Last updated: 7 August 2026
This policy explains what Legionaut collects, why, and what you can do about it. It is written to describe what the game actually does rather than to cover every hypothetical.
Legionaut is the game you are playing. Contact us at support@legionaut.com about anything in this policy, including requests to access or delete your data.
You can play without an account. When you first open the game we create a guest account identified by a random device identifier generated on your device. It is not your advertising ID, your phone number, or anything issued by your device maker, and it is not shared with anyone.
For a guest account we store: a display name and a four digit tag, your coins, trophies, wins, losses, draws and win streak, the army skin you have equipped and the items you own, and your daily login streak.
If you create an account we additionally store your email address and a password, kept only as a salted hash. We never store your password in a form we can read.
When you play a ranked match we store the moves you made, the result, and the rating change. Your last 50 matches are kept as your match history; older ones are dropped automatically as new ones arrive.
If you send a bug report through the game, we receive your message together with your display name, your account tag, whether you are a guest, and the platform you are playing on.
When you sign in, our server briefly records your IP address so it can limit repeated sign-in attempts from the same place. It is used for that and nothing else: it is not linked to your account, not used to work out where you are, and not shared. It is deleted automatically once it is no longer needed, within minutes of you stopping.
There is no advertising in Legionaut. There are no third party analytics or tracking tools. We do not sell your data, and we do not share it with anyone for marketing.
Your profile and inventory exist so your progress follows you between sessions and devices. Match data exists to run ranked matchmaking, decide results, and build the leaderboards. Your email address exists so you can recover your account and so we can verify it is yours. Bug reports exist so we can fix what you told us about.
We operate from Georgia. Your data is stored and processed there and by our hosting provider, which may be located elsewhere.
Georgia is outside the European Economic Area and the United Kingdom, and is not covered by a UK or EU adequacy decision. If you are in the EEA or the UK, that means your data is transferred outside it. Where that transfer happens we rely on the European Commission's Standard Contractual Clauses, or the UK equivalent, with the providers who handle it on our behalf.
Other players can see your display name, your tag, and your trophy count on the leaderboard and when matched against you. Nothing else about you is shown to them.
We use Resend to deliver verification and password reset emails. Your email address is passed to them for that purpose only.
Our servers are operated on our behalf by our hosting provider. Traffic between the game and our servers is encrypted in transit.
If you are in the EEA or the UK, we rely on these bases. Running your account, your matches and the leaderboards is necessary to provide the game you asked for, so we rely on performance of a contract. Keeping the game secure and fair, and acting on bug reports, rests on our legitimate interests. Where we ask for your consent, you can withdraw it at any time.
We keep your account data for as long as the account exists. Match history is limited to your most recent 50 matches. Verification and password reset codes expire shortly after they are issued and are deleted once used. The IP addresses used for sign-in rate limiting are deleted automatically within minutes.
Open Settings and choose "Delete account & data", or "Reset progress & data" if you are playing as a guest. This erases your server side record, including your profile, inventory, match history and leaderboard entry.
Deleting the app on its own does not delete your data, because your account lives on our servers rather than on your device. Please use the in game control instead.
Legionaut is not directed at children under 13, and we do not knowingly collect data from them. Some countries set a higher age before a child can agree to services like this on their own; where that applies to you, please ask a parent or guardian first. If you believe a child has given us personal data, contact us and we will remove it.
Wherever you live, you can erase everything yourself using the delete control in Settings.
If you are in the EEA or the UK you also have the right to ask us for a copy of your data, to correct it, to have it deleted, to receive it in a portable form, to restrict or object to how we use it, and to withdraw consent where we relied on it. You can exercise any of these by writing to us. You also have the right to complain to your local data protection authority, and in Georgia to the Personal Data Protection Service.
If you are in California you have the right to know what we collect, to have it deleted, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we do not use it for cross context behavioural advertising, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the game.