Privacy policy
Last updated 3 September 2026
Prism Wings ("the game", "the app") is operated by the Prism Wings team, based in the United Kingdom ("we", "us"), who is the data controller for the personal data described here. This policy explains what information the game handles, why, where it is stored, how long it is kept, and the choices and rights you have. Questions and requests: hello@prismwings.com.
The short version
- You can play without ever giving us your name or email. The game creates an anonymous account (a random identifier) so your collection can be backed up and so multiplayer features work.
- We collect gameplay data (your collection, decks, progress, currencies), a display name you choose, and the data needed to run battles, trades and nearby-player features.
- The game contains no advertising and no third-party analytics SDKs. We do not sell or rent your data to anyone, and we never will without asking you first.
- Game data is stored with our hosting provider, Supabase, in the European Union (Ireland).
- You can delete your account and its server data at any time, from inside the app or by email. Instructions are below.
- Prism Wings is not directed at children under 13.
What we collect, and why
| Data | What it is | Why we process it |
|---|---|---|
| Account identifier | A random anonymous ID created by our hosting provider when the game first connects. No name, email or phone number is required to play. | To back up your save, restore it on a new device, and identify your account in multiplayer features. Lawful basis: performance of our terms with you (contract). |
| Linked sign-in (optional) | If you choose to link your account with Apple or Google, we receive the identity token from that provider so your account can be recovered if you lose your device. Apple lets you hide your email. | Account recovery, at your request. Lawful basis: contract. |
| Gameplay data | Your card collection, decks, campaign and progression state, in-game currencies, reward claims and event progress. | Cloud backup and sync, and preventing duplication or abuse of in-game rewards. Lawful basis: contract and our legitimate interest in keeping the game's economy fair. |
| Display name and public profile | A display name you choose (filtered against a blocklist), plus the profile elements you decide to showcase, for example your favourite cards. What other players can see is limited server-side to these public elements. | So other players can recognise you in battles, trades and nearby encounters. Lawful basis: contract. |
| Battles and trades | Match moves and results in online battles; the contents and outcomes of card trades between players. | Making multiplayer work, settling trades correctly, and resolving disputes. Lawful basis: contract and legitimate interest (fairness and anti-cheat). |
| Nearby players (Bluetooth) | If you enable the nearby-player feature, the game uses Bluetooth to notice other Prism Wings players around you. What is broadcast is a short fragment of a per-install identifier, not your name and not your location. Meeting, battling and trading with a nearby player then uses the profile data described above. The game does not collect GPS location. | Powering the street-pass style features you switch on. Lawful basis: consent. The feature is off until you grant Bluetooth permission, and you can revoke it in your device settings at any time. |
| Player reports | If you report another player (for example over a display name), we receive the report you submit. | Moderation and safety. Lawful basis: legitimate interest. |
| Support email | Anything you send to our contact address. | Answering you. Lawful basis: legitimate interest. |
What we don't do
- No advertising, and no advertising SDKs in the app.
- No third-party analytics or tracking SDKs in the app.
- No selling, renting or trading of personal data, and no sharing of it for anyone else's marketing.
- No GPS or location collection. The nearby-player feature is short-range Bluetooth presence only.
- No profiling and no automated decisions that produce legal or similarly significant effects on you.
- This website is static and sets no cookies of its own.
Device permissions
The app asks for Bluetooth permission, and on some devices the related nearby-devices permission, only to power the nearby-player features. Saying no leaves the rest of the game fully playable. You can withdraw the permission at any time in your device settings and the feature simply switches off.
Where your data lives, and transfers
Server data is hosted by Supabase, our backend provider, in the eu-west-1 (Ireland) region of the European Union, which the UK treats as providing adequate protection. Your device also keeps a local copy of your save. That copy stays on your device and is yours, until you delete the account, which removes it too.
We share data only with the processors needed to run the game: Supabase (hosting), and Apple or Google if you choose to link your sign-in. Each processes data under their own agreements and safeguards, and where any processing happens outside the UK or the European Economic Area, it is protected by recognised transfer mechanisms such as adequacy decisions or standard contractual clauses. We may also disclose data where the law requires it, or to protect the safety of players or the integrity of the service.
How we protect it
Data travels between the app and our servers over encrypted connections (TLS), is stored encrypted at rest by our hosting provider, and is protected by row-level access rules so one player's account cannot read another's private data. Access to the production database is limited to the operator. No system is perfectly secure, but the service is built so that the sensitive surface stays as small as possible: the game never handles your payment details (the app stores do), and it never holds a password of yours.
How long we keep it
- Account and gameplay data: kept while your account exists, then deleted when you delete the account.
- Trade and reward records: kept while the account exists, because they are what makes trades and rewards provable and fair.
- Player reports: kept as long as needed for moderation and safety.
- Support email: kept as long as needed to handle the conversation and any follow-up.
- Backups: deleted data leaves encrypted backups on the provider's rotation schedule, typically within weeks.
Deleting your account
2 different things, and you can do either:
- Stop syncing: in the app, open Settings and unlink your account. Your local save stays on your device and the game keeps working; it simply stops sending anything.
- Delete the account: in the app, open Settings and choose account deletion. This permanently removes your account and everything stored on our servers, including any linked Apple or Google sign-in, and wipes the save on your device as well. The app restarts from the beginning. It cannot be undone.
These steps also live on a dedicated page at prismwings.com/delete-account.
No device any more? Email hello@prismwings.com from the linked address (or with enough detail for us to find the account) and we will delete it for you.
Your rights
Under UK and EU data protection law (UK GDPR / GDPR) you can ask us for access to the data we hold about you, correction, deletion, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw the consent at any time. Write to hello@prismwings.com and we will respond within a month. You also have the right to complain to your data protection authority; in the UK, that is the Information Commissioner's Office (ico.org.uk).
If you live somewhere with its own privacy law, such as a US state privacy statute, we honour the equivalent requests (access, deletion, correction) on the same contact route. We do not sell or share personal data as those laws define it.
Children
Prism Wings is not directed at children under 13, and the app's store listings carry an age rating to match. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
Changes to this policy
If this policy changes in a way that matters, we will update this page and the date at the top, and flag significant changes in the app or on this site before they take effect where we reasonably can.
Contact
Prism Wings, United Kingdom
hello@prismwings.com
Data controller: Jonathan Mormone
A postal address for formal correspondence is available on written
request.