple and Google (Game Center / Play Games): if you linked, to write your achievements and scores to the platform; Apple gets your game player ID with the achievement / score values, Google gets the achievement / score values with the token (Game Center and Google Play Games link).
• Apple and Google (Sign in with Apple / Sign in with Google): at sign-in the provider verifies your identity and processes data in its own name; our server sends Google no user data and sends Apple only the code and the token needed to obtain and revoke the refresh token (Sign in with Apple and Sign in with Google).
• OVH (OVHcloud; server hosting, data center in France): our servers and databases that process account, character, order and support data, support attachments, server logs and local backups are kept here; OVH processes this data on our behalf and only to host the server (Game data and logs).
• Cloudflare (network and security, static site and game client, backup storage, email service): traffic from the app and the website to our servers passes through the Cloudflare network (content delivery, firewall and rate limits, encrypted tunnel); the site and the game client are published on Cloudflare; encrypted database backups are kept in Cloudflare R2; verification and password reset emails, and news emails if you consented, are sent with Cloudflare's email service; emails you write to us (addresses such as privacy@ and support@) are forwarded by Cloudflare's email routing to the company's inbox (Google Gmail).
• NOVENTRA STUDIOS, LLC (Itemgold) (USA; publisher of the web edition and infrastructure provider): the site, the game client, the administration panel and the content delivery of Diyar Online run in Itemgold's Cloudflare account; the traffic from the app and the website to our servers (firewall, rate limits, encrypted tunnel) and the encrypted database backups pass through that account as well. The technical records made while this site's pages are served (IP address, browser information) are Noventra's own responsibility. For the account, game and purchase data this infrastructure carries and backs up, Itemgold processes that data only to host, carry and protect it, on our behalf and on our instructions, for the purposes in this policy (as a sub-processor), and does not use it for its own purposes (The promo site and the wiki).
• Lawyers, accountants and competent public authorities: only when a legal obligation or the defense of a right requires it.
• We do not sell your data and use no third-party tracking for analytics. Sharing for advertising happens only through the ads SDK above.
• Transfers abroad: the servers that hold your data are in OVH's data center in France; the company is in the USA, Cloudflare receives requests in its network at many places around the world, and some of the providers above are in the USA and other countries, so your data may be processed outside the country you live in. These transfers rest on the standard contractual clauses in the providers' data processing terms or on other valid transfer mechanisms such as the EU–US Data Privacy Framework; providers that process data on our behalf use it only on our instructions and for the purposes in this policy.
• In the game, your character name, looks, weapon, level and chosen cosmetics (and your title, if you have one) are visible to other players on the same map; rankings and the Hall of Honor are public to other players.

How long is it kept?

• Sessions: 30 days; expired sessions are deleted. A verification link is valid for 2 days and a password reset link for 1 hour; records of used or expired links are deleted after 7 days.
• Account and character data: as long as the account is open; if you delete the account, the "deleting your account" rule below applies. The sign-up and last login IP addresses are kept with the account record.
• Order, payment, refund and ledger records: kept without a time limit for tax and accounting obligations and to defend against payment disputes; once the account is deleted these records no longer hold personal details (email, name).
• Support requests: attachments 30 days after the request is closed; the request text 24 months after it is closed.
• Game server logs (including the IP address of a connection): kept for at most 30 days for security and defense against disputes, then deleted.
• Install record (device verification): deleted 90 days after the last verification; it has no link to an account (details).
• Consent to email news and events: the time and wording version of your consent (and, if you withdraw it, the time and way of the withdrawal) and the suppression record of your address that we keep to honor your opt-out are kept until your account is deleted; deleting your account deletes them. The send record (it holds no address) is deleted after 180 days (details).
• Last seen country: the two-letter country code is kept as long as the account is open and is replaced when it changes or at most every 6 hours; deleting your account deletes it (together with its copy in the device registration, if any) (details).
• Game Center / Play Games link: the platform player ID, the encrypted token (Android) and the write records are kept until you remove the link or delete your account; either one deletes them (details). Achievements and scores written to the platform are the platform's data and remain.
• Sign in with Apple / Sign in with Google: the provider account ID, the email the provider reported and (Apple) the encrypted refresh token are kept until you remove the link or delete your account; either one deletes them (details). The hand-over record of Apple sign-in on Android is valid for 60 seconds at most.
• Backups: database backups are kept as short-lived local copies on the OVH server and, encrypted, in Cloudflare R2. In the cloud, daily backups are kept for 90 days and the game database backups taken every 6 hours for 7 days; backups based on continuously archived transaction logs (weekly full, daily differential) are kept for about 4 weeks; deletion requests drop out of the database backups within these periods.

Your rights, deleting your account and data requests

Wherever you live, you have these rights over your personal data: access (to know what data we hold about you and get a copy), rectification, erasure, restriction of processing, objection, portability (to receive your data in a common, machine-readable format) and, for processing based on consent, to withdraw your consent. These rights are in line with those the GDPR gives in the European Economic Area (and the UK GDPR in the United Kingdom); if the law where you live gives you more, that remains too. Send your request to privacy@playdiyar.com from the email address registered to your account (support page); we answer within 30 days at the latest.

• Deleting your account (inside the game): Settings › Account › Delete my account. You enter your password and give a final confirmation (on an account you created with Apple or Google and added no password to, no password is asked; you only give the final confirmation); if you sign in to the account within 14 days the deletion is cancelled, after that it cannot be undone. On deletion your email, password, notification settings, last seen country, Game Center / Play Games link and token, Sign in with Apple / Sign in with Google records (the provider account ID, the email and the encrypted Apple token; the token at Apple is revoked) and support conversations are deleted; your characters become anonymous (they stay in the world as "Silinmiş-xxxx") and your character names are released; your Diamonds balance and all your entitlements are lost and are not given back (Diamonds Terms). Achievements and scores already written to Game Center / Play Games are the platform's data and are not deleted; you manage them on that platform. Removing the app does not delete your account. The steps and the way to delete by email: support page.
• Export: data export requests are for now handled by email and by hand.
• What cannot be deleted: order, payment, refund and ledger records are kept separately for as long as the law requires and used only for legal purposes; once the account is deleted these records no longer hold personal details (email, name), only the account number.
• Data at the stores: for the data Apple or Google hold (your account, payment details, purchase history, your achievements and scores in Game Center / Play Games, your Sign in with Apple / Sign in with Google records), you have to contact that store or platform.
• Complaints: your right to complain to the data protection authority where you live remains.

Security

Passwords are salted and hashed with scrypt (the plain password is never stored); session, verification and reset codes are stored only as hashes; wrong password attempts are rate limited and lock temporarily; the session cookie is HttpOnly; store notifications are verified; every change to the Diamonds ledger is recorded; connections are encrypted (HTTPS / WSS). No system is perfectly secure; in a breach that affects your personal data we will inform you and the competent authority when the applicable rules require it.

Cookies and local storage

This section describes what is stored in your browser and which third parties your browser calls while you use this website (the promo pages and the legal pages). The table matches what the site really does and is generated with the site on every release. What the game app does is below.

Categories

• Necessary: What the site needs to work and stay secure (fraud and bot prevention), to carry out something you asked for (such as a payment) and to keep this choice. Cannot be switched off.
• Statistics: Measures how the pages are used (visit counts, which pages). Runs only if you allow it. Not used on this site.
• Marketing: For advertising and retargeting (social networks, ad networks, video embeds). Runs only if you allow it. Not used on this site.

If a statistics or marketing cookie, script or embed is ever added, this table and the categories are updated first, the version of your choice changes and you are asked again; none of them loads or makes a request before you allow it.

How do you change your choice?

• On your first visit, pick Accept all, Necessary only or Settings in the bar at the bottom of the page. The three have equal weight; the necessary ones cannot be switched off because the site does not work without them.
• You can change your choice at any time: use the Cookie settings link in the footer of every page or the button in this section.
• Your choice stays in this browser for 6 months; when it runs out or this section changes, the bar comes back. If you clear your browser's site data your choice is deleted too and you are asked again.
• With JavaScript off the site asks nothing and loads nothing that is not necessary.
• In pages opened from inside the app only necessary records are used and no consent bar is shown.

The game app

• The game, when you sign in with an account: the game server sets a session cookie (HttpOnly, 30 days, only to keep you signed in) and the session code is also kept in the app's local storage. The game sets no advertising or tracking cookies; the device identifiers of the ads SDK are covered in Ads and consent.
• Guest or account: the game keeps settings and saves in localStorage / IndexedDB (above).
• Install ID: not a cookie; it is kept in the app's own secure storage (the Keychain on iOS, encrypted preferences on Android) and is not used for ads or tracking (Device verification).

Children

To create an account and play you must be at least 13 years old (if the country you live in sets a higher age for processing personal data, that age applies); accounts found to belong to someone under 13 may be closed. The game is not directed at children. To buy Diamonds you must confirm that you are 18 or older (your own declaration, not verified separately); purchases are also subject to the age and family (parental) settings of the App Store and Google Play. The game has a profanity filter, blocking and reporting for chat; there is no separate age verification.

Changes

This page changes as the game and the site develop; the date at the top shows the last change. Related texts: Terms of Service · Diamonds Terms · Support.