Elder Kingdom home

Privacy policy

Last updated: 26 October 2026.

Who we are

Elder Kingdom (the game, its mobile apps and this website) is operated by Lili's Ark Limited, a private limited company registered in England and Wales (company number 15424953), registered office 106 Hemper Lane, Sheffield, S8 7FE, United Kingdom. Lili's Ark Limited is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact us at support@elderkingdom.com.

What we collect and why

  • Account and sign-in data. An internal account identifier and, if you sign in with Apple or Google, the provider's user identifier for your account. We do not store your email address from these providers. If you play as a guest, the app creates a random device identifier; we store a hash of it, not the raw value. We use this data to create and secure your account (contract).
  • Linked accounts. One Apple or Google sign-in can hold up to 10 game accounts. We keep the link between that sign-in (the provider's user identifier) and each of its accounts, so we can show you the list of your accounts when you sign in. We also use the link to stop invite rewards being paid between accounts on the same sign-in, and to stop a suspended player from starting or linking another account on that sign-in (contract and legitimate interests).
  • Session tokens. Hashed tokens that keep you signed in. App sessions last 30 days; website sessions last 8 hours.
  • Game data. Your kingdom and city names, avatar, progress, inventory, battle and activity records. We use this to run the game (contract).
  • Chat, letters and reports. Messages you send in public, alliance and private chat and letters, plus abuse reports and block lists. Other players can see public and alliance chat and your kingdom name. We use this to provide communication and keep players safe (contract and legitimate interests).
  • Invite codes. A kingdom can create an invite code to share. We store the code with that kingdom. When a new player enters a code, we record which kingdom invited which, when it was redeemed and which rewards have been paid, and we keep a note that the account has used a code, so a reward is paid once. We use this to run the invite rewards and to prevent abuse (contract and legitimate interests).
  • Purchase records. Store order or transaction identifiers, product, coins credited, timestamps and refund status for purchases through the Apple App Store, Google Play or our website. We use these to verify purchases, credit coins, handle refunds and prevent fraud (contract, legal obligation and legitimate interests).
  • Push notification tokens. When you sign in, the app registers your device's notification token (issued by Apple or by Google Firebase Cloud Messaging). We use it only to send the notifications you allow. You can turn notifications off in the game or in your device settings.
  • Crash reports. If the app crashes or hits a serious error, it sends a crash report to Google Firebase Crashlytics. A report contains the error and stack trace, your device model, operating system and version, the app version, and a random installation identifier created by Crashlytics. We do not attach your account identifier, kingdom name or any other details about you. We use crash reports to find and fix bugs (legitimate interests). Debug builds of the app do not send them.
  • IP addresses and technical data. Your IP address is processed whenever you connect to our servers. We use it for rate limiting, security and anti-abuse, for example to detect one person trading with themselves. Where we keep an IP-derived value (for market anti-abuse) it is stored as a keyed hash that cannot be turned back into your address, and it is cleared when the listing closes. Our servers also write operational logs of requests and errors, which can include IP addresses; these logs are capped in size and rotated automatically, and older entries are overwritten as new ones are written. Logs are used for security and reliability (legitimate interests).

World rankings on this website are public without a sign-in and show kingdom name, rank, score, alliance and crest.

We also record how the game is used: the screens you open, the actions you take and your tutorial progress. With it we keep these device details: the platform (Android or iOS), the device model, the operating system version, the app version, and whether the device is a Google test device used for automated app checks. This is linked to your account, kept on our own servers for 180 days, deleted when you delete your account, and used only to understand and improve the game (legitimate interests). It is not shared or sold, and it is not used for advertising.

We do not use advertising, tracking or analytics SDKs, we do not build advertising profiles, and we do not sell personal data.

Website payments

Coin purchases on this website are processed by Stripe Payments Europe, Ltd. and its group companies. Stripe collects your card or wallet details directly; we never see or store them. We receive the result of the payment, an order reference and the amount, and we keep them as a purchase record. Stripe acts as an independent controller for its own purposes, such as fraud prevention and legal compliance; see stripe.com/gb/privacy. Purchases in the apps are processed by Apple or Google under their own privacy policies; we receive the transaction details, not your payment details.

Cookies on this website

We use only strictly necessary cookies, which do not need consent under the Privacy and Electronic Communications Regulations:

  • __Host-ek_web: keeps you signed in on the website after you sign in. It is HttpOnly, Secure and SameSite=Lax, and expires after 8 hours or when you sign out.
  • __Host-ek_choice: when your Apple or Google sign-in holds more than one game account, it proves which sign-in is choosing one, so the website can list your accounts and sign you in to the one you pick. It is HttpOnly, Secure and SameSite=Lax, and expires after 10 minutes or as soon as you have chosen an account.
  • __Host-ek_oauth: protects the Apple or Google sign-in flow against forgery. It is HttpOnly, Secure and SameSite=None, because Apple and Google return you to us with a cross-site form post that a stricter setting would block. It expires after 10 minutes.

All three cookies are set by our game server at api.elderkingdom.com, not by the pages of elderkingdom.com, and your browser sends them only back to that server.

We set no analytics, advertising or tracking cookies. Our pages do not use local storage for tracking.

Who receives your data

We share data only with service providers acting on our instructions, and with other bodies where the law requires:

  • our hosting and infrastructure provider (DigitalOcean), which runs our servers and database;
  • Apple and Google, for sign-in, store purchases and push notifications;
  • Google Firebase Crashlytics, which receives the app's crash reports (see above);
  • Stripe, for website payments (see above);
  • email forwarding and mailbox providers that deliver messages sent to our support address;
  • law enforcement, regulators or professional advisers where we are legally required or need to protect our rights.

International transfers

Some of these providers process data outside the United Kingdom, including in the United States. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or on the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed. Contact us for details of the safeguards for a particular provider.

How long we keep data

  • App session tokens: up to 30 days after issue; website sessions: 8 hours. Expired sessions are deleted automatically.
  • Chat messages, letters and battle reports are deleted automatically after 30 days, and so are alerts you have read; alerts you have not read stay until you read them. Gift notices, such as Weekly Pass rewards, are the exception: they stay until you remove them. A message or letter that a player has reported is kept for as long as a report on it remains, so moderators can review it; there is no fixed time limit. A letter that holds a Weekly Pass reward you have not claimed stays until you claim it.
  • Invite codes and invite records: kept until the kingdom they belong to is deleted. The note that an account has used a code stays with the account record.
  • Reports: kept until the account of the player who filed the report, or of the player it is about, is deleted.
  • When you delete your account, every chat message you sent or received is erased, whether or not it was reported.
  • Crash reports: kept by Firebase Crashlytics for 90 days and then deleted.
  • Account, game and sign-in data: until you delete your account, or until we remove an account that is abandoned or breaches the terms.
  • Usage records: kept for 180 days, and deleted when you delete your account.
  • Purchase and audit records: kept for as long as needed for accounting, tax, refund handling and fraud prevention, normally up to six years.
  • Backups: we keep the 14 most recent daily database backups, and older ones are overwritten. Deleted data can persist in a backup until it expires, and we do not restore backups into the live game except to recover from a disaster.
  • Support emails: kept while we help you and for a reasonable period afterwards to resolve disputes.

Deleting your account

You can delete your account in the app or by email; see account deletion. Deletion takes effect immediately. It removes your sign-in access, linked identities, devices and their device details, sessions, push tokens and usage records, removes your kingdom and city names, and erases your chat, letters and other social content. Remaining game-world records (such as map tiles, cities, inventory and generals) are de-identified: your names and sign-in links are removed. Purchase and transaction records stay linked to an internal account number for the retention period described above.

Children

Elder Kingdom is not directed at children under 13 and we do not knowingly collect personal data from them. If you are under 13 you must not use the game. If you are under 18 you should have a parent or guardian's permission before making purchases. If you believe a child under 13 has an account, email us and we will delete it. The game contains stylised fantasy combat and player-to-player chat.

Security

Connections to our API and website use TLS encryption. Authentication tokens are stored hashed. Access to our servers is restricted. No system is perfectly secure, and we will tell you and the ICO about a breach where the law requires.

Your rights

Under UK data protection law you have the right to be informed, to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing based on legitimate interests, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. To use these rights email support@elderkingdom.com; we may ask you to confirm your identity and will normally reply within one month.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to resolve your concern first. If you live in the European Economic Area, you can also complain to the data protection authority in your country.

Changes

We will post any change to this policy on this page and update the date above. For significant changes we will also tell you in the game.