Privacy Policy

Last updated: 28 July 2026

This policy explains what Folklores: Rise of the Diwata ("the Game") collects, why, and what you can do about it. It covers the mobile game and this website.

The short version. You can play without giving us anything. The Game creates an account for you automatically, and your progress lives on our server rather than on your phone. Connecting a Google account is optional, and it is the only way to get your progress back if you uninstall the Game or change device. We do not sell your data, we do not share it with advertisers, and we ask for nothing beyond what the Game needs to work.

1. Who we are

Sherwin Chua, 15 Yishun Close, Singapore, is the data controller for the Game. You can reach us at privacy@folkloresthegame.com.

2. What we collect

Data	Why	Source
An anonymous account identifier	To know which progress is yours. Created automatically when you first open the Game, without you signing in or giving us anything	Firebase Authentication
Optional: Google account identifier, email address, display name	Only if you choose to connect a Google account. It is what lets us give your progress back if you uninstall the Game or change device, and it is required before any purchase	Google Sign-In, via Firebase Authentication
Game state: currencies, creatures owned, campaign progress, battle history	The Game is server-authoritative, so this is the Game itself, not a copy of it	Created as you play
An internal player identifier	Everything above is keyed to this rather than to your Google account	Generated by us
Technical logs: IP address, device model, operating system version, timestamps	Security, abuse prevention, and diagnosing crashes	Automatic

We do not collect your name, date of birth, phone number, postal address, contacts, photos, precise location, or any biometric data. We never see or store your Google password.

3. How we use it

To run the Game: saving progress, awarding rewards, and resolving battles.
To keep the Game fair: detecting cheating, duplicate accounts, and abuse.
To support you when you contact us about your account.
To meet legal and regulatory obligations, including record-keeping for chance-based ("gacha") mechanics.

We do not use your data for advertising, profiling for marketing, or automated decisions with legal effects.

4. Who we share it with

Only the service providers the Game runs on, and only as needed:

Provider	Purpose	Their policy
Google (Firebase Authentication)	Verifies who you are when you sign in	Firebase privacy
Google Play	Distributes the Game and delivers its downloadable content	Google privacy
Cloudflare	Serves this website	Cloudflare privacy
Amazon Web Services	Hosts the game server and its database	AWS privacy

We do not sell your personal data, and we do not share it with data brokers or advertising networks.

5. Where your data lives

Your game data is stored in Singapore. Authentication is handled by Google's infrastructure, which may process data outside Singapore. Where data is transferred abroad, we rely on the providers' contractual safeguards.

6. How long we keep it

Account and progress — for as long as your account exists. When you ask us to delete your account we keep it for a 45-day grace period, during which signing in again cancels the request, and then delete it. See Account & Data Deletion.
Technical logs — retained for a limited period for operational and security purposes, then discarded. They may contain your IP address for that period.
Records of chance-based rewards — retained after account deletion in an anonymised form, with no route back to you. We keep these because we may be required to demonstrate that advertised drop rates were honoured.

7. Your choices

You may ask us to:

Tell you what data we hold about you.
Correct anything inaccurate.
Delete your account and personal data, from inside the Game or by email — see Account & Data Deletion.
Disconnect your Google account, which removes your email address and display name from our records. Your progress stays, but it can no longer be restored if you uninstall the Game.
Withdraw consent entirely, which means closing your account, since the Game cannot run without an account of some kind.

Email privacy@folkloresthegame.com. We reply within 30 days.

8. Children

The Game is not directed at children under 13, and we do not knowingly collect their data. It contains chance-based reward mechanics. If you believe a child has given us personal data, contact us and we will delete it.

9. Security

If you choose to sign in, it is handled by Google; we never receive your password. Traffic between the Game and our server is encrypted in transit. Access to the database is restricted. No system is perfectly secure, and we do not claim otherwise.

10. Changes

We will update this page and change the date above when this policy changes. Material changes will be announced in the Game before they take effect.

11. Contact

privacy@folkloresthegame.com
Sherwin Chua, 15 Yishun Close, Singapore

If you are unhappy with our response, you may complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.