Privacy Policy

1. Introduction

Upscale Games ("we", "us", or "our") operates the Scale: Rise of Dragons website, mobile app, and online game platform (the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We are the controller of the personal information described here. You can reach us about any privacy matter at contact@upscale.games.

Our players are currently located in the United States, but we have written this policy to also meet the standards of the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

2. Information We Collect

We collect only the information we need to run the Service:

• Account information: your username, email address, and password. Passwords are never stored in readable form — they are hashed and salted. We also store an email-verification status and code, and your account creation and update dates.
• Google sign-in (optional): if you choose to sign in with Google, we receive your Google account identifier, email address, and name (used to suggest a username) from Google, and we store the Google identifier and a sign-in token we generate. We never receive or store your Google password.
• Marketing preference: whether you opted in to receive marketing or newsletter emails.
• Gameplay and progress data: match history and outcomes, skill ratings, leaderboard standing, decks you build, achievements, gameplay statistics, daily-mission progress, cosmetic items ("skins"), chests, and in-game currency balances.
• Social and communications data: in-game, lobby, direct, and global chat messages; friend lists, blocked players, and game invites; and any support, contact, or moderation reports you submit (including a snapshot of the relevant chat or game context at the time a report is filed).
• Purchase data: for real-money purchases we store a record of the items bought, quantities, amounts, tax and shipping totals, our payment processor's transaction identifiers (Stripe and legacy Square IDs, receipt links, subscription IDs), your subscription status and expiry, and — for physical merchandise — the fulfillment order and shipping-tracking identifiers. See Section 4 for how payment-card and shipping details are handled.
• Technical and security data: we briefly process your IP address to rate-limit sign-in, registration, and password-reset attempts and to protect against abuse. This is held only transiently in server memory and is not written to our database. Our server logs may contain account identifiers (such as your email, username, or internal player ID) for operational and troubleshooting purposes; these logs are kept only as long as needed for security and reliability.

We do not collect device advertising identifiers, precise location data, or behavioral tracking data, and we do not use analytics, advertising, or cross-site tracking technologies.

3. How We Use Your Information and Our Legal Basis

We use your information for the following purposes, relying on the legal bases noted:

• To provide the Service (performance of a contract): creating and managing your account, authenticating you, running matchmaking, recording games, maintaining ratings and leaderboards, and processing your purchases and subscriptions.
• To keep the Service safe and working (legitimate interests): preventing fraud and abuse, enforcing our terms, moderating chat and conduct, rate-limiting authentication, and diagnosing technical problems.
• To send marketing or newsletter emails (consent): only if you have opted in. You can withdraw this consent at any time by unsubscribing or contacting us, without affecting your account.
• To meet legal obligations: retaining transaction and tax records and responding to lawful requests.

4. Payments

Real-money payments are processed by Stripe. Your full payment-card number, security code (CVV), and billing and shipping address are entered directly with Stripe and are handed entirely to Stripe — this information never reaches or is stored on our servers. We retain only Stripe's transaction identifiers and plan, status, amount, and timestamp metadata needed to fulfill your order and support your account. For physical merchandise, your shipping address is passed from the checkout directly to our fulfillment provider and is likewise not stored in our database.

Stripe acts as an independent data controller for the payment information it collects and processes it under its own privacy policy, available at stripe.com/privacy.

5. How We Share Your Information

We do not sell your personal information and we do not share it for advertising. We share information only with the service providers ("subprocessors") that help us operate the Service, and only as needed for them to perform their function:

• Stripe — payment processing (see Section 4).
• Google — delivery of our transactional and account emails (for example, email verification and password resets) and, if you use it, Google Sign-In.
• Printful — fulfillment of physical merchandise; receives the recipient name, shipping address, and email needed to ship your order. We do not retain that shipping information ourselves.
• RealRate — our skill-rating and leaderboard service; receives your username and match results only. It does not receive your email address or other contact information.

We enter into data processing agreements with our subprocessors as a matter of standard practice. We may also disclose information where required by law or to protect the rights, safety, and security of our players and our Service.

Some information is public by design: your username, skill rating and leaderboard standing, win/loss record, account creation date, current ban status, unlocked achievements, gameplay statistics, and the cosmetic items (skins) you have equipped may be visible on leaderboards and public player profiles. Your email address, password, friend lists, chat messages, and purchase history are never public.

6. Cookies and Local Storage

We do not set advertising, analytics, or cross-site tracking cookies, and our website does not set tracking cookies of any kind. To keep you signed in, our app stores your sign-in credentials or session token in your browser's or device's local storage. This is strictly necessary for the Service to function and is cleared when you sign out.

7. Data Location and International Transfers

Our servers and database are hosted with cloud infrastructure providers located in the United States. If you access the Service from the EU, EEA, or UK, your personal information will be transferred to and processed in the United States. Where such transfers occur, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, with our hosting and email providers. Stripe handles its own international transfers under its own safeguards.

8. Data Retention

We keep your account information for as long as your account is active. When you delete your account, we permanently and immediately erase your account record — including your email address, username, password, Google identifiers, chat messages, friend and block lists, decks, achievements, statistics, ratings, and matchmaking entries.

For legal, tax, fraud-prevention, and safety reasons, a limited set of records is retained after account deletion, identified only by an internal reference rather than by your name or email: purchase and transaction records, completed-game outcomes and aggregate gameplay statistics, and moderation records such as reports and bans. Transient gameplay logs and chat messages are automatically purged on a short cycle during normal operation, and IP addresses used for rate-limiting are discarded from memory within minutes to an hour.

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct (rectify) inaccurate or incomplete information
• Delete your account and personal information (erasure)
• Receive a copy of your data in a portable, machine-readable format
• Restrict or object to certain processing
• Withdraw consent for marketing emails at any time

You can exercise several of these rights yourself from your account settings: use "Download My Data" to obtain a copy of your personal information in a portable, machine-readable (JSON) format, and delete your account at any time. To exercise any other right, or to request any data not included in the self-serve download, email us at contact@upscale.games. We will respond within 30 days. If you are in the EU, EEA, or UK, you also have the right to lodge a complaint with your local data protection authority.

California residents: we do not sell or share your personal information. You have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. You can exercise them using the contact details above.

10. Data Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, or destruction. Passwords are hashed and salted, payment-card data is handled entirely by Stripe, and connections to the Service are encrypted in transit. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

Scale: Rise of Dragons is intended for a general audience, but you must be at least 13 years old to create an account. We do not knowingly collect personal information from children under 13. In the EU and EEA, where a member state sets a higher digital- consent age (up to 16), users below that local age may use the Service only with the consent of a parent or guardian. If we learn that we have collected personal information from a child below the applicable age without the required consent, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on our website with a revised "last updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.