Terran Gold — Privacy Policy

Version 2026-09 · Effective 1 September 2026 · Last updated 31 August 2026
Controller: Sicarii Business LLC · support.terrangold.app@gmail.com

Plain-English summary. We collect the minimum data we need to run the game (account, location, gameplay, purchases, cashouts). We don't sell your data. You can request access, correction, or deletion at any time.

1 · What we collect

Category	Data	Why we need it	Retention
Account	Google sub / email, display name, avatar	Login, identifying you across devices, showing you on the leaderboard (if opted-in)	Life of account + 30 days after deletion request
Gameplay	Owned tiles, gold, TC, quests, achievements, streaks, mining rate	Running the game, syncing progress across devices	Life of account + 30 days
Coarse location	ISO country + first-level administrative region (state / prefecture / county)	Regional leaderboards, RMG eligibility check	Life of account
Precise location	GPS coordinates (only while the "Claim Nearby Tile" flow is open)	Verifying you're within tile range for a claim	Not persisted — used in-memory only
Device	OS, model, app version, install ID, IP address (short-lived)	Bug reports, fraud prevention, ad delivery	IP retained 90 days; other fields life of account
Purchases	Store receipts, RevenueCat entitlement, product SKU (never card numbers)	Restoring purchases, refund handling, tax reporting	7 years (tax law)
Cashouts	PayPal email, USD amount, timestamp, tax-reporting name/DOB/ID (only above the $600/£1,000 threshold)	Sending payouts, tax reporting, sanctions screening	7 years (financial recordkeeping)
Analytics	Anonymised event counters (sessions, key features used)	Improving the game	Aggregated forever; raw events 90 days
Ads	AdMob device advertising ID (opt-out honored), coarse ad-topic profile	Serving rewarded / banner ads	Per Google AdMob retention policy

2 · Legal basis (GDPR / UK-GDPR)

Contract — running the game, processing purchases and cashouts.
Legal obligation — tax reporting, KYC/AML, responding to lawful requests.
Legitimate interest — fraud prevention, security, service improvement, anonymised analytics.
Consent — precise location, personalised ads, marketing emails (opt-in only). Withdrawable at any time in Profile → Privacy or by contacting the DPO.

3 · Who we share with

Google (Sign-In, Firebase, AdMob): account identity, ad targeting, crash reports. Google is a separate controller for advertising data.
Apple (App Store): only for iOS purchase receipts.
RevenueCat: processor for in-app-purchase entitlement management.
PayPal: recipient email + payout amount when you cash out. PayPal is a separate controller for its own KYC.
MongoDB Atlas / hosting providers: processors under a data-processing agreement.
Emergent Deployments (Kubernetes hosting): processor.
Tax / legal advisors, when required: only the minimum necessary data.
Law-enforcement, when compelled: only under a valid legal request.

We do not sell your personal data. We do not share your data with data brokers.

4 · International transfers

Our servers are hosted primarily in the United States. When we transfer data out of the EU/UK/EEA, we rely on the EU–US Data Privacy Framework (where the recipient is certified) and the UK Extension. Standard Contractual Clauses (2021/914) are executed with all sub-processors that are not DPF-certified. A copy of the SCCs applicable to your data is available on request.

5 · Your rights

EU / UK / EEA / IL / CH residents

Access, rectification, erasure, restriction, portability, objection.
Withdraw consent at any time (does not affect prior lawful processing).
Lodge a complaint with your national data-protection authority (list at edpb.europa.eu). Israel: PPA — gov.il/privacy-protection-authority.

California / Colorado / Connecticut / Utah / Virginia residents (US)

Right to know what we collect, right to delete, right to correct, right to opt out of "sharing / sale" (we don't sell — but the opt-out button is available anyway in Profile → Privacy for CCPA compliance).
Right to non-discrimination for exercising any of the above.
Authorised-agent requests accepted with proof of authorisation.

Everyone else

You have the right to access and correct your data at any time from Profile → Account, and to delete your account. Non-account data (server logs, analytics) is anonymised or purged per §1 retention.

6 · How to exercise rights

Email support.terrangold.app@gmail.com with subject "Data Subject Request" and include:

Which right you want to exercise (access / delete / etc.)
The email address linked to your Terran Gold account
Enough info for us to verify identity (last purchase date, recent tile claim, etc.)

We respond within 30 days (GDPR/UK-GDPR), 45 days (CCPA, extendable once by another 45 days if we tell you why).

7 · Children

The App is not directed at children under 18. If we learn we have collected data from a user under 18 (or under 21 where local law applies to cashouts), we will delete the account and refund any pending cashout.

8 · Security

TLS 1.2+ for all traffic between the App and our servers.
Encryption at rest for the MongoDB Atlas cluster.
Least-privilege server access; audited admin actions (mint / cashout override) require a rotating ADMIN_KEY.
Server-side receipt validation for every IAP.
Region + age verification prior to first cashout.

No system is perfectly secure. In the event of a breach affecting your personal data we will notify you and the applicable supervisory authority within 72 hours of becoming aware, per GDPR Art. 33/34 (or the local equivalent).

9 · Cookies & SDKs

The App itself does not use browser cookies. It does embed the following native SDKs:

Google Sign-In (Emergent-managed)
Google AdMob (rewarded + banner ads; user can opt out of personalisation via device settings)
RevenueCat (IAP entitlement)
Expo (crash logging, over-the-air updates)

10 · Contact / DPO

Sicarii Business LLC — Data Protection Officer
support.terrangold.app@gmail.com
EU-representative (Art. 27 GDPR): appointed on request; email us for details.

11 · Changes

We may update this Policy. Material changes trigger an in-app prompt. Continued use after the effective date constitutes acceptance. Prior versions are available at sicariibusiness.github.io/terran-gold-legal/privacy-history/.