Privacy Policy

Effective date: 20 October 2026

OnKnights Tactics is a free auto-battler for iOS, Android and the web (onknights.com). It has no ads, no in-app purchases and no advertising or cross-app tracking. We do not sell your data. This policy tells you exactly what the game collects and stores.

In this policy, "we" means the independent developer of OnKnights Tactics. Contact: eray@better-i18n.com.

1. Playing offline (no account)

The campaign and skirmish against bots work without an account and without a network connection. The game keeps a profile only on your device (app storage on iOS and Android, local storage in the browser on the web):

your knight name and nation banner,
settings: language, sound and music volume, haptics, skirmish options,
campaign progress and stars, skirmish record, offline XP and level.

Without an account, we do not receive this data. It stays on the device until you uninstall the app or clear the browser data. Settings > Reset progress erases your level, XP, campaign and skirmish record, but keeps the knight name and settings. If you sign in to an account, the app sends your offline XP total and your campaign progress (cleared scenarios and their stars) to the server: the XP counts toward your account level, and the campaign progress comes back after a reinstall or on a new device. When you are signed in, Reset progress also deletes the campaign progress on your account. Your knight name and nation do not leave the device.

2. Online account

Online 1v1 duels need an account. You only choose a username and a password. We do not ask for your email address, real name, phone number or birthday. The server stores:

Account: username (it is also your display name), the date the account was created and last changed. The account system needs an email field, so the server fills it with a placeholder made from your username (for example knight@players.onknights.invalid). This address does not exist and we never send email to it.
Password: stored only as a salted hash (PBKDF2-SHA256). We cannot see or recover your password.
Sessions: for each sign-in, a session token, its creation and expiry time, and the IP address and user agent (browser or app and device type) of the request. We use these to keep you signed in and to protect accounts. Your device keeps the token in the iOS Keychain, the Android Keystore or, on the web, in browser local storage.
Game record: rating and peak rating, duels, wins, losses, draws and streaks, training games against bots, online XP and the offline XP total from your device (your level), and campaign progress (cleared scenarios and their stars).
Match history: for each finished duel, the opponent's username, the result, the number of rounds, the rating change and the start and end time.
Invites: the invite codes you create, when they expire and who used them, and who invited you and when.

What other players see

Your username, level, rating and duel record are public: they show on the leaderboard and on your player profile. Your opponent sees your username during a duel and in their match history. After you delete your account, their history shows "Deleted player" instead. A friend who opens your invite link sees your username.

Short-lived technical data

While you wait for or play a duel, the server keeps the queue entry (user id, username, rating, level and a broad region such as "Europe", derived from your IP address to pick a nearby server) and the match state. The match state is removed about 10 minutes after the duel ends; cached ratings are removed after 24 hours.
To stop abuse, the server counts requests per IP address for one minute (rate limiting).
To stop bots, the beta page and account creation on the web use the Cloudflare Turnstile check. The check sends browser and device signals to Cloudflare. Our server then sends the check token and your IP address to Cloudflare to verify the result. Cloudflare gets no email address and no username. The iOS and Android apps do not use this check.
Our hosting provider keeps technical logs (errors and request details such as time, path and IP address) for a few days, to run and secure the service.

3. Usage data (telemetry)

To find errors, measure speed and balance the game, the app sends usage events to our server. The setting Settings > Share usage data is on by default. If you turn it off, the app stops sending events, deletes the events that wait on the device and deletes its random install id.

Events from the app: app start and start-up time, screen changes, game start and end (mode, scenario, difficulty, rounds, result, frame rate), quitting a game, wait time in the online queue, level-ups, tutorial steps, app errors (with technical error details) and failed network requests.
With each batch: a random install id made on your device, a session id, the app version, the platform, the device model, the operating system version and the language setting. If you are signed in, also your account id (a random id, not your username). The server adds the country, derived from your IP address. It does not store the IP address with the events.
Events from the server: sign-ups, invite use, matchmaking, duel results, beta sign-ups (without the email address) and server errors. These events can contain your account id.
Beta page: when you open onknights.com/beta or tap one of its buttons, the server counts the step (for example "opened the page" or "tapped the test link"), the language, the link you came from and your country. These counts have no id, no email address and no IP address.

The events do not contain your username, knight name, email address or advertising identifier. We look at them in aggregate and to fix errors. They are stored in Cloudflare Workers Analytics Engine and deleted automatically after 3 months. This store cannot delete single events, so events sent before you turned the setting off stay until they expire.

4. Push notifications

Push notifications are optional, and the app asks for your permission first. If you allow them while you are signed in, the app gets a push token from Google Firebase Cloud Messaging (on iOS through the Apple Push Notification service). Our server stores the token, your account id, the platform, your language and when the token was saved. The app also subscribes the device to a news topic in your language. It leaves this topic when you sign out or turn notifications off.

We send a message when a friend uses your invite, a message when your online duel continues after you left the app, a message when you missed a planning phase in a duel (before the duel counts you as away), and rare game news. We do not send ads.

We delete the token when you sign out, when you turn notifications off in Settings, when the token stops working and when you delete your account. You can also turn notifications off in the settings of your device.

5. Beta sign-up

The page onknights.com/beta asks for an email address so that we can add you to the test version of the app. We store the email address, the platform (Android or iPhone), the language, the link you came from (for example a social network), the time of the sign-up and the state of the tester list entry. For Android, we do not send the email address to Google. You join our public Google Group (groups.google.com/g/onknights-beta) yourself with your Google account. That group is the tester list of the Google Play closed test, so Google and the group owners see your address. Other members do not see it. You can leave the group at any time. For iPhone, we can invite the email address to Apple TestFlight, so Apple receives it. We use the email address only for the beta test and do not link it to a game account.

We keep a beta sign-up until you ask us to delete it, and at the latest until the beta test ends. To delete it, email eray@better-i18n.com. We then remove it from our database and from the tester list.

6. Why we use this data

To provide the account and online duels you ask for: sign-in, matchmaking, rating, level, match history, leaderboard and invites.
To keep the service secure: session protection, rate limiting and finding errors.
To improve the game: usage data to find errors, measure speed and balance the game (section 3).
To send the push notifications that you allowed (section 4) and to run the beta test (section 5).

We do not use your data for advertising or profiling, and we do not use it to train AI models. The app does not access your contacts, location, camera, microphone, photos or advertising identifier.

7. Who processes the data

The game server, database, usage data and this website run on Cloudflare (Workers, Durable Objects, D1 and Workers Analytics Engine), which processes the data on our behalf. Other service providers:

Cloudflare Turnstile checks for bots on the beta page and when you create an account on the web (section 2).
Google Firebase Cloud Messaging and, on iOS, the Apple Push Notification service deliver push notifications, only if you allow them (section 4).
Google (Google Groups and Google Play) gets the Google account of Android beta testers who join our tester group themselves, and Apple (TestFlight) receives the email address of iPhone beta testers that we invite (section 5).

These providers run global networks, so data can be processed outside your country. The app contains no third-party analytics, advertising or tracking SDKs. We share data with authorities only when the law requires it.

The website onknights.com sets no cookies. Only the beta page and the account screen of the web app load a third-party script: the Cloudflare Turnstile check from challenges.cloudflare.com.

8. How long we keep data

Account data, game record, match history and invites: until you delete the account.
Sessions: deleted when you sign out or delete the account. A session that you do not use stops working after 30 days.
Queue and match state: minutes to 24 hours, as described above. Technical logs: a few days.
Usage data: 3 months.
Push tokens: until you sign out, turn notifications off or delete the account, or until the token stops working.
Beta sign-ups: until you ask us to delete them, and at the latest until the beta test ends.
After you delete your account, the database recovery history of our host can still contain a copy for up to 30 days. After that, the data is gone.

9. Deleting your data

Account: in the app, open Account > Delete account. On the web, sign in at onknights.com/account and do the same. Or email eray@better-i18n.com from any address with your username; we can ask you to prove that the account is yours. See Delete account for the steps and what is deleted.
Offline profile: uninstall the app, or clear the site data of onknights.com in your browser. Settings > Reset progress erases only your progress (level, XP, campaign and skirmish record). When you are signed in, it also deletes the campaign progress on your account.
Usage data: turn off Settings > Share usage data. Events that were already sent are deleted after 3 months.
Push notifications: turn them off in Settings or in the settings of your device. We then delete the push token.
Beta sign-up: email eray@better-i18n.com from the address that you signed up with.

10. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, the KVKK in Turkey, the LGPD in Brazil or US state laws), you can ask to see, correct, export or delete your data, and you can object to or restrict its use. Email eray@better-i18n.com. We answer within 30 days. You can also complain to your data protection authority. We process account data to provide the service you ask for (contract) and for security (legitimate interest). We process usage data for our legitimate interest in a working and balanced game; you can object at any time with the setting Share usage data. We send push notifications and process beta sign-ups with your consent, which you can withdraw at any time.

11. Children

OnKnights Tactics is not directed at children under 13, and we do not knowingly collect personal data from children under 13 (or the minimum age in your country). An account needs no personal details other than a username. If you think that a child gave us personal data, email eray@better-i18n.com and we will delete it.

12. Security

All connections use HTTPS or secure WebSockets (TLS). Passwords are hashed, and sign-in is rate-limited. No system is perfectly secure, so use a password that you do not use elsewhere.

13. Changes

If we change this policy, we update this page and the effective date. If a change is important, we also tell you in the app.

14. Contact

Questions about privacy: eray@better-i18n.com.