1Who is responsible
Oracian operates Fellfiend Survivors and is responsible for the personal data described here. Privacy and deletion requests: [email protected].
2Information we use
- Account and sign-in: an account identifier, player name, friend code, sign-in provider identifier, provider name and email address when supplied, and credentials needed to maintain your session. Apple may supply a private relay email. If you choose email sign-in, we also store your email address, a salted password hash and temporary verification or password-reset challenges. We do not store your email-login password in readable form and do not receive your Apple or Google password.
- Gameplay: progress, characters, settings, inventory, currencies, rewards, purchases made with game currency, run results and the gameplay evidence used to validate rewards and leaderboards.
- Social features: in-game friendships, blocks, inventory visibility choices, trade listings, offers, completed trades and player-name reports. We do not read your device address book.
- Store purchases: product and transaction identifiers, purchase verification tokens, quantities, delivery status and refund information from Apple or Google. We do not receive card numbers or bank account details.
- Service and security: app version, request timing, sign-in status and a random app installation identifier used to keep a run on its originating device. Our servers process IP addresses to deliver requests and limit abuse. Sign-up limits keep only salted IP hashes in memory for about a day, not a stored IP history. Infrastructure and sign-in providers also process network and security information; Google Sign-In may estimate a general location from an IP address to prevent fraud.
- Support: the email address and information you choose to send us. Please send only what is needed to resolve your request.
3Why we use it
We use account, gameplay, social and purchase information to provide the game, save progress, authenticate players, deliver purchases, support trading and respond to requests. Where applicable, the legal basis is performing our agreement with you.
We use limited security and transaction evidence to prevent abuse, cheating and payment fraud, investigate disputes and protect the service and other players. Where applicable, this is our legitimate interest; we limit access and retention for these purposes. We process information required by law to meet those obligations. We do not sell personal information, run advertising SDKs or use cross-app advertising tracking.
4What other players can see
Your player name, friend code and qualifying leaderboard results can be visible to other players. Social and trade features show the details needed for the action you choose. Your inventory is shared according to the visibility setting you select. Sign-in email addresses and private credentials are not public.
After deletion your public profile, leaderboard records and social connections are removed. Completed trade receipts may temporarily remain as restricted transaction evidence with your name replaced by “Deleted player”. Items already transferred to someone else remain theirs.
5Service providers and transfers
Apple and Google provide sign-in and store payment services. Cloudflare provides network delivery and security for the website and API. Our hosting and email services process data needed to run the service and answer requests. Google Workspace delivers account verification and password-reset emails, including the destination address and temporary code. We disclose only what each service needs. We may also disclose information when required by law or necessary to protect legal rights.
These services may process data outside your country. Where European data protection law applies, applicable transfer safeguards include adequacy decisions or standard contractual clauses. You can ask us about the safeguards for your data. Apple and Google also process information under their own policies: Apple Privacy Policy and Google Privacy Policy. See also Cloudflare’s Privacy Policy.
6Retention and account deletion
We retain the information needed to operate your account while it remains active. You can permanently delete it at Settings → Account → Delete account. If you no longer have the app, follow the account deletion instructions; reinstalling is not required.
- Profile and playable data: deletion removes sign-in identities, email password hashes and verification challenges, name, email, active sessions, saved progress, social connections, public leaderboard records and run history from the live game database. Remaining account records cannot be used to sign in or recover the save.
- Restricted transaction evidence: only the account reference, deletion receipt, purchase verification and delivery/refund records, currency ledger and trade evidence needed for payment disputes, fraud prevention and deletion retries are retained, for up to 180 days after deletion. These records expire automatically and are not used for marketing or to restore gameplay.
- Backups: private backups expire within 30 days of creation. Backups containing restricted transaction evidence may therefore remain for up to 30 days after that evidence is removed from the live database. A separate deletion record prevents an old backup from restoring a deleted account to the game. Sign-in with Apple revocation is requested promptly; any encrypted token awaiting a failed revocation retry is removed within 30 days.
- Support: we keep correspondence only as needed to handle the request and any directly related dispute. You can ask us to delete it. We explain any specific legal requirement that prevents deletion.
Apple, Google and other independent providers retain their own transaction and account records under their policies and legal obligations. Deleting Fellfiend does not delete your Apple or Google account or automatically request a refund. Separate accounting records required by law are not copies of your game save.
7Your choices and rights
You can use the account and social settings to manage supported sign-in links and inventory visibility, and the deletion controls above to leave permanently. Contact [email protected] to request access, correction, deletion, restriction, portability or to object to processing, where those rights apply. We may ask for proportionate proof that the account is yours. We never need your password or full payment details.
We aim to respond within one calendar month. If the law allows an extension, we explain it. You may also complain to the data protection authority where you live, work or believe an infringement occurred.
8Website and security
The website does not use advertising or analytics cookies. Its server receives the network information needed to deliver a page; our website application does not maintain visitor access logs. Cloudflare processes network requests for delivery and security. Links to Discord and store websites take you to services governed by their own privacy policies.
The game connects to the public API over HTTPS. Access to private server records and backups is restricted. Credentials are protected with hashing or encryption as appropriate. No service can promise perfect security; please contact us if you suspect an account or privacy issue.
9Children
Fellfiend is not directed to young children. Players must meet the game’s age requirements and have any parental permission required where they live. If you believe a child has provided personal information without the required permission, contact us so we can investigate and remove it where appropriate.
10Changes to this policy
We update the date above when this policy changes and provide appropriate notice of material changes. Contact [email protected] with any privacy question.