DragonHaven Privacy Policy

Last updated: 13 October 2026. This policy covers the DragonHaven Android game (nl.dragonhaven.app) and www.dragonhaven.eu.

Who is responsible

DragonHaven is operated by Rick Groot, the controller of personal data used to provide the game and website. For privacy questions, access requests or deletion requests, email groot.rick+dragonhaven@hotmail.com. You may contact us in English or Dutch. Never send your password or sign-in tokens.

Data used by the game

DragonHaven is an online game intended for players aged 13 and over. An entered age below 13 does not block the account, but receives the same protected access as every player under 16. An account and internet connection are required. We retain the date of birth used to calculate age-based access and the privacy notice version you read. Existing accounts that had no date of birth when this protection was introduced receive 1 January 1990 as a temporary legacy default; the player can correct it at any time in Account Info.

• On your device: game progress, dragons, inventory, preferences and notification settings are stored locally. Online features also use account session credentials.
• Accounts: when you register or sign in, our authentication provider Supabase processes your email address, date of birth, authentication credentials, account identifier and verification/session information. Passwords are handled by the authentication service; they are not shown to other players.
• Online gameplay: we process your Keeper ID, chosen display name, profile, cloud saves, online inventory, gameplay actions and relevant timestamps to provide and synchronise online features, validate actions and restore progress.
• Social features: these features are available only from age 16. Friend requests, friendships, blocks, trades, Conclave membership and activity, messages and rankings are processed when you use the relevant features. Profile information and contributions are visible to the players or groups involved; ranking entries are visible to their ranking audience. Your account email is not a public player-profile field.
• Keeper invitations: from age 16 you can ask DragonHaven to email an invitation to another person. Resend processes the recipient address to deliver that message. DragonHaven stores only a one-way hash of the address and invitation token, together with the inviter, invited account, status and timestamps needed to prevent duplicate rewards and abuse. The invited account is linked only when it registers with the same address through the personal link. The invitation expires after 7 days. If the new account is created in time, there is one full day to hatch its starter egg. The inviter then receives 150 Gems; neither player sees the other's email, password or game progress through this feature.
• Technical and support information: online services process connection information such as IP addresses and request/security logs. If you contact support, we process your email, message and any diagnostic report you choose to provide. Diagnostic information may include app/device versions, timestamps, operation codes and identifiers needed to investigate an issue.

These data are used to operate accounts and gameplay, authenticate requests, deliver account emails, prevent abuse, troubleshoot problems and answer support requests. The game does not request access to your contacts, camera, microphone or precise location. Android notification and alarm permissions support game reminders. You can control notifications in Android settings.

DragonHaven offers optional rewarded advertisements: players can choose to watch an advertisement to receive rewards such as gems, coins or a Trial refresh. Website Analytics is separate from these in-game advertisements. External links, including Google Play, GitHub and Ko-fi, open services with their own privacy policies.

In-game advertising, diagnostics and notifications

Google Mobile Ads (AdMob) processes IP addresses (which may indicate approximate location), device and advertising identifiers, ad interactions and technical diagnostics for advertising, analytics and fraud prevention. The SDK can initialise and preload ads before you choose to watch a rewarded ad. Where required, Google's User Messaging Platform asks for advertising consent first; its privacy options can be reopened from the app where available. For players under 16, DragonHaven requests age-restricted, non-personalised ads with the strictest content rating. For older players, ad personalisation depends on their choices. Watching an ad is optional.

Reward verification sends Google a random, single-use claim code, not your email, player name, chats or game progress. Google sends signed reward evidence to our server; we retain verification records while the account exists to award rewards once and prevent fraud.

Google Analytics for Firebase, Crashlytics and Performance collect a pseudonymous app-instance ID, app events, broad region derived from a masked IP address, crash logs, device/app information and performance measurements only if you enable optional usage and diagnostics sharing in Account Info → Privacy. They are off by default and unavailable below age 16. From age 16 you can withdraw consent there. DragonHaven does not add your email, player name, chats or game content to these reports. Advertising-ID collection and personalised-advertising signals are disabled for in-game Analytics. Firebase Cloud Messaging uses a device token for push notifications, subject to your notification choices. Firebase App Check and Play Integrity process app/device integrity signals and tokens to help protect server access.

Google Play purchases

Real-money purchases are unavailable below age 16. For eligible players who buy a cosmetic pack, Google Play and DragonHaven process the product, purchase status, Play Store country, purchase time and technical purchase and order identifiers. Our server verifies purchases before granting content. The purchase ledger prevents duplicate grants and supports restores, refunds and chargebacks. Google processes payment details; DragonHaven does not receive a full card or bank account number.

Community safety

Harassment, threats, hate, sexual content, child exploitation, scams, spam and sharing others' private information are prohibited. In versions with in-app reporting, you can report players, messages and Conclaves. DragonHaven support reviews reports and may remove content or restrict accounts. Reports include the reported content, player identifiers and the selected reason. Evidence is kept for up to 30 days for safety review, including after the original message expires or an account is deleted. Linked account references are removed on account deletion. You may also contact support at the email above.

Website and Google Analytics

The website is hosted by Cloudflare, which processes connection information to deliver and secure it. Website features may use local storage to remember their state.

Only after you choose Allow, Google Analytics uses cookies to measure website visits, page views and interactions. Google processes browser/device information, online identifiers and connection information. Advertising features and Google signals are disabled in our website tag. We do not deliberately send your account email, account identifiers or URL query parameters to Analytics. Account-deletion, email-confirmation and privacy pages do not load the Analytics tag.

Your analytics choice is stored on your device for six months. Analytics cookies are configured to expire after six months without extending their expiry on each visit. You can refuse or withdraw consent using Privacy settings in the website footer. Withdrawal stops future collection by this website and removes its Analytics cookies; it does not automatically erase previously processed reports. You can also clear browser storage and cookies. See Google's privacy policy.

Service providers and disclosure

Supabase provides game authentication, databases and online services; Cloudflare provides website hosting and protection; Resend delivers transactional account email; Google provides Google Play purchases, consent-based website and in-game Analytics, AdMob and UMP, Firebase diagnostics and push messaging, and app/device integrity services. See Firebase privacy information and Google privacy information. Email delivery and support email providers process the messages needed for account and support communication. Providers process data needed for their services. See the privacy information of Supabase and Cloudflare.

We do not sell your personal data. Data may also be disclosed where needed to comply with law, protect the service or respond to a valid legal request. Content you intentionally share with other players can be seen by those players.

Legal grounds and international processing

Account and gameplay processing is necessary to provide the services you request. Service security, abuse prevention and ordinary support rely on our legitimate interests in running a reliable game. Optional website Analytics and optional in-game usage, crash and performance diagnostics rely on your consent. Advertising consent is requested where required; Google may act as an independent controller for advertising processing. Moderation evidence is processed for our legitimate interest in protecting players. Legal obligations may require specific processing. Providers may process data outside your country, including outside the European Economic Area, using applicable transfer safeguards described in their terms and privacy information. Contact us for information about safeguards relevant to your request.

Retention and deletion

Account, current cloud-save, inventory and linked social records are generally kept while your account exists. Previous cloud-save revisions are limited to four previous revisions and up to 30 days. Friend and Conclave messages are scheduled for deletion after 24 hours. Shared Conclave history can remain while the group exists, with your account reference removed on account deletion. Support-access audit records are retained for up to 30 days. These exceptions are also described on the account-deletion page.

Diagnostic support exports are retained for no more than seven days and incident evidence for no more than 30 days. Ordinary support correspondence is retained for as long as needed to resolve and document the request. Hosting, authentication and Analytics providers apply their own configured log, backup and reporting retention periods; account deletion does not promise immediate removal from every provider backup. Contact us for a specific retention or deletion request.

You can delete your online account from the Account screen in the app or at www.dragonhaven.eu/delete-account/. The website verifies your email and asks for a separate final confirmation. Deletion removes your online account and associated profile, cloud saves, online inventory and linked social records, subject to the exceptions above. It cannot be undone. Local game data on your devices is separate: clear the app's storage if you also want to erase that data.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. Email the contact above; we may need to verify account ownership. You can correct your date of birth in Account Info. Withdrawal does not affect processing already lawfully performed. You may complain to your local data protection authority, including the Dutch Autoriteit Persoonsgegevens.

Children and updates

DragonHaven is intended for players aged 13 and over. Players under 16 cannot use Friends or social features, Packs, or purchases with real money. An entered age below 13 receives the same protected access. If you are a parent or guardian with a question about a child's account or data, contact us. We do not use website data for personalised advertising. This policy may be updated when the service or its data practices change; the date above identifies the current version.