Privacy policy

1. Who we are

Cloudfall: Expeditions is a stand-alone strategy game set in the world of The Great Cloud. It is made and published by Kai Karhunen, an independent developer and sole trader in the United Kingdom, under the name The Great Cloud, the developer name on the game's Google Play listing ("we", "us"). Kai Karhunen is the controller of the personal data this policy describes as reaching us, and is registered with the UK Information Commissioner's Office. If the game moves to a company before or after release, we will update this policy first.

Privacy questions and requests: support@thegreatcloudgame.life.

This policy covers the game on Android phones and tablets and on Google Play Games on PC, and the closed test of the game. Our website, thegreatcloudgame.life and its subdomains, including its waitlist and its optional analytics, is covered by the website's own privacy notice.

We do not run a game server. We run one small service, on Cloudflare, that hands out temporary relay passwords (section 7). The game itself collects no gameplay analytics, advertising identifiers, contact lists, location, payment details or account information. Google Play Games, if you use it, is run by Google (section 5).

2. On your device and Android backup

The game stores these on your device, in its own app storage:

• your expedition leader's name, sponsor and livery choices, the looks you wear, and your settings;
• experience, sponsor mastery, feats (achievement progress), match history and records, daily and weekly streaks, Ledger seals and titles, and tutorial progress;
• a saved solo or pass-and-play match, so you can resume it, and your recent replays;
• for online play: your block list, a signing key for each recent room, the offer to rejoin a match you dropped out of (with its room code), and your recent online matches. A finished online match is kept as a replay record: the seed, the setup, and each player's orders and shown name. An unfinished one keeps what is needed to rejoin it, including its signed turn history, which holds the other players' shown names and their public room keys;
• a short log of recent errors, and whether the game has already asked you for a rating.

How much is kept is limited: see section 13. Clearing the app's storage, or uninstalling the game, removes all of it from the device. We cannot see this data or recover it for you.

Android backup

The game allows Android's own backup (Auto Backup). When backup is on for your device, Android can copy the game's app storage (everything in the list above except the room signing keys) to your Google account's backup, and can move it to a new phone. That includes your recent online matches, so the backup also holds other players' shown names and orders from those matches. The backup is kept by Google under your Google account and Google's policies; it is not sent to us, and we cannot read it. The signing keys and the game's caches are left out, so a restored phone makes fresh keys, and an online match from the old phone cannot be rejoined. You can turn backup off, or delete backups, in your device's Google or backup settings.

3. Graphics and performance

To choose graphics settings, the game reads your device's performance characteristics: model, processor, memory, temperature state, Game Mode state, screen refresh rate, and whether other music is playing. This happens on your device, and this information is not sent anywhere: not to us, not to other players.

4. Things you choose to send

Copy diagnostics

Settings › About › Copy diagnostics (also offered on the error recovery card) copies a block of text to your clipboard: the game's version and rules version, your device model and Android System WebView version (from the browser's user agent), screen size, processor cores, graphics tier and measurements, a summary of the sound system, your settings and the last errors seen. Nothing is sent unless you paste it into a message and send it yourself.

Support emails

Settings › About › Support opens your own email app with our address and the game's version in the subject. If you email us, we receive your email address, your message and anything you attach, and we use them only to answer you and to fix problems you report.

Sharing a result

After a daily or weekly challenge you can share a result line: the period, whether you won or finished, your place, the number of seats, your score, the turns and your streak. It holds no name and no link. It goes only where you send it, through your device's own share sheet or clipboard.

5. Google Play Games (optional)

The game works with Google Play Games Services, Google’s service for game achievements and cloud saves. Using it is optional. If you have a Google Play Games profile, the game can sign in to it automatically; you can change this in your Play Games settings, and if you are not signed in the game works the same, keeping your progress only on your device. When you are signed in:

• the feats you earn are sent to Google as achievements under your Play Games profile;
• your progress is saved to your Play Games account (Saved Games), so a new phone or a reinstall keeps it: your experience, sponsor mastery, the feats you have earned, your Expedition Ledger seals and titles, and the looks you wear (at most 64 KB). It holds no name, signing keys or match. The game saves it when you sign in (first combining the saved copy with the progress on this device), when a match ends, every 5 minutes while something has changed, and when the app goes to the background;
• Google's Play Games software also collects diagnostic and analytics information about its own operation, under Google's policies;
• the game never receives your Google account name or email address, and your Play Games identity is never shown to other players or used for online play. Play Console shows us only overall statistics, such as how many players have unlocked each achievement; we cannot see individual players’ Play Games data or saves.

Google's Privacy Policy applies to this data. You can view or delete your Play Games data from your Play Games profile or your Google Account.

After your second win or third finished match, back at the menu, the game may show Google Play's rating prompt once. Your rating and review go directly to Google Play.

On Google Play Games on PC, the game tells Google's on-screen controls overlay its fixed keyboard and mouse map. That stays on your PC and holds nothing about you.

6. Online play

Solo, daily, weekly, Ledger and pass-and-play games do not need a network connection. If you choose to play online, your device connects directly to the other players' devices (peer to peer).

What other players receive

• Game state and orders, over encrypted WebRTC channels, signed with a key made for that room only, so your keys cannot link your rooms together.
• In a private room, the expedition leader's name you typed. In public rooms and quick match, everyone is shown by a generated expedition title instead.
• Signals: a fixed set of text-free messages. There is no chat, voice or file sharing. You can mute any player.
• Your IP address. Everyone in a room learns the IP address of every other player in it, as is normal for direct connections. That is your public internet address, which can show your rough location (such as your country or town) and your internet provider. They may also see your device's address on your local network (for example your home Wi-Fi), which on its own means nothing outside that network. Other players could keep what they receive.

Finding each other

• Public signalling relays (Nostr relays and WebTorrent trackers) pass short connection messages between devices. A private room's connection messages are encrypted with a key that comes from the room code, so only people with the code can read them. A public room's code is shown in its board listing, so anyone following the board can join it or read its connection messages, which include your IP address.
• The public board and quick match use short-lived Nostr messages, which relays pass on without storing. Each one is signed with a key the game makes when it starts, so a relay can tell that board and room messages from one launch of the game came from the same device. The messages are also wrapped with a key that anyone can work out from the board's public name: this keeps out casual scraping, but it is not secret. No direct connection is opened to another player, and so no IP address is exchanged with strangers, until you join a room. The relays see that your device follows the board and the messages it sends.
• If no Nostr relay can be reached within 5 seconds, the board falls back to WebTorrent trackers. Board participants then connect directly, so they can see each other's IP addresses. A room also adds the trackers after 8 seconds if nobody has joined it by then or no Nostr relay is open.
• If you open a room to the public board, its listing shows a room code, the number of places, a sponsor crest and a short code for the game's rules version. Quick match sends the same kind of short messages while it looks for players. The game withdraws listings when the match starts, but it cannot erase a copy someone else kept.
• Public STUN servers, run by Google, Cloudflare and Nextcloud, tell your device its public address.
• These operators see connection details such as your IP address and timing, and may keep logs under their own policies. We do not run or control them. The game uses up to six of these Nostr relays: relay.damus.io, nos.lol, relay.primal.net, nostr.mom, relay.snort.social and offchain.pub; it may also use nostr.data.haus and purplerelay.com. Its trackers are tracker.openwebtorrent.com, tracker.webtorrent.dev and open.ftorrent.com.

Connecting by QR code or text

The lobby's manual exchange shows a QR code or a block of text holding encrypted connection details, including your device's connection addresses. You pass it on yourself, by the share sheet or the clipboard; the game never uses the camera. It still contacts the STUN servers and our relay-password service.

Block and Report

Blocking a player is stored only on your device, and quick match avoids a blocked player's room for 24 hours. Report opens your own email app, addressed to us, with the room code and the name the player was shown by. Nothing is sent unless you send that email. If you do, we receive your email address, the room code, that player's shown name and what you write, and we use them only to look into the report.

Share private room codes only with people you mean to invite.

7. Connection relay

Some networks, especially mobile ones, stop two devices connecting directly. So that online play still works there, the game uses Cloudflare's relay (TURN) service, with Cloudflare acting as our service provider.

Each time you open or join an online room (a manual QR room included), the game first asks our small credential service, which runs on Cloudflare, for a temporary relay password, unless it already holds one from about the last hour and a half. That service therefore sees the IP address of every player who goes online. It uses the address only to answer and to limit how often one address can ask (20 requests a minute), stores nothing itself, and sends Cloudflare's relay only the password's lifetime. Cloudflare's network may keep its own short request logs.

While a room is open, your device may also reserve a relay address with Cloudflare's relay, so Cloudflare can see your IP address even in a room that nobody joins. Cloudflare's relay carries the match only when no direct path works. It then processes both devices' IP addresses and the connection's timing and volume, and it cannot read the match, which stays encrypted between the players. Cloudflare's privacy policy applies.

8. Google Play and what it shows us

Google Play handles your purchase, the free Game Trial and refunds under its own terms and privacy policy. The game has no in-app purchases, subscriptions, billing system or advertising. Google Play adds its own checks to the game it delivers (automatic protection). They run on your device, also work offline, and check that the game was installed from Google Play, has not been modified and runs on a certified device. When a check fails, or needs Google, it tells Google Play services the result, such as the installer's name, the game's package name and pass or fail verdicts, under Google's policies. We do not receive these results about you.

Like every developer, we see some information in Google Play Console:

• order records for purchases, such as the order number, date, product and price, and the buyer's country, state or region, postcode (in part or in full, depending on local tax rules), sometimes the city, and the device model. They never include the buyer's name, email address, billing address or payment details. We use them for our accounts, tax and refunds;
• crash and "app not responding" reports (Android vitals), with the device model and Android version, which we use to fix bugs;
• ratings and reviews, shown with the reviewer's public Google Play name, which we read and may reply to;
• during testing, testers' private feedback (section 9);
• overall figures such as installs and achievement statistics.

9. Closed-test testers

Before release, the game is tested by a small group of invited testers. If you are one of them, we handle:

• the email address of the Google account you test with, on the test's tester list in Play Console (an email list or a Google Group), and on Play's licence-testing list;
• your answers to the feedback form after each session (a Google Form or an email), including your phone model, and any feedback you send through Google Play;
• our own record of the test: your name, email, start day, any promo code we sent you, and your feedback. It is kept on our own computer, never published.

We use this only to run the test, to send you reminders and codes, to improve the game and to answer the questions Google asks when we apply to release the game. Google processes the tester list and Google Forms under its own policies. If you joined through our website's waitlist, that sign-up is covered by the website's notice. You can leave the test at any time, and ask us to delete your tester details sooner (section 16).

10. Permissions

That is all. The game does not request camera, microphone, contacts, location or storage access, it uses no advertising ID, and it blocks unencrypted web traffic.

11. Why we may use data (legal bases)

Where UK or EU data protection law (the UK GDPR or the EU GDPR) applies, we rely on:

• contract, to provide the online play you ask for: connecting your device to other players, and handing out relay passwords; and, if you sign in to Google Play Games, sending your achievements and cloud save to Google;
• legitimate interests, for keeping the relay-password service from being misused, answering support emails, looking into reports, running the closed test, and using Play Console's records to keep the game working and handle refunds;
• legal obligation, for keeping order records for tax.

You can object to any use based on legitimate interests (section 16).

12. Where data goes

The relays, trackers and STUN servers the game uses, Cloudflare and Google operate around the world, so connection details may be handled outside the UK and the EEA. Cloudflare and Google are our service providers for the relay and for Google Play services; where they move personal data abroad for us, they do so under their own data protection terms, such as the UK and EU standard contractual clauses or the EU–US Data Privacy Framework.

13. How long things are kept

On your device

• Online matches: the ten most recent keep their detail (a finished one only as its replay record, up to 64,000 characters); signed turn histories for the two most recent unfinished matches (up to 200,000 characters each); all online match data within 1,000,000 bytes. Older matches remain only in your lifetime statistics.
• Room signing keys: for the 8 most recent rooms.
• Replays of your own local matches: the 10 most recent.
• The rejoin offer: 3 hours.
• The block list: up to 200 players; a blocked player's room is avoided for 24 hours.
• The error log: the last 50 errors.
• Everything else on your device stays until you clear the app's storage or uninstall the game.

Elsewhere

• Saved Games, achievements and Android backups: kept by Google until you delete them with Google's controls (section 5 and section 2).
• Our relay-password service: it stores nothing itself; its rate limit counts requests per address over one minute. Cloudflare's own request logs follow Cloudflare's retention.
• Support emails and report emails: 12 months after the last message in the conversation, then deleted.
• Tester details: deleted 6 months after the closed test ends.
• Order records: as long as tax law requires.

14. Security

• Game traffic between players is encrypted (DTLS, as WebRTC requires), and so is the relay's copy of it.
• Connections to the signalling relays, to our relay-password service and to Google are encrypted (TLS). STUN requests, which only ask for your public address, are not encrypted.
• Each room's signing key is made on your device, and its private part cannot be exported from the device.
• A private room's connection messages are encrypted with a key from the room code before any relay sees them.
• Board messages are signed, so they cannot be altered on the way. Their wrapping is not a secret (section 6), so treat a public listing as public.

15. Children and teenagers

The game is for people aged 13 and over. It is not made for children under 13 and is not part of Google Play's Designed for Families programme. We have set the game's defaults, and written this policy, with the UK Information Commissioner's Children's Code in mind for players aged 13 to 17.

If you are under 18, in short: the game does not ask who you are, where you are or how old you are. It shows no ads, and the game itself does not track you or build a profile of you. Signing in to Google Play Games is optional, and only Google sees your Play Games profile. There is no chat. Online rooms are private unless you choose public, and your typed name is shown only in private rooms; strangers in public rooms see a made-up title. Other players in a room can see your IP address, which can show roughly where you are, so play online with people you know if that worries you. You can block and report players. If something online upsets you, tell an adult you trust, and email us.

16. Your rights

Where UK or EU data protection law applies, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to our use of it, and to receive it in a portable form. To use any of these rights, email support@thegreatcloudgame.life. We will answer within one month, and we may ask you to confirm it is you.

Most of your data is not held by us at all:

• Data on your device: delete it by clearing the game's storage in Android's settings, or by uninstalling the game.
• Play Games data and Android backups: view or delete them from your Play Games profile, your Google Account or your device's backup settings.
• Emails, reports and tester details we hold: ask us, and we will delete them.

If you are unhappy with how we handle your data, please tell us first, and we will look into it and reply. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, to your local data protection authority.

17. Changes and contact

We update this policy, its version number and its date before releasing any version of the game that changes what it describes. Version 2.2, last updated 3 October 2026, effective 3 October 2026.

Contact: Kai Karhunen (The Great Cloud), support@thegreatcloudgame.life.