Privacy Policy
What we keep about you, why, and what you can do about it, in plain words.
Draft for legal review, 18 October 2026. This policy is waiting for a lawyer's check and isn't in force yet. The highlighted parts are filled in after that check.
1. Who we are
The Vyralune app, with its two games Vyralune and Cardvanta, is made by MadI Games, run by [owner's legal name], [city], India ("we"). We decide what data the game uses and why. You can reach us at support@madigames.com.
2. What we keep
| What | Where it comes from | Why |
|---|---|---|
| Account: email, password (stored only as a one-way code), date of birth, player name, avatar, country, city, User ID, when you joined | You, at sign-up | Your account; checking you're 13 or older; leaderboards by country and city |
| Google or Facebook sign-in: the account number they give our app, and your email if they share it | Google or Facebook, when you choose them | Signing you in. We never see your Google or Facebook password. |
| Guest code: a random code the app makes on your phone | The app | Finding a guest's account again on the same phone |
| Game data: cards, decks, skill cards, favourites, coins and every change to them, matches and rounds, statistics, daily gifts and missions | Your play | Running the game fairly, and settling questions about coins |
| Friends: friends, requests, blocks, reports and quick messages | You and other players | Playing with friends; keeping players safe |
| Notice address: a push address for your phone (from Google's Firebase), and when the phone last gave it | Your phone, after you sign in | Telling you about friend requests and challenges when the game is closed |
| Purchases: the store's receipt, the product and the date | Google Play or the App Store | Giving you what you bought. We never see your card or bank details. |
| Rewarded videos: the ad service's confirmation that a video was finished | The ad service | Giving each reward once |
| Error reports: the error message, where in the app it happened, the app's version and whether it's Android or Windows | The app, when something goes wrong | Finding and fixing bugs. No names or account details are included. |
| Internet address | Every connection | Stopping abuse, such as too many sign-in tries; kept only in short-lived server logs |
| Emails to support | You | Answering you |
We don't ask for your phone number, contacts, photos, location or microphone.
3. What other players see
Your player name, avatar, country (as a small badge), User ID, statistics and recent results. Never your email, date of birth or city. Quick messages are ready-made phrases; there is no free chat.
4. How we use it
- To run your account and the games, keep your coins and items, and match you with other players.
- To keep the game fair and safe: checking coins and matches on our server, and looking into reports and cheating.
- To send you notices you can turn off (friend requests, challenges, reward reminders).
- To improve the game, using reports in which you are a scrambled number, never your name or email.
- To answer you when you write to us, and to follow the law.
We use your data because you asked to play and agreed to this policy, or because the law requires it. You can withdraw your agreement at any time by deleting your account.
5. Who helps us
We don't sell your data. These companies help us run the game and handle only what their part needs:
- Microsoft Azure: our servers and database.
- Google: Google sign-in, Firebase Cloud Messaging (notices; it carries the sender's player name and the entry fee), and Google Play (purchases).
- Meta: Facebook sign-in, set up only to sign you in, with app events and advertising tracking off.
- Unity and the ad networks it works with: ads and rewarded videos (see Ads).
- Apple: Sign in with Apple and App Store purchases, on iPhone.
- Cloudflare: this website and our support email.
We may also share data when the law requires it, or to protect players and the game from fraud and abuse.
6. Where it is kept
Our servers and database are in India (Microsoft Azure, Central India, with South India as the backup region). Some of the companies above may process data in other countries under their own safeguards.
7. How long we keep it
- Your account and game data: while your account exists. When you ask to delete it, it closes at once and is deleted 30 days later (sign in before then to keep it); it then leaves our backups within 35 days.
- A guest account is lost to you when the app is uninstalled before signing up; [how long unused guest accounts are kept].
- Notice addresses: removed when you sign out, when Google says they no longer work, or after 60 days unused.
- Error reports and server logs: about 30 days.
- Reports with scrambled numbers: deleted after 2 years without use.
- Purchase records: as long as tax and accounting law requires.
8. Young players
Vyralune is for players aged 13 and over. We ask for your date of birth and don't create accounts for younger children. If we learn that a child under 13 has an account, we delete it.
India's data law treats everyone under 18 as a child. If you are under 18, please play with your parent's or guardian's permission. We don't show personalised ads to players we know are under 18. [parental consent steps, after the lawyer's check]
9. Ads
The free game is paid for by ads: banners on menu pages, an ad before and after each match, and optional rewarded videos. Never during a battle. Ads come through Unity LevelPlay and the ad networks it works with, such as Google AdMob. These services may use your phone's advertising ID and basic device details to show and count ads. Where the law asks for it, the app asks for your agreement first. You can reset your advertising ID, or ask for fewer personalised ads, in your phone's settings.
10. Your rights and choices
- See or correct your details: most are on your Profile; write to us for the rest.
- Delete your account and data: in the app, or see Delete your account.
- Turn off notices in your phone's settings.
- Complain: write to our grievance contact below. If you aren't happy with our answer, you can complain to the Data Protection Board of India.
- Nominate someone to act for you if you can't, as India's data law allows.
We answer requests as quickly as we can, and within 30 days.
11. Keeping it safe
Everything between the app and our servers is encrypted. Passwords are stored only as one-way codes. Sign-ins expire and are renewed safely, private keys are kept in Azure Key Vault, and coins can only be changed by our server. No system is perfect: if a breach ever affects you, we'll tell you and the authorities as the law requires.
12. Changes and contact
If we change this policy, we'll update this page and its date, and tell you in the app before important changes take effect.
Grievance contact: [owner's legal name], MadI Games, support@madigames.com, [postal address].