Last updated: 30 September 2026
This policy explains what Legionaut collects, why, and what you can do about it. It is written to describe what the game actually does rather than to cover every hypothetical.
Legionaut is the game you are playing. Contact us at support@legionaut.com about anything in this policy, including requests to access or delete your data.
You can play without an account. When you first open the game we create a guest account identified by a random device identifier generated on your device. It is not your advertising ID, your phone number, or anything issued by your device maker, and it is not shared with anyone.
For a guest account we store: a display name and a four digit tag, your coins, trophies, wins, losses, draws and win streak, the army skin you have equipped and the items you own, your daily login streak, the day you last opened the game, kept as one value that is overwritten each time you play rather than a history of your visits, and your progress toward achievements.
If you create an account we additionally store your email address and a password, kept only as a salted hash. We never store your password in a form we can read.
On iPhone and iPad you can sign in with Game Center. If you do, we receive and store your Game Center player identifier so your progress follows you to another device, and your account counts as a registered account. Your achievements are decided by our server and reported to Game Center, which shows them to you and, depending on your Game Center settings, to your Game Center friends. We do not receive your Apple ID, your Game Center nickname or your friends list.
When you play a ranked match we store the moves you made, the result, and the rating change. Your last 50 matches are kept as your match history; older ones are dropped automatically as new ones arrive.
If you send a problem report through the game, we receive your message together with your display name, your account tag, whether you are a guest, and the platform you are playing on. Unless you untick "Include my device info" on the report form, the report also carries technical details of your device: the game and system versions, the device model, processor, memory, graphics chip and graphics mode, the screen and window size, and the game's language and graphics quality setting. None of these identify your device on their own, and we use them only to look into the problem you reported. The box is ticked each time you open the form, and you can untick it for any report.
When you sign in, our server briefly records your IP address so it can limit repeated sign-in attempts from the same place. It is used for that and nothing else: it is not linked to your account, not used to work out where you are, and not shared. It is deleted automatically once it is no longer needed, within minutes of you stopping.
We also measure how you use the game. We store how many seconds the app was in the foreground and how many times you opened it, per day, linked to your account. That is different from the day you last played, above, which we record for every account either way. We use it only to understand how long sessions run and whether players come back, and only in totals. It is never shared with anyone. This is on unless you turn it off, and you can turn it off, or back on, at any time from Settings. We keep it for 400 days, and deleting your account deletes it along with everything else.
Separately, we keep anonymous totals that are never linked to any account: how many matches are played in each mode, win rates by army and mode, how often each bonus is used, which operating systems players use, and how many players reach each step of getting started. These carry no account identifier at all, so they are not personal data. We keep them indefinitely.
There is no advertising in Legionaut. There are no third party analytics or tracking tools. We do not sell your data, and we do not share it with anyone for marketing.
Your profile and inventory exist so your progress follows you between sessions and devices. Match data exists to run ranked matchmaking, decide results, and build the leaderboards. Your email address exists so you can recover your account and so we can verify it is yours. Problem reports, and the device details sent with them, exist so we can fix what you told us about.
We operate from Georgia. Your data is stored and processed there and by our hosting provider, which may be located elsewhere.
Georgia is outside the European Economic Area and the United Kingdom, and is not covered by a UK or EU adequacy decision. If you are in the EEA or the UK, that means your data is transferred outside it. Where that transfer happens we rely on the European Commission's Standard Contractual Clauses, or the UK equivalent, with the providers who handle it on our behalf.
Other players can see your display name, your tag, and your trophy count on the leaderboard and when matched against you. Nothing else about you is shown to them.
We use Resend to deliver verification and password reset emails, and to forward problem reports to our own inbox. Your email address is passed to them for the first, and the contents of a report, as described above, for the second. Neither is used for anything else.
Our servers are operated on our behalf by our hosting provider. Traffic between the game and our servers is encrypted in transit.
If you use Game Center, Apple receives which achievements you have earned in Legionaut. Apple handles that under its own privacy policy.
If you are in the EEA or the UK, we rely on these bases. Running your account, your matches and the leaderboards is necessary to provide the game you asked for, so we rely on performance of a contract. Game Center sign-in and achievements are part of providing the game you asked for when you turn Game Center on. Keeping the game secure and fair, and acting on problem reports, including the device details that come with them unless you leave them out, rests on our legitimate interests. Gameplay measurement rests on our legitimate interests too: we need to know whether the game holds up over a session and whether players return, we cannot answer that from anything else we hold, and the measurement is limited to our own game, is never linked to anything outside it, is not used to profile you or to advertise to you, and goes to no one else. You have the right to object to it, and the switch in Settings is how you do that, with no reason needed and no effect on anything else. Where we otherwise ask for your consent, you can withdraw it at any time.
We keep your account data for as long as the account exists. Match history is limited to your most recent 50 matches. Verification and password reset codes expire shortly after they are issued and are deleted once used. The IP addresses used for sign-in rate limiting are deleted automatically within minutes. Gameplay measurement, unless you have turned it off, is kept for 400 days. The anonymous totals described above carry no account identifier and are kept indefinitely.
Open Settings and choose "Delete account & data", or "Reset progress & data" if you are playing as a guest. This erases your server side record, including your profile, inventory, match history, leaderboard entry, and any gameplay measurement data if you turned that on. Deleting your account also removes the Game Center link, and, while you are signed in to Game Center, asks Game Center to reset your Legionaut achievements.
Deleting the app on its own does not delete your data, because your account lives on our servers rather than on your device. Please use the in game control instead.
Legionaut is not directed at children under 13, and we do not knowingly collect data from them. Some countries set a higher age before a child can agree to services like this on their own; where that applies to you, please ask a parent or guardian first. If you believe a child has given us personal data, contact us and we will remove it.
Wherever you live, you can erase everything yourself using the delete control in Settings.
If you are in the EEA or the UK you also have the right to ask us for a copy of your data, to correct it, to have it deleted, to receive it in a portable form, to restrict or object to how we use it, and to withdraw consent where we relied on it. You can exercise any of these by writing to us. You also have the right to complain to your local data protection authority, and in Georgia to the Personal Data Protection Service.
If you are in California you have the right to know what we collect, to have it deleted, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we do not use it for cross context behavioural advertising, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the game.