Privacy policy
Last updated 26 September 2026
Prism Wings ("the game", "the app") is operated by the Prism Wings team, based in the United Kingdom ("we", "us"), who is the data controller for the personal data described here. This policy explains what information the game handles, why, where it is stored, how long it is kept, and the choices and rights you have. Questions and requests: hello@prismwings.com.
The short version
- You can play without ever giving us your name or email. The game creates an anonymous account (a random identifier) so your collection can be backed up and so multiplayer features work.
- We collect gameplay data (your collection, decks, progress, currencies), a display name you choose, and the data needed to run battles, trades and nearby-player features, including a record of the players you meet.
- The game contains no advertising and no third-party analytics SDKs. We do not sell or rent your data to anyone, and we never will without asking you first.
- Game data is stored with our hosting provider, Supabase, in the European Union (Ireland).
- You can delete your account and its server data at any time, from inside the app or by email. Instructions are below.
- Prism Wings is not directed at children under 13.
What we collect, and why
| Data | What it is | Why we process it |
|---|---|---|
| Account identifier | A random anonymous ID created by our hosting provider when the game first connects. No name, email or phone number is required to play. | To back up your save, restore it on a new device, and identify your account in multiplayer features. Lawful basis: performance of our terms with you (contract). |
| Linked sign-in (optional) | If you choose to link your account with Apple or Google, we receive the identity token from that provider so your account can be recovered if you lose your device. With it comes the email address on that sign-in, and from Google the name and profile picture address on your Google account. Apple lets you hide your email, in which case we receive Apple's relay address instead. These details are stored with your account record. The game does not display them, does not use them to contact you, and shows you only a masked form of the address when you link. | Account recovery, at your request. Lawful basis: contract. |
| Purchases | If you buy card packs or a bundle, the payment is taken by Apple's App Store or Google Play. We never see or store your card or bank details. We receive and keep a record of the purchase: the store's transaction identifier, which product it was, which store, when, the cards it granted, and any later refund. Purchases are processed for us by RevenueCat, which receives your anonymous account identifier, the store's purchase receipt, your device type and your country. | Delivering what you bought to the right account exactly once, handling refunds, preventing fraud, and keeping the sales records the law requires. Lawful basis: contract and legal obligation. |
| Device identifier | A random identifier the game creates for this install. It is not your phone's hardware or advertising identifier, and it changes if you reinstall. | Letting a nearby player challenge or trade with the right device, and telling your devices apart when a save is backed up. Lawful basis: contract. |
| Gameplay data | Your card collection, decks, campaign and progression state, in-game currencies, reward claims and event progress. | Cloud backup and sync, and preventing duplication or abuse of in-game rewards. Lawful basis: contract and our legitimate interest in keeping the game's economy fair. |
| Display name and public profile | A display name you choose (filtered against a blocklist), plus the profile elements you decide to showcase, for example your favourite cards. What other players can see is limited server-side to these public elements. | So other players can recognise you in battles, trades and nearby encounters. Lawful basis: contract. |
| Battles and trades | Match moves and results in online battles; the contents and outcomes of card trades between players. | Making multiplayer work, settling trades correctly, and resolving disputes. Lawful basis: contract and legitimate interest (fairness and anti-cheat). |
| Nearby players (Bluetooth) | If you enable the nearby-player feature, the game uses Bluetooth to notice other Prism Wings players around you. While the feature is on and the game is open, your phone broadcasts a short fragment of the install identifier, the first few characters of your display name, and the codes of your showcase card and avatar, so nearby players can see who is there. Anyone within Bluetooth range running the game can receive this. It never includes your location, your email or your account identifier, and the broadcast stops when the game is in the background. Meeting, battling and trading with a nearby player then uses the profile data described above. The game does not collect GPS location. | Powering the street-pass style features you switch on. Lawful basis: consent. The feature is off until you grant Bluetooth permission, and you can turn the radar off in the game's Settings or revoke the permission in your device settings at any time. |
| Meets and passes | When you meet a player, we record both accounts, when it happened and the card each of you received. When your phone notices another player, the Wanderer Track keeps a short code for that player and the time, so each pass counts once. We never record where a meet or a pass happened. | Paying meet rewards, holding the once-a-day limit for each pair of players, and filling the Wanderer Track. Lawful basis: contract. |
| Save history | Copies of your save from the last 14 days, each with the device identifier it came from. | Putting your save back after a bug, a bad sync or a support request. Lawful basis: contract and legitimate interest (keeping progress safe). |
| Server logs | Our hosting provider logs each request the app makes to our servers: your IP address, the time, the app version and platform, and what was asked for. | Security, stopping abuse and fixing faults. Lawful basis: legitimate interest. |
| Player reports | If you report another player (for example over a display name), we receive the report you submit. | Moderation and safety. Lawful basis: legitimate interest. |
| Support email | Anything you send to our contact address. | Answering you. Lawful basis: legitimate interest. |
What we don't do
- No advertising, and no advertising SDKs in the app.
- No third-party analytics or tracking SDKs in the app.
- No selling, renting or trading of personal data, and no sharing of it for anyone else's marketing.
- No GPS or location collection. The nearby-player feature is short-range Bluetooth presence only.
- No profiling and no automated decisions that produce legal or similarly significant effects on you. The game does run automated fair-play checks: a save whose gems, cards or progress grow faster than play allows can be refused and returned to its last accepted state, and repeated cases pause trading on that account for a time. If you think a check got it wrong, email us and a person will look at it.
- This website sets no cookies, stores nothing on your device and loads nothing from anyone else: its fonts and scripts are served from prismwings.com itself.
Device permissions
The app asks for Bluetooth permission, and on some devices the related nearby-devices permission, only to power the nearby-player features. Saying no leaves the rest of the game fully playable. You can switch the radar off in the game's Settings, or withdraw the permission in your device settings, at any time.
Where your data lives, and transfers
Server data is hosted by Supabase, our backend provider, in the eu-west-1 (Ireland) region of the European Union, which the UK treats as providing adequate protection. Your device also keeps a local copy of your save. That copy stays on your device and is yours, until you delete the account, which removes it too.
We share data only with the processors needed to run the game: Supabase (hosting), RevenueCat (processing purchases, based in the United States), Apple or Google as the store you buy through, and Apple or Google if you choose to link your sign-in. Each processes data under their own agreements and safeguards, and where any processing happens outside the UK or the European Economic Area, it is protected by recognised transfer mechanisms such as adequacy decisions or standard contractual clauses. We may also disclose data where the law requires it, or to protect the safety of players or the integrity of the service.
How we protect it
Data travels between the app and our servers over encrypted connections (TLS), is stored encrypted at rest by our hosting provider, and is protected by row-level access rules so one player's account cannot read another's private data. Access to the production database is limited to the operator. No system is perfectly secure, but the service is built so that the sensitive surface stays as small as possible: the game never handles your payment details (the app stores do), and it never holds a password of yours.
How long we keep it
- Account and gameplay data: kept while your account exists, then deleted when you delete the account.
- Trade and reward records: kept while the account exists, because they are what makes trades and rewards provable and fair.
- Purchase records: the record of a purchase (the store's transaction identifier, the product, the date and any refund) is kept after the account is deleted, with the link to the account removed, for as long as tax and consumer law require, normally 6 years. It is also what stops one purchase being claimed twice.
- Fair-play records: a note of a refused save is kept while the account exists.
- Meet and pass records: kept while the account exists.
- Save history: each copy is deleted after 14 days.
- Server logs: kept by our hosting provider for a short time, currently about a week, then deleted.
- Player reports: kept as long as needed for moderation and safety.
- Support email: kept as long as needed to handle the conversation and any follow-up.
- Backups: deleted data leaves encrypted backups on the provider's rotation schedule, typically within weeks.
Deleting your account
2 different things, and you can do either:
- Unlink this device: in the app, open Settings and choose Unlink this device. Your collection stays on the phone and stops backing up to your account, and the next time you open the app the phone starts a fresh backup of its own. The account itself stays on our servers until you delete it.
- Delete the account: in the app, open Settings and choose account deletion. This permanently removes your account and everything stored about it on our servers, including any linked Apple or Google sign-in and the details that came with it, and wipes the save on your device as well. The one thing kept is the bare record of any purchases, no longer linked to you, as described above. The app restarts from the beginning. It cannot be undone, and cards you bought are not restored to a new account.
These steps also live on a dedicated page at prismwings.com/delete-account.
No device any more? Email hello@prismwings.com from the linked address (or with enough detail for us to find the account) and we will delete it for you.
Your rights
Under UK and EU data protection law (UK GDPR / GDPR) you can ask us for access to the data we hold about you, correction, deletion, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw the consent at any time. Write to hello@prismwings.com and we will respond within a month. You also have the right to complain to your data protection authority; in the UK, that is the Information Commissioner's Office (ico.org.uk).
If you live somewhere with its own privacy law, such as a US state privacy statute, we honour the equivalent requests (access, deletion, correction) on the same contact route. We do not sell or share personal data as those laws define it.
Children
Prism Wings is not directed at children under 13, and the app's store listings carry an age rating to match. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
Changes to this policy
If this policy changes in a way that matters, we will update this page and the date at the top, and flag significant changes in the app or on this site before they take effect where we reasonably can.
Contact
Prism Wings, United Kingdom
hello@prismwings.com
Data controller: Jonathan Mormone
A postal address for formal correspondence is available on written
request.