Privacy Policy

1. Your account

The first time the game opens it makes a guest account with Firebase Authentication, a Google service: a random identifier, with no form to fill in. The guest gets a name such as “Guest 4821”, which you can change.

If you make the guest an account, to keep your progress on another phone, the service you choose tells us who you are:

• Sign in with Apple (on iPhone): an identifier for you and, if you allow it, your e-mail address, which may be a private relay address Apple makes for you.
• Google: your Google account’s identifier, e-mail address, name and profile picture. The game uses only the e-mail address, to show you which account you are signed in with.
• E-mail and password: your e-mail address, and your password, which Firebase keeps only as a hash. We never see it.

2. What you do in the game

To run the game and keep its online parts fair, our server keeps:

• Your profile: your name, friend code, rating, the number of games, wins and achievements, the stones, board, avatar and frame you wear, when the account was made and when you last played.
• Your wallet and progress: coins, the items you own, the daily reward’s calendar, the day’s missions, lifetime counts (games, wins, mills and the like), the achievements you have claimed, and the players you have blocked.
• Online games: the moves of every duel, arena game and Cup game, its players, its clock and its result, so the server can referee it. Games against the computer on your phone are sent to the server once finished, to be checked against the rules and counted for missions and the season; only the count is kept.
• Seasons, ratings and the Weekly Cup: your season points and place in the month’s standings, your rating, your Cup sign-up, qualifier scores and matches. While you look for an opponent, your place in the queue (arena and rating) is kept for a few seconds.
• Friends: your friend list, the requests and challenges you send and receive, and the messages you and your friends write to each other, which are stored so both of you can read them. Offensive words are hidden automatically as a message arrives.
• Invites: if you enter a friend’s invite code, we keep whose code it was, and how many new players each code brought.
• Reports: when you report a player, we keep who reported whom and why, for a person to look at.

3. Purchases

Coin packs and the “No ads” subscription are sold by Apple’s App Store and Google Play. They take the payment; we never receive your card or payment details.

To grant what you bought, our server checks each purchase with Apple or Google and keeps a record of it: the product, the transaction’s identifiers and dates, and, for “No ads”, whether it is active, when the month ends, and any renewal, cancellation or refund Apple or Google tell us about. Each purchase carries an identifier made from your account, so it cannot be claimed by another account.

4. Ads

The game is free and shows ads from Google AdMob (Google Ireland Limited): full-screen ads at the breaks between games, and videos you choose to watch for coins. To show and count them, Google’s software in the game collects your device’s advertising identifier (on iPhone only if you allow tracking), your IP address, the device’s model, system and language, and how you interact with the ads.

In the European Economic Area and the United Kingdom, Google’s consent message asks you, before any ad is requested, whether ads may be personalised and whether information may be stored on your device for them. If you say no, you still see ads, but not ones chosen from your activity. Where US state law gives you the choice, Google’s message for those states lets you opt out of the use of your data for targeted ads. Settings → Ad privacy choices opens the message again.

When you watch a video for coins, AdMob tells our server, with a signed message carrying your account’s identifier, so the server can pay the coins once.

Google uses this data as a controller in its own right: see how Google uses information from apps that use its services.

5. Measuring our own ads

When we advertise Morris Clash on Facebook, Instagram or TikTok, the game tells Meta Platforms and TikTok which installs their ads brought: the install, launches of the game, purchases, and the first game finished, with your device’s advertising identifier (on iPhone only if you allow tracking; without it, Apple’s SKAdNetwork counts installs with no identifier), IP address, device model, system and language. They use it to measure and improve our campaigns, under their own policies: Meta’s and TikTok’s.

In the European Economic Area and the United Kingdom this runs only if you allowed, in the consent message above, information to be stored on your device and ad performance to be measured. It is off while we run no campaigns on those networks.

6. Notifications

The game asks to send notifications only after you sign up for the Weekly Cup or send a first challenge. If you allow it, Firebase Cloud Messaging gives your phone an address for notifications, which we keep with your account and the phone’s language, to tell you when your Cup match opens, when your opponent is waiting, or when a friend challenges you. Settings turns them off, and so does your phone’s own settings.

7. Usage statistics and technical data

To learn how the game is played and make it better, the game sends Google Analytics for Firebase a record of what you do in it: the games you play, against whom (the computer, a friend, a player found for you) and at what stake, how they end, and the coins, rating and points they bring; the arenas you look for opponents in; the friend requests, invitations and challenges you send and answer; that you sent a message, and its length, never its text; what you look at, earn, spend and buy in the shop; the ads you watch; your settings, the screens you open, and errors from our server.

Each record carries your account’s identifier, an identifier Analytics makes for the game on your phone, the device’s model, system and language, the game’s version, and the country and region worked out from your IP address, which Analytics does not keep. Analytics collects no advertising identifier, and these statistics are not used for ads. We copy the records into Google BigQuery, in the European Union, to study them. They are kept for 14 months.

Settings → Usage statistics turns this off at any time; turning it off also resets the identifier Analytics made on your phone.

• The game sends our server its version and platform, to tell an outdated version to update and to fetch updates of its own code.
• Our server’s logs (Google Cloud) record requests and errors, with IP addresses, and are kept for 30 days.
• Your settings (language, sound, vibration) and some of the server’s last answers stay in your phone’s own storage.
• The game has no crash-reporting software.

8. Why we use it, and on what legal basis

• To give you the game you asked for, your account, online games, friends, messages and purchases: performing our contract with you (GDPR article 6(1)(b)).
• To keep games fair and players safe, refereeing every online move, limiting rewards, filtering words, acting on reports, and keeping logs to find faults and abuse: our legitimate interest in a fair, working game (article 6(1)(f)).
• Usage statistics (section 7): our legitimate interest in understanding how the game is played, to improve it and keep it free (article 6(1)(f)). You can object at any time with Settings → Usage statistics.
• Personalised ads, storing information on your device for ads, and measuring our campaigns: your consent, where the law asks for it (article 6(1)(a)); elsewhere, our legitimate interest in paying for a free game with ads.
• Notifications: your permission, given on the phone.
• Keeping purchase records: our legal duties under accounting and tax law (article 6(1)(c)).

9. Who sees it

• Other players see your profile (section 2), your place in the standings and in the Cup, and the games you play against them. Your friends also see when you were last active, and the messages you send them.
• Google runs our servers as our processor: Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Cloud Storage, Hosting, Google Analytics for Firebase and BigQuery. The game’s database and functions run in Google’s region in Belgium (europe-west1), and our copy of the usage statistics in the European Union; sign-in, notifications and Analytics are Google’s global services.
• Apple and Google, as app stores and sign-in services; Google AdMob, Meta and TikTok, as described in sections 4 and 5. Each is responsible for its own processing.
• Authorities, when the law obliges us.

We do not sell your personal information. Showing personalised ads and measuring our campaigns can count as “sharing” or “targeted advertising” under some US state laws; section 4 says how to opt out.

Google, Apple, Meta and TikTok may process data outside the European Economic Area, including in the United States. Such transfers rely on the EU–US Data Privacy Framework where the company is certified under it, or on the European Commission’s standard contractual clauses.

10. How long it is kept

Your account’s data is kept while the account exists. Settings → Delete the account removes it at once: your profile, wallet and progress, friend code, your lines in the ratings, the season’s standings and the week’s Cup, your friends’ links to you and your conversations, the requests and challenges you left open, your phones’ notification addresses, and last your sign-in itself.

Two things stay after a deletion: games you already played remain in your opponents’ records, under the name you had then; and each purchase’s record stays, so a transaction is never granted twice and for as long as accounting law requires.

Usage statistics (section 7) already collected are kept until their 14 months are over; deleting the account resets the identifier on your phone, so the new guest is not linked to them. Write to us to have them deleted sooner.

A guest account you leave behind, by removing the game without making it an account, stays on our server, out of reach of a new install. Write to us with its friend code (on the You tab) and we will delete it. Server logs are kept for 30 days. Reports are kept while they are looked into, and as long as needed to deal with repeated abuse.

How to delete your account.

11. Your rights

You may ask for a copy of your data, have it corrected (you can change your name yourself), have it deleted, restrict or object to how we use it, and receive it in a form you can take elsewhere. You may object to usage statistics with Settings → Usage statistics. You may withdraw a consent at any time: Settings → Ad privacy choices for ads, the game’s Settings or your phone’s for notifications, and on iPhone Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in the phone’s settings.

Write to us at support@encodeera.co; we answer within a month. You may also complain to Romania’s data protection authority, ANSPDCP, or to the authority where you live.

12. Children

Morris Clash is not meant for children under 13, or under the age at which a child may agree to these services in their country (16 in Romania). We do not knowingly collect data from them. If you think a child has given us data, write to us and we will delete it.

13. Security

Everything between the game and our server travels encrypted, and Google encrypts it where it is stored. Phones cannot write to our database: only our server’s functions can, after checking each request.

14. This website

This website sets no cookies, runs no analytics and shows no ads; its fonts and pictures are served from the site itself. Firebase Hosting, a Google service, receives your IP address and your browser’s request in order to deliver the pages and keep them safe. If you choose a language, your browser remembers the choice in its own storage, and it is never sent to us.

15. Changes

When this policy changes, the new version is published here with its date. If a change matters to how your data is used, we will also say so in the game.