Privacy policy

Who is responsible

The operator and data controller is Andreas Katsiamides, trading as Midas Saketi. Short Kings appears under the Midas Saketi Games brand on Google Play, and this studio website uses the Midas Saketi Studios name. These names do not identify separate data controllers.

Privacy, parent and support enquiries: aakatsias@gmail.com.
Correspondence: 20 Armada Way, London E6 7AF, United Kingdom.
Telephone: +44 7925 786097.

Offline progress and backups

In the mobile app, offline Career and tournament progress are saved on your device. In the web game, Career and solo tournament progress are saved on our game server under private keys kept in your browser. Settings stay on the device.

Delete saved progress removes the Career and Tournament saves accessible from that device and the previous restore copy. Clearing browser storage alone removes your access keys; it does not send the server a deletion request.

Save Backup lets you export a file yourself. Optional cloud backup uploads your offline Career and Tournament character, nickname, results, inventory and progression under your signed-in online account. Uploading is not automatic. The backup is processed by the hosting and database providers for the online service, and is not shown to opponents.

You can download, replace or delete the cloud copy using the backup controls. It remains until you replace or delete it, or delete the linked account. Exported files remain wherever you choose to save or share them.

Online play and account recovery

Online play processes your login username, password hash, player nickname, character, attributes, inputs, results and progression. Connection information, including IP addresses and request information in server access logs, is processed to deliver and secure the service.

Opponents see your nickname, character, attributes and match activity. They do not see your password, parent email or date of birth. Please choose a nickname without a real name, phone number, school or other contact details.

Account recovery uses a recovery code, of which the server stores a hash. Keep the code private: using it changes the password and replaces the code. Recovery does not remove online age or parent-permission requirements.

Young players and parent permission

The date-of-birth screen helps determine the permission route. The app keeps raw birth dates out of local storage. A configured server uses the submitted date to determine eligibility without retaining the date. Existing sessions last up to 30 days.

Where parent permission is available, verification is followed by a separate approval choice. Permission lasts up to 30 days. Parents can withdraw permission from the management page in the same browser, or contact support for help. Availability depends on country and server configuration.

When available, Epic Kids Web Services (KWS) processes the parent email and verification information through its verification providers. Verification details are not sent to opponents. Withdrawal of online permission stops that permission; it does not by itself delete an account or offline progress.

Colyseus has confirmed that it can host games played by children and processes their data to provide its service, rather than for its own profiling or marketing. We remain responsible for the game's age and parent-permission arrangements.

Optional gameplay analytics

Optional analytics is off by default. Players who declare an age of 18 or over may separately opt in through Privacy & analytics. Children and players of unknown age are not included. Declining does not affect gameplay, rewards or online access.

If you opt in, analytics uses a separate random device credential to record catalogue character and item IDs, game modes, active time, results, progression, virtual purchases and fixed error categories. It does not include player names, account credentials, free text, precise location, advertising identifiers or screen recordings. The random identifier is pseudonymous, not anonymous.

The date you enter is used for the eligibility check without being stored; a coarse age setting stays on your device. Analytics is used to improve the game and its reliability, not for advertising. Hosting providers process this information.

Use Turn off & delete in Privacy & analytics to stop collection and request deletion for that device. An offline deletion request retries when the device reconnects. Other devices have separate choices. Events expire after 90 days and are removed at the next collection or reporting operation after expiry.

Google Play and Apple App Store purchases

Where in-app purchases are available, Court Coins are purchased through Google Play on Android or Apple's App Store on iOS. The relevant store handles checkout, payment methods, billing and refund requests under its own terms and privacy policy. We do not receive your payment-card number or your Google or Apple account password. For Apple's handling of purchase information, see App Store & Privacy.

We process your game-account identifier, product identifier, transaction or receipt reference, purchase destination (Career or Online Arena), coin quantity, transaction time, and verification and delivery status. We use this information to check the purchase with Google or Apple, deliver coins to the selected game balance, recover interrupted deliveries, prevent duplicate credit and investigate purchase support requests. Our online hosting and database providers process the game-server records needed for these purposes.

Purchase verification and delivery records are separate from optional gameplay analytics. Turning off optional analytics does not stop the processing needed to fulfil a purchase or protect your coin balance.

App-store billing records are separate from game-server purchase records. Deleting an online game account removes its associated game-server purchase records as described below, but does not delete purchase history or billing records held by Google or Apple. Each store applies its own retention and privacy arrangements to those records.

Images you choose to share

The sharing feature creates an image of your in-game appearance and achievements, including information shown on the card such as your player name, level and record. The image is created on your device. We do not upload it to our servers as part of sharing.

On Android, the image is placed in the app's private cache and the Android sharing menu lets you choose a destination. Temporary share images older than 24 hours are removed when another share image is created; this is not an automatic daily deletion. You can also clear the app's cache through Android settings.

On other supported platforms, the game uses the available system sharing option or lets you download the image. Copies you save or send are controlled by you and the receiving app or service under its own terms and privacy policy. Check the image before sharing it.

Support and privacy enquiries

If you email us, we receive your email address and the information you choose to send. We use it to answer your enquiry, provide support and handle privacy or parent requests. Google provides the email service. We do not use support enquiries for marketing.

We rely on our legitimate interests in responding to enquiries and providing support. Where we must handle a statutory request or keep a required record, we rely on the relevant legal obligation.

We keep correspondence for as long as necessary to resolve the enquiry, deal with relevant follow-up or disputes, and meet legal obligations. You can ask us to delete it; if an exception requires retention, we will explain it.

Please do not email passwords, recovery codes, payment-card details, dates of birth, identity documents or other unnecessary sensitive information. If verification is needed, we will arrange a proportionate way to do it.

Service providers and locations

• Colyseus Cloud, operated by GAMESTDIO TECNOLOGIA DA INFORMACAO LTDA in Brazil, hosts our multiplayer application on Vultr servers in Frankfurt, Germany. Its authorised staff in Brazil may access the servers to provide support or investigate an incident.
• Vultr supplies the application-server infrastructure. Colyseus identifies the selected server region as Frankfurt, while noting that Vultr may also process data in the United States.
• DigitalOcean hosts the Colyseus dashboard in the United States. Application logs pass through the dashboard when we view them, but are not stored there.
• Neon on AWS stores online account records in Frankfurt. Neon is a provider we use separately from Colyseus.
• OpenAI ChatGPT Sites hosts the browser game and optional gameplay analytics.
• Epic Kids Web Services and its verification providers handle parent verification when that feature is available.
• Google provides the support email service and, separately, Google Play checkout, billing and purchase verification.
• Apple provides App Store checkout, billing and purchase verification for in-app purchases on iOS.

These providers process information needed for their roles. Choosing Frankfurt for game hosting does not mean all support, infrastructure, verification or other service processing takes place in Germany.

We do not sell personal information or share it with advertising networks for targeted advertising. We may disclose information where required by law or where reasonably necessary to protect legal rights and address misuse.

Colyseus international transfers

For transfers from the European Economic Area to Brazil that it covers, the European Commission has adopted an adequacy decision, Decision (EU) 2026/179 of 26 January 2026.

We have mutually signed Colyseus's data processing agreement. The agreement provides for EU Standard Contractual Clauses and the UK Addendum for relevant UK transfers to Brazil, and an SCC fallback for EEA transfers if the adequacy decision does not cover them or ceases to apply. The agreement states that it takes effect on the date of the last signature.

For its infrastructure providers, Colyseus identifies EU Standard Contractual Clauses and the UK Addendum for Vultr, and the EU–US Data Privacy Framework and its UK Extension for DigitalOcean, with contractual clauses as a fallback. These are the arrangements described in the Colyseus documentation; they do not mean that every provider used by Short Kings processes data only in the UK or EEA.

Contact us if you would like information about international processing or the relevant safeguards, including an available copy of applicable contractual safeguards.

Server logs and retention

Colyseus keeps web-server access logs for 14 days. These can include IP addresses, connection times, request paths and browser information.

Application logs are rotated by size: the current file plus up to five compressed files of 100 MB each. There is no fixed time limit in that rotation, so older entries can remain longer on a quieter server. Colyseus does not keep backups of its application servers. This does not describe backups or restore copies held by our separate database provider, or backups you choose to make.

The Colyseus agreement provides for destruction of application servers and the personal data on them within 30 days after the hosted application is deleted or the agreement ends, subject to its stated legal-retention exception. This concerns the whole hosted application, not an individual player's account deletion. The countersignature status is explained above.

Other retention periods and deletion controls are described in the relevant sections of this policy: device and browser saves, optional cloud backups, analytics, sessions and permissions, shared images, and support correspondence.

There is currently no automatic deletion of online accounts or browser-key saves after a fixed period of inactivity. The deletion controls below let you remove the relevant records. Clearing browser storage without using those controls can leave server-held saves that you can no longer access with that browser.

Deleting your information

Use Delete online account in Player Settings or Policies & online permission, or visit the online account deletion page. You can request permanent deletion using your username and password or recovery code. Leave active online matches first.

Account deletion removes the online player, progression, login, linked cloud backup, and game-server purchase and permission records. It does not automatically remove separate operational logs, device saves, exported files, optional analytics, purchase history or billing records held by Google or Apple, or verification records held by KWS. Each has its own controls or provider arrangements; contact us for help.

Use Delete saved progress for the saves accessible from your current device, and Turn off & delete for that device's optional analytics. Resigning a Division career does not delete the online account. Removing the app or clearing browser storage alone does not send a request to delete an online account.

Parents can contact us to request help with their child's information, including access, correction, deletion or withdrawal of permission.

Your privacy rights

Depending on the circumstances and the law that applies, you may ask to access, correct or delete personal information, restrict its use, receive a portable copy, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

Players and parents can contact aakatsias@gmail.com. We verify identity or parental authority proportionately before disclosing or changing records and respond within the applicable legal time limits. Some rights have conditions or exceptions, which we will explain where relevant.

You may complain to the UK Information Commissioner's Office (ICO) or your local data protection authority.

Changes to this policy

We update this policy when relevant features, providers or data practices change. The date at the top shows the latest revision. Separate in-game choices continue to apply to optional analytics and online permissions.