Privacy Policy
This policy explains what the game Iron Front Mobile ("the game") and this website collect, why, how long it is kept and how you can delete it. The game is made by the developer of Iron Front Mobile ("we", "us"): Arman N., Ust-Kamenogorsk, Kazakhstan. Privacy questions and data requests: [email protected].
The short version
- Offline play collects nothing. The campaign, skirmish against the computer, training, the arsenal and offline events send nothing to us. You never need an account for them.
- Online play sends what a multiplayer game needs: a random player and device ID, the call sign you choose, your match orders and results, and your IP address (every internet connection has one).
- No ads, no tracking, no selling. The game contains no advertising, analytics or attribution software, does not use Apple's advertising identifier and does not track you across other apps or websites. We do not sell or rent your data or share it for advertising.
- You can delete your online account in the game at any time: Profile → Account → Delete account.
What stays on your device
Settings, campaign and skirmish progress, your profile, achievements, event progress, key bindings and saved replays are stored on your device. On iPhone and iPad, campaign progress and settings sync through your own iCloud account; Apple stores that copy and we cannot see it. Settings → Data → Reset progress erases it, including the iCloud copy. Your online sign-in keys (session tokens and the guest secret) are kept in the iOS Keychain on this device.
What we receive when you play online, and why
Your account and how you sign in
Online play needs an account so we can seat you in matches, bring you back after a dropped connection and keep your rating. You choose how to sign in:
- Guest. The game makes a random device ID and secret (not an advertising or hardware ID). Our server keeps the ID and only a one-way hash of the secret. No e-mail or name is needed.
- Sign in with Apple. We receive Apple's anonymous user identifier for our app. We keep Apple's refresh token, encrypted, only so we can revoke it at Apple when you delete your account. We do not ask Apple for your name, and we do not store an e-mail address from Apple.
- E-mail one-time code. If you choose it, we store your e-mail address to send you a 6-digit code and to recognise you later. The code is valid for 10 minutes and we keep only a hash of it. An e-mail delivery service sends the code for us. We do not send marketing e-mail.
- Google or Facebook (only if the game offers them). We keep only the provider's account identifier for our app — no e-mail, name, friends or provider token.
- Game Center (if you are signed in to it on the device). Your Game Center player ID for our game, verified with Apple's signature.
Every account also gets a random player ID made by our server. You can link several sign-in methods to one account and unlink them in Profile → Account.
Your call sign
The name you type in your profile, filtered for offensive and reserved words. Other online players see it in lobbies, on match screens, in their match history, on leaderboards and in replay lists. If you never type one, others see a generated name such as "General 4821".
Match data
The orders you give, the map, mode, teams, result and duration; for ranked play your rating, league, wins, losses, draws, leaves and season results. We use them to relay orders between players, decide results (our server replays ranked matches to judge them), calculate ratings and run seasons and leaderboards. Leaderboards and season results are visible to all online players.
Replays
A file with the match setup and every order, without names or player IDs inside. Players who were in the match can download and watch it.
Connection data and your IP address
Your IP address, network round-trip time, disconnections, the game version and, if two players' games fall out of sync, a flag on the match. We use them to deliver data to you, limit abuse and fix network problems. We do not use your IP address to find your location.
Reports, blocks and moderation
If you report a player, we keep your player ID, theirs, their call sign at that moment, the reason you picked, where you saw it and when — no free text. The reported player is not told who reported them. If you block a player, we keep that list so we can hide their call sign from you. If an account is kicked, banned or its call sign is reset, we record when, for how long and why, to enforce the Terms of Use and handle appeals.
Crash reports
The game includes a crash-reporting component (Sentry). It sends nothing unless we have switched it on for the version you play. When it is on, after a crash or a long freeze the game sends a report to Sentry, which processes it for us: the error and where it happened, device model, operating system, game version, memory, graphics and temperature settings, and the game's language, plus a random installation ID used only to count crash-free sessions. Reports carry no name, e-mail, account ID or IP address: the game removes identifiers from error texts and the service is set not to store IP addresses. We use them only to find and fix crashes.
How long we keep it
| Data | Kept |
|---|---|
| Account, sign-in methods, e-mail address (if used), call sign, ratings, season results, block list | Until you delete the account (an e-mail address also goes when you unlink it) |
| E-mail sign-in codes | 10 minutes |
| Sign-in refresh tokens | 90 days, replaced on each use |
| Replays | 14 days (casual), 90 days (ranked) |
| Match records (result, player IDs, connection statistics) | 12 months |
| Server logs (may include IP addresses) | 30 days |
| Reports you send or that are about you | 12 months |
| Moderation records | 24 months after the action |
| Backups of the account database | Up to 30 days |
| Crash reports (only when crash reporting is on) | Up to 90 days |
Who else handles it
- Our server hosting provider, which stores the online data for us.
- An e-mail delivery service, which sends sign-in codes for us (only if you use e-mail sign-in).
- Sentry (Functional Software, Inc., USA), crash reports for us, only when crash reporting is on: sentry.io/privacy.
- Cloudflare, which serves this website and forwards e-mail sent to our addresses.
- Apple (App Store, iCloud, Sign in with Apple, Game Center) and, if you use them, Google and Facebook handle your accounts with them under their own privacy policies. Apple handles your purchase; we never see your payment details.
- Other players see your call sign, rating, league, leaderboard position and season results.
- Authorities, only if the law requires it.
Our server and these providers may be in a country other than yours. Where the law requires it, we use the safeguards it sets for such transfers.
Deleting your data and your rights
- In the game: Profile → Account → Delete account (also under Settings → Online → Account). This at once deletes your account, sign-in methods, e-mail address, call sign, ratings, season results and block list, removes your link to past matches, and replaces your player ID with "deleted" in match records, server logs, moderation records and reports. If you used Sign in with Apple, we also revoke the game's access at Apple. Copies in backups disappear within 30 days. Replays contain no names. Your offline progress stays on your device until you reset it or delete the game.
- By e-mail: write to [email protected] to get a copy of your online data, correct it, delete it or object to its use. Include your player ID (Profile → Account); if you no longer have the game, give the room code or the date and time of a match. We answer within 30 days.
- Depending on where you live (for example the EU/UK GDPR, California's CCPA/CPRA, Kazakhstan's Law "On Personal Data and Their Protection" or Russia's Federal Law 152-FZ) you may have further rights, including the right to complain to your data-protection authority.
Legal bases
Where the law asks for one: providing the online service you asked for (account, matches, ratings, replays); our legitimate interest in keeping the game fair, secure and working (moderation, logs, crash reports); and legal obligations where they apply.
Children
Iron Front Mobile is a war game for older teenagers and adults and is not directed at children. We do not knowingly collect personal data from children under 13, or under the age of digital consent where they live (16 in parts of the EU). The offline game collects nothing from anyone. If you believe a child has played online, write to [email protected] and we will delete the account.
Security
Sign-in only travels over encrypted HTTPS connections. Secrets and codes are stored as hashes, provider tokens are encrypted, and sign-in keys on your iPhone live in the Keychain. The server's admin interface is not reachable from the internet.
This website
ironfrontmobile.com sets no cookies and runs no analytics, trackers or third-party scripts or fonts. Cloudflare, which serves it, processes your IP address and request details to deliver the pages and protect them from attacks.
Changes
If this policy changes, we will update the date at the top of this page and, for important changes, say so in the game's update notes.
Contact
The developer of Iron Front Mobile: Arman N., Ust-Kamenogorsk, Kazakhstan
Privacy and data requests: [email protected]
Everything else: [email protected]