← Back to Hobbyist Games

Privacy

Privacy Policy

Last updated 31 August 2026

The short version

Playing on your own sends us nothing. Signing in for online play stores an id from Steam or Apple, your username, your fighter, your fight record and a backup of your save, so the ladder and your progress work across devices. We never see your email, your password, or your payment details. You can delete your account from inside the game whenever you like.

What we collect

Only when you play online

Single player needs no account and sends us nothing. Everything below applies only once you sign in for online play, which is Steam on the Steam version and Sign in with Apple on iPhone and iPad.

An id from the service you signed in with — your Steam ID, or the identifier Apple issues for this app alone — which we map to an internal id that means nothing outside our server
Your chosen username, and the time you last changed it
Your belt rank, ladder rating, division, and the two numbers the rating system uses to track how certain it is about you
The result of every ranked match: who you fought, whether you won, how it ended, and when
A separate turn-by-turn log of those same matches, recording what each player played on each turn, which is how we detect cheating
The fighter you bring to a match: archetype, stats, stamina, equipped moves, unlocked skills, appearance, cosmetics, active pet and any active buff
Your daily and weekly reward claim counts
When your account was created, and when you last played a match

Accounts are not joined across platforms. Signing in on Steam and on an iPhone gives you two separate accounts, with separate ladder records, and nothing here connects them to each other.

What we collect

Your cloud save

Signing in backs your single-player save up to our server, so you can carry it between a computer and a phone. We store it as one opaque string and never look inside it: the game's save format changes often, and a server that understood it would corrupt saves rather than merely fail to read them.

The save itself, stored as text we do not parse
The save format version, so an older build refuses a save it is too old to read
A short summary the game writes for you to read: your belt, your in-game day, your playtime, and a device label
An id for the install that wrote last, so the game can tell you the newer progress came from your other device

That install id is the one device identifier we hold, and this page used to say we held none. It is generated by the game, it lives in this game's own settings, and it names an installation rather than your phone or your computer. It is not an advertising identifier, nothing outside this game can read it, and no server logic branches on it.

What we collect

Friends and challenges

If you add friends in game, we store the friendship and the requests that led to it. A challenge you send sits on the server for the minute it stays open, and it carries the fighter you are bringing, because the other player's game needs that to build the match.

Who you are friends with
Friend requests you have sent or received, including ones that were declined
Challenges you have sent or received, until they are accepted or expire

A declined request is kept on purpose. There is no player search, so the only people who can reach you are people you have already played or who know your exact username, and a decline that sticks caps each of them at one attempt.

What we collect

Reporting and blocking

You can block another player, and you can report one for an offensive name, for impersonation, or for cheating. Both are stored, and reports are read by a person rather than acted on automatically.

Who you have blocked
Reports you have filed: who, which of the three reasons, and when
Reports other players have filed about you, on the same terms

Deleting your account does not clear either of these in both directions, and the asymmetry is deliberate. It is described under what deletion does not remove, below.

What we collect

What we never ask for

There is no account signup on either platform. Steam signs you in because you are already signed in to Steam, and Sign in with Apple hands us an identifier. There is nothing to fill in, and so nothing for us to lose.

No email address
No password
No real name
No payment information. Valve and Apple handle every purchase and we never see your card, billing address, or anything like it
No location data
No contacts

Sign in with Apple can return your name and your email address, or a private relay address that forwards to it. We request neither scope, so neither ever reaches us. The game has no passwords, sends no mail of any kind, and never handles payment, so an address would have no job to do here.

Optional

If you want game updates

You can give us your email address to hear about the game. That is entirely your choice, it is never required, and it has nothing to do with playing.

It goes to a mailing list on this website, held in Google Firebase, which is a different system from the game server. Your address and your game account are not connected, and cannot be
We use it to tell you about the game and nothing else
Every email has an unsubscribe link, and leaving removes your address
We do not sell it or share it with anyone

This is the only email address we ever hold, and you have to hand it over on purpose. Signing in to play never gives us one.

What we collect

IP addresses

When your game asks our server to sign you in, we read your IP address and use it as a rate-limit key, so those endpoints cannot be hammered by bots. The rate limiter holds it for the length of its window, which is one minute, and then it is gone. It is never written to our database and never attached to your account.

What we will not claim is that no trace of it exists anywhere. Cloudflare, which runs our server, and Google Firebase, which issues your sign-in token, both log IP addresses as part of doing those jobs, the way any host and any login service does. That is their logging under their own policies, and not something we collect, keep, or can read back out.

Visibility

What other players can see

Ranked play is public by design. Other players can see your username, your belt, your ladder rating and where you sit on the ladder, and the results of matches you have played.

Anyone you have played, and anyone who knows your exact username, can send you a friend request. There is no way to search for a player, so that is the whole of it.

Nothing that identifies you outside the game is shown to other players. Your Steam ID is not, your Apple identifier is not, and your cloud save is visible to nobody but you.

Third parties

Who else touches your data

Valve, on the Steam version. We send Steam a ticket from your game to confirm you are who you say you are, and Steam sends back your Steam ID. If you sign in through a browser instead, that exchange holds a short-lived session on our server for ten minutes and then drops it
Apple, on iPhone and iPad. We ask Apple to confirm who you are and receive an identifier unique to this app and meaningless outside it. We request nothing else. We also keep the refresh token Apple issues, for one purpose: Apple requires that deleting your account revokes your tokens with them, and that token is what the revocation call needs
Google Firebase. This issues the token your game uses to prove it is signed in, and separately it holds this website's mailing list. Firebase only ever receives our internal id, never your Steam ID or your Apple identifier
Cloudflare. This hosts our game server and our database
Vercel. This hosts this website, including the form that takes your email address if you join the mailing list

We do not sell your data, and we do not share it with advertisers. There is no advertising or analytics tracking in the game.

Your rights

Deleting your account

You can delete your online account from inside the game, on the account screen reached from the title menu. It happens immediately, and it is not a request that we review.

This is what deletion actually does, precisely, because it is worth being exact about.

Your account record is removed, and your username is released — you or anyone else can claim it again
Your ladder record is destroyed: belt, rating, division, and last played time
Your cloud save is destroyed
Your reward claim counters are destroyed
Your friendships are destroyed, on both sides, along with every friend request and challenge either of you sent the other, declined ones included
Your own block list, and the reports you filed about other people, are destroyed
On iPhone and iPad, your tokens are revoked with Apple first, and then the token we held is destroyed
Your past matches stay, but your id in them is replaced with an anonymous placeholder, so they no longer point to you

Your rights

What deletion does not remove

Two things survive on purpose, and they are worth stating plainly rather than leaving you to find out.

The mapping from your sign-in to an internal id. Your Steam or Apple credential goes on resolving to the same internal id it always did. What deletion removes is the account on that identity, not the identity itself: no handle, no ladder record, no save, no friends, nothing about you is left attached to it. Signing in again puts you on that same empty id rather than a fresh one, and you start over from nothing.

Other people's protection from you. Blocks that other players placed on you stay, because a block is the blocker's protection rather than your data, and it would be worth nothing if deleting your account walked you back through it. Reports other players filed about you stay for the same kind of reason: they are evidence in a queue that counts how many separate people complained, and clearing them would let someone reset their own tally on demand.

Banned accounts differ in one further way. A banned account is kept as a marker instead of being removed, and its username stays retired permanently, so that a ban cannot be shed by deleting the account and signing straight back up.

Your rights

How long we keep things

While your account exists, we keep the data above. There is no automatic expiry, because a ladder rating and a match record are only meaningful as a continuous history.

Deleting your account is the way to end that, and it takes effect straight away.

Age

Younger players

Submission Saga is intended for players aged 13 and over, and we do not knowingly collect data from anyone younger. Some countries set that age higher, as far as 16, so the limit where you live may not be 13.

If a child under the age that applies where you live has created an online account, email info@submissionsaga.com and we will delete it.

Changes

If this policy changes

If we change what we collect or who we share it with, we will update this page and change the date at the top. Material changes will also be announced wherever you got the game.

Contact

Who we are

Submission Saga is made by Nathan Markham, trading as Hobbyist Games, based in the United States. That is who is responsible for the data described on this page.

For any question or request about your data, email info@submissionsaga.com. Depending on where you live you may have additional rights over your data under local law, and you can use that address to exercise them.

← Back to Hobbyist Games