Privacy policy
Draft for review: this text has not been approved yet.
Last updated: November 9, 2026
In short
- You can play Cristalune without creating an account: we don't ask for your name, email address or phone number.
- The game creates a random identifier on your device. We use it to find your heroes.
- On leaderboards and in the Auction House, other players see your hero's name, level and country.
- Crash reports and game statistics are sent only with your consent, which you can withdraw at any time in Settings > Privacy.
- The game contains no advertising and does not track you across other apps or websites.
- You can erase everything at any time: delete my account.
- This website sets no cookies.
1. Data controller
ASURA STUDIO, SARL with a capital of €100, SIREN 994 847 358, 1 Cours du Buisson, 77186 Noisiel, France. Contact: contact@asura.studio.
2. Data we process
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Random device identifier, account identifier | Recognize you and keep your heroes | Performance of the contract | Until the account is deleted. An account with no login for 3 years is deleted along with its data. |
| Apple or Google identifier (opaque), if you link your account | Recover your account on another device. We keep neither your email nor your name. | Performance of the contract | Until the account is deleted or you unlink it |
| Heroes, names, levels, items, gold, Moons, Codex, quests, achievements | Run the game | Performance of the contract | Until the account is deleted |
| Device language, from which a country is derived; login dates | Country leaderboards, attendance statistics, support | Legitimate interest | Until the account is deleted. Then deleted within 30 days. |
| Auction House listings and sales | Run the Auction House, investigate abuse | Performance of the contract, legitimate interest | The log stays after the account is deleted, with no link to you |
| Corrections made to an account by our support | Support, traceability | Legitimate interest | Until the account is deleted |
| Outing statistics (map, duration, party size, average level) | Balance the game | Legitimate interest | Anonymous, no limit |
| Moon purchase history (through RevenueCat) | Carry out your purchases, credit Moons, process refunds | Performance of the contract, legal obligation | Erased with the account, except the transaction register that accounting law requires us to keep, anonymized |
| Device notification token, time zone offset | Send you the notifications you accepted (Auction House sale, forgotten quest reward) | Consent (system permission) | Erased with the account or when you turn notifications off |
| Crash report: device model and system, game version, description of the error | Fix crashes | Consent | 90 days at most. |
| Game statistics: random device-specific identifier (not linked to your account), model, system, game steps, IP address when sent | Understand where players get stuck or stop | Consent | According to GameAnalytics' policy (https://gameanalytics.com/privacy); the identifier is random and not linked to your account. |
| Update check: platform, game version, IP address seen on the request | Deliver fixes without going through the store | Legitimate interest (running the game) | 30 days. |
| IP address and server technical logs | Connection, security | Legitimate interest | 30 days. |
We do not collect your GPS location, contacts, photos or the content of your phone. The game has no messaging between players.
3. Third-party services
- Sentry (Functional Software, United States): crash reports. No hero name or account identifier is attached. Turned on only with your consent.
- GameAnalytics (GameAnalytics ApS, Denmark): game statistics. Turned on only with your consent. Deleting your account cuts any link to you but does not erase what was already sent: to request erasure, write to contact@asura.studio.
- RevenueCat (United States): management of Moon purchases. Receives your account identifier, purchase history and IP address, to perform the contract.
- Apple (APNs) and Google (FCM): deliver the notifications you accepted.
- Apple and Google: sell Moons and, if you ask, authenticate your account. We never see your payment details.
- Cloudflare R2: distributes the game's remote updates.
The game contains no advertising and no advertising measurement tool.
4. Consent and withdrawal
At first launch, the game asks whether you accept crash reports and game statistics. Declining takes nothing away from the game. You can change your mind at any time in Settings > Privacy: withdrawing stops sending and erases what was waiting to be sent. Notifications can also be turned off in your device settings.
5. Hosting and transfers
The game server is hosted by Hetzner Online GmbH, in Germany (European Union). Sentry, GameAnalytics and RevenueCat may process data outside the European Union, notably in the United States. These transfers are covered by the European Commission's standard contractual clauses and, for certified providers, by the EU–US Data Privacy Framework.
6. Your rights
You can access, correct, erase and receive your data in a common format, object to or restrict a processing, and withdraw your consent at any time. Write to contact@asura.studio stating the identifier shown in Settings > Account. You may also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).
7. Children
The game is intended for people aged 13 and over. Purchases may be subject to Apple or Google parental controls. Age rating: PEGI 3 on Google Play (IARC classification), 13+ on the App Store. In France, a player under 15 gives consent to statistics and crash reports only together with a holder of parental authority (article 45 of the French Data Protection Act); elsewhere, the age set by local law applies.
8. This website
This website sets no cookies, does not measure its audience and loads nothing from another server. Its host keeps technical logs. They are kept for 30 days.
9. Changes
If something important changes, we will tell you in the game and, if the purposes change, ask for your consent again. The date at the top of this page shows the latest version.