Privacy

Privacy Policy

Last updated 12 October 2026

The short version

Single-player gameplay stays on your device unless you sign in for cloud backup. On Android, Google Play Billing can send billing diagnostics to Google even without an online game account. Signing in for online play stores an id from Steam, Apple or Google, your username, your fighter, your fight record and a backup of your save, so the ladder and your progress work across devices. Game sign-in does not give us your email, password or full payment details. Apparel purchases are separate: Shopify provides your order and contact details, and Printful receives the information needed to fulfill your order. You can delete your account from inside the game whenever you like.

Shopping for apparel? Read the apparel privacy summary and our full store privacy policy.

Shop

Apparel orders

Hobbyist Games LLC operates the Submission Saga apparel shop. When you order, we receive your contact details, shipping and billing addresses, purchased items, payment status and order history through Shopify. We use this information to process your purchase, provide support, handle returns and meet our accounting and legal obligations.

Shopify provides the product catalog, shopping bag, checkout, payment processing and order management. Your browser connects to Shopify when you browse the collection and use your bag. We store a Shopify cart identifier in this browser so your bag can be restored. Payment details are entered in Shopify's checkout; we do not receive your full payment-card number.

We share the order and recipient details needed to print and deliver your shirts with Printful and its delivery providers. They may process that information in countries outside your own. Order records are retained as needed to fulfill purchases, resolve disputes and comply with tax and other legal requirements.

For access, correction, deletion or other privacy requests relating to an apparel order, email info@submissionsaga.com. Some records must be retained for legal reasons. Deleting a game account does not delete shop orders, and a shop account is separate from your game account.

The store privacy policy linked above provides further details about Shopify, international processing, retention and your rights. The game-specific sections below describe game data, not apparel orders.

Website

Advertising cookies

If you choose Allow in the website's advertising cookie notice, we load Meta Pixel to measure page visits and clicks on our Steam, App Store and Google Play links. A store click does not tell us whether you installed or purchased the game.

Meta receives these events, the page URL, browser and device information, your IP address and advertising cookie identifiers. Meta can use this information to attribute visits to ads and match activity to Meta accounts. We do not send mailing-list email addresses, game account details or payment information through the Pixel, and automatic advanced matching is disabled.

Advertising tracking stays off until you opt in. You can decline or change your choice through Cookie settings on this website. We remember your choice in this browser and honor Global Privacy Control by keeping advertising tracking off. Withdrawing consent stops future events; it does not remove events already sent to Meta.

This tracking applies to the website only. It is not installed inside the game. Meta handles the data it receives under its own privacy policy at https://www.facebook.com/privacy/policy/.

What we collect

Only when you play online

Single player needs no game account. The online records listed in this section are sent to our server once you sign in, using Steam on the Steam version, Sign in with Apple on iPhone and iPad, or Google on Android. Android billing services can communicate with Google separately, as described below.

An id from the service you signed in with — your Steam ID, or the identifier Apple or Google issues — which we map to an internal id that means nothing outside our server

Your chosen username, and the time you last changed it

Your belt rank, ladder rating, division, and the two numbers the rating system uses to track how certain it is about you

The highest division you reached at each belt, and the one-time division rewards you have been paid

The result of every ranked match: who you fought, whether you won, how it ended, and when

A separate turn-by-turn log of those same matches, recording what each player played on each turn, which is how we detect cheating. It is deleted after 14 days

When an online match ends early because a connection dropped or the two games disagreed about what happened: the turn, the reason, and which game versions were playing. Connection records are deleted after 30 days; records of the two games disagreeing are kept as match records

The fighter you bring to a match: archetype, stats, stamina, equipped moves, unlocked skills, appearance, cosmetics, active pet and any active buff

Your daily and weekly reward claim counts, and which dated in-game events you collected a reward for

When your account was created, and when you last played a match

Accounts are not joined across platforms. Signing in on Steam and on an iPhone gives you two separate accounts, with separate ladder records, and nothing here connects them to each other.

What we collect

Your cloud save

Signing in backs your single-player save up to our server, so you can carry it between a computer and a phone. We store it as one opaque string and never look inside it: the game's save format changes often, and a server that understood it would corrupt saves rather than merely fail to read them.

The save itself, stored as text we do not parse, including your Gold balance and the identifiers of purchases already credited to that save

The save format version, so an older build refuses a save it is too old to read

A short summary the game writes for you to read: your belt, your in-game day, your playtime, and a device label

An id for the install that wrote last, so the game can tell you the newer progress came from your other device

Earlier copies of your save, so a bad save can be recovered: the ten most recent, plus the first save you made at each belt. They are erased along with the save

That install id is the one device identifier we hold, and this page used to say we held none. It is generated by the game, it lives in this game's own settings, and it names an installation rather than your phone or your computer. It is not an advertising identifier, nothing outside this game can read it, and no server logic branches on it.

What we collect

Friends and challenges

If you add friends in game, we store the friendship and the requests that led to it. A challenge you send sits on the server for the minute it stays open, and it carries the fighter you are bringing, because the other player's game needs that to build the match.

Who you are friends with

Friend requests you have sent or received, including ones that were declined

Challenges you have sent or received, until they are accepted or expire

A declined request is kept on purpose. There is no player search, so the only people who can reach you are people you have already played or who know your exact username, and a decline that sticks caps each of them at one attempt.

What we collect

Reporting and blocking

You can block another player, and you can report one for an offensive name, for impersonation, or for cheating. Both are stored, and reports are read by a person rather than acted on automatically.

Who you have blocked

Reports you have filed: who, which of the three reasons, and when

Reports other players have filed about you, on the same terms

Deleting your account does not clear either of these in both directions, and the asymmetry is deliberate. It is described under what deletion does not remove, below.

What we collect

What we never ask for

There is no account signup on any platform. Steam signs you in because you are already signed in to Steam, Sign in with Apple hands us an identifier, and on Android you pick a Google account in your browser. There is nothing to fill in, and so nothing for us to lose.

No email address

No password

No real name

No payment information. Valve, Apple and Google Play handle every purchase and we never see your card, billing address, or anything like it

No location data

No access to your phone's address book. In-game friendships are described above

Sign in with Apple and Google sign-in can both return your name and your email address. We ask each of them for an account id and nothing else, so neither your name nor your address ever reaches us. The game has no passwords, sends no mail of any kind, and never handles payment, so an address would have no job to do here.

Android store services

Google Play billing

The Android game initializes Google Play Billing when loading or saving progress so it can check for purchases that still need to be credited. This is separate from signing in to the game's online account and can happen even if you do not buy anything.

The billing library can send billing diagnostics to Google, including operation results, error details and a billing-client session identifier. This supports the operation and diagnosis of the billing service. Signing out of online play does not turn this off.

Google Play handles the payment itself. We do not receive your card number or billing address. The game keeps a local purchase record so the same purchase is not credited twice; purchase-claim identifiers are also included in your save and its optional cloud backup.

Deleting your game account removes the game data described below. It does not delete your Google account or Google's separate payment and billing-service records, which Google handles under its own policies.

Optional

If you want game updates

You can give us your email address to hear about the game. That is entirely your choice, it is never required, and it has nothing to do with playing.

It goes to a mailing list on this website, held in Google Firebase, which is a different system from the game server. Your address and your game account are not connected, and cannot be

We use it to tell you about the game and nothing else

Every email has an unsubscribe link, and leaving removes your address

We do not sell it or share it with anyone

You provide this email address when subscribing. Signing in to play does not give us an email address; apparel checkout and support are separate sources described in the shop section.

What we collect

IP addresses

When your game asks our server to sign you in, we read your IP address and use it as a rate-limit key, so those endpoints cannot be hammered by bots. The rate limiter holds it for the length of its window, which is one minute, and then it is gone. It is never written to our database and never attached to your account.

What we will not claim is that no trace of it exists anywhere. Cloudflare, which runs our server, and Google Firebase, which issues your sign-in token, both log IP addresses as part of doing those jobs, the way any host and any login service does. That is their logging under their own policies, and not something we collect, keep, or can read back out.

Visibility

What other players can see

Ranked play is public by design. Other players can see your username, your belt, your ladder rating and where you sit on the ladder, and the results of matches you have played.

Anyone you have played, and anyone who knows your exact username, can send you a friend request. There is no way to search for a player, so that is the whole of it.

Nothing that identifies you outside the game is shown to other players. Your Steam ID is not, your Apple or Google identifier is not, and your cloud save is visible to nobody but you.

Third parties

Who else touches your data

Valve, on the Steam version. We send Steam a ticket from your game to confirm you are who you say you are, and Steam sends back your Steam ID. If you sign in through a browser instead, that exchange holds a short-lived session on our server for ten minutes and then drops it

Apple, on iPhone and iPad. We ask Apple to confirm who you are and receive an identifier unique to this app and meaningless outside it. We request nothing else. We also keep the refresh token Apple issues, for one purpose: Apple requires that deleting your account revokes your tokens with them, and that token is what the revocation call needs

Google, on Android. You sign in with Google in your browser, and our server receives a token carrying an account id and nothing else, because that is all we ask Google for. The exchange holds a short-lived session on our server for up to ten minutes and then drops it

Google Firebase, a separate relationship from Google sign-in above. It issues the token your game uses to prove it is signed in, and separately it holds this website's mailing list. It only ever receives our internal id, never your Steam, Apple or Google one

Cloudflare. This hosts our game server and our database

Vercel. This hosts this website, including the form that takes your email address if you join the mailing list

We do not sell your data or share it with advertisers. The game has no advertising. Online connection diagnostics and Google Play billing diagnostics are described separately above.

Your rights

Deleting your account

You can delete your online account from inside the game, on the account screen reached from the title menu. It happens immediately, and it is not a request that we review.

If you no longer have the game installed, email info@submissionsaga.com with your username and the platform you play on, and we will delete the account for you, with the same effect as deleting it in game.

This is what deletion actually does, precisely, because it is worth being exact about.

Your account record is removed, and your username is released — you or anyone else can claim it again

Your ladder record is destroyed: belt, rating, division, last played time, the highest division you reached at each belt, and the division rewards you were paid

Your cloud save is destroyed, along with every earlier copy of it

Your reward claim counters are destroyed, and so is the record of which dated events you collected

Connection records about your matches are destroyed

Your friendships are destroyed, on both sides, along with every friend request and challenge either of you sent the other, declined ones included

Your own block list, and the reports you filed about other people, are destroyed

On iPhone and iPad, your tokens are revoked with Apple first, and then the token we held is destroyed

Your past matches, their turn-by-turn logs and any record of the two games disagreeing stay, but your id in them is replaced with an anonymous placeholder, so they no longer point to you

Your rights

What deletion does not remove

Two things survive on purpose, and they are worth stating plainly rather than leaving you to find out.

The mapping from your sign-in to an internal id. Your Steam, Apple or Google credential goes on resolving to the same internal id it always did. What deletion removes is the account on that identity, not the identity itself: no handle, no ladder record, no save, no friends, nothing about you is left attached to it. Signing in again puts you on that same empty id rather than a fresh one, and you start over from nothing.

Other people's protection from you. Blocks that other players placed on you stay, because a block is the blocker's protection rather than your data, and it would be worth nothing if deleting your account walked you back through it. Reports other players filed about you stay for the same kind of reason: they are evidence in a queue that counts how many separate people complained, and clearing them would let someone reset their own tally on demand.

Banned accounts differ in one further way. A banned account is kept as a marker instead of being removed, and its username stays retired permanently, so that a ban cannot be shed by deleting the account and signing straight back up.

Your rights

How long we keep things

While your account exists, we keep the data above. Most of it has no automatic expiry, because a ladder rating and a match record are only meaningful as a continuous history.

Three things do expire on their own: the turn-by-turn match log after 14 days, connection records after 30 days, and earlier copies of your save once they are older than the ten most recent, except the first save at each belt.

Deleting your account is the way to end that, and it takes effect straight away.

Age

Younger players

Submission Saga is intended for players aged 13 and over, and we do not knowingly collect data from anyone younger. Some countries set that age higher, as far as 16, so the limit where you live may not be 13.

If a child under the age that applies where you live has created an online account, email info@submissionsaga.com and we will delete it.

Changes

If this policy changes

If we change what we collect or who we share it with, we will update this page and change the date at the top. Material changes will also be announced wherever you got the game.

Contact

Who we are

Submission Saga is made by Hobbyist Games LLC, based in California in the United States. That is who is responsible for the data described on this page.

For any question or request about your data, email info@submissionsaga.com. Depending on where you live you may have additional rights over your data under local law, and you can use that address to exercise them.

← Back to Hobbyist Games