Privacy policy

Information we handle

This policy covers Portal Squad for Android and iOS, its optional online game and purchase services, and the Portal Squad support website. Available features depend on your platform and installed build. Restricted Google no-charge purchase tests use a separate test service. The Android parent approval and purchase service and the iOS on-device purchase flow are described separately below.

Local play: the game stores progress, earned rewards and settings on your device. In the family-enabled Android and iOS builds, the age entered during setup selects a child, teen or adult age band. The exact age and date of birth are not saved or sent to our game servers; the age band is stored locally.

Optional online game accounts: if online features are available to you and you choose to use them, we handle an account identifier, username, password hash, recovery-code hash, sign-in sessions, cloud progress, game results and the Squad content you submit. Usernames and rankings are visible to other players; Squad membership and shared messages are visible to the relevant players. Do not use your real name or include contact details or other private information in a public username or message.

Android purchases: Google Play handles checkout and payment-card details; we do not receive your card number. We handle protected installation credentials, opaque purchase-owner identifiers, product and store purchase references, verification results, delivery confirmations, and completion and refund records to verify purchases and prevent duplicate grants. Adult checkout does not require a parental-controls email or PIN. For child and teen profiles, the parent flow handles a parent email address, verification proof, a protected PIN hash, linked installation credentials, and product-specific approvals. Parent email addresses are encrypted in the service database; PINs and verification codes are not stored as plain text. No child email address, exact age or date of birth is required by this purchase service.

iOS purchases: Apple handles checkout and payment-card details; we do not receive your card number. The current iOS release verifies signed Apple transactions on your device and saves product identifiers, transaction identifiers and delivery records with your local coins and lives to prevent duplicate grants and recover interrupted delivery. This iOS flow does not use the Android parental-controls email and PIN service or a server purchase wallet. A temporary parent shop gate opens the purchase screen for a child or teen profile; Apple Account and device purchase restrictions, including any Apple purchase-approval settings, still apply.

Support and service operation: when you email us, we receive your email address and the information you send. A device connecting to an online service exposes its network address to that service. The game service uses technical records and protected rate-limit identifiers for operation and abuse prevention. Please do not send passwords, recovery codes, payment-card details or children’s personal details to support.

Notifications: local reminders use settings on your device. Builds testing optional remote Squad notifications can use a notification token, installation identifier and notification preferences after opt-in for an eligible online account. Remote notifications are not enabled on the current public game service and are excluded from child mode in the family-enabled Android build.

Optional usage and diagnostics: eligible players can choose Share usage & diagnostics in Settings. Updated clients then send a randomly generated installation identifier, foreground session and level events, platform, app version and limited diagnostic codes. We do not send account identifiers, advertising identifiers, device fingerprints, error messages or stack traces in these reports. Children and unknown-age profiles do not send these optional reports. Reports cover only opted-in, updated clients when their network connection permits delivery.

In-game feedback: when an eligible player chooses Send feedback, we receive the selected category, the message they enter, a random reference identifier, the installation identifier, platform and app version. This does not turn on usage sharing. Email correspondence remains in the support mailbox. Do not include private credentials, card details or children’s personal information in feedback.

How we use information

We use local data to run the game and remember progress. We use optional online account data to sign you in, synchronize progress, verify results, operate rankings and provide the Squad features you choose.

We use purchase records to verify store purchases, deliver the selected items once, handle interrupted checkout, and reconcile completion or refund events. Parent contact and PIN information is used to verify inbox access, establish or recover parental controls, and approve purchases on linked installations. We use support and security records to answer requests, diagnose problems and protect the service.

Portal Squad does not serve advertising or sell player data. We do not use children’s gameplay for targeted advertising. The support, privacy and deletion-request webpages do not use analytics, advertising trackers or cookies.

Where applicable, we process information to provide the optional service you request, for necessary security and fraud prevention, to meet legal obligations, or with consent for an optional feature. You can choose local play without an online game account.

We use optional operational reports to understand session activity, level difficulty and return rates and to investigate diagnostic codes. The private admin is restricted to our existing owner account and records moderation and support-status actions. Test activity and Google no-charge test purchases are identified separately; they are not production revenue.

Service providers and sharing

Fly.io hosts our application service, and Supabase provides its database. Our support email is hosted by Google. Resend delivers parental-controls verification emails and receives the parent email address and verification message for delivery. These providers handle information needed to deliver those services. Google Play receives store-related information during its purchase flow. Google Firebase Cloud Messaging handles notification tokens and delivery for builds testing opted-in remote notifications. Apple receives store-related information during the iOS purchase flow.

The application and primary database are configured in Frankfurt, Germany. Privacy and support requests use the contact below. Provider infrastructure, backups and support operations can involve other countries; the Frankfurt setting does not mean all processing stays in Germany.

Other players can see usernames, ranking information and the Squad content made available through the features you choose. We may disclose limited information when legally required, to protect security or rights, or in a business transfer subject to applicable privacy requirements.

How long we keep information

Local game data remains on your device until you remove it using the game or device controls. Removing local data or uninstalling the game does not delete an online account or records held by Apple or Google Play.

The online service keeps account information, cloud saves, rankings and Squad records until you delete the account or they are removed through a verified support request or service administration. It does not currently apply automatic account deletion for inactivity or a fixed age limit to all message history. You can delete your account at any time.

Our support mailbox retains correspondence until it is manually removed. You can request removal of your support messages. Information needed for an unresolved request, dispute, security investigation or legal obligation may be retained for that purpose. We do not currently operate an automatic 90-day mailbox deletion rule.

Fly.io retains ordinary application output logs for seven days. This is the hosting provider’s log period; it does not determine the retention of database records, support emails, incident extracts or backups.

Parent contact, PIN hashes and linked parental-controls credentials remain until a verified deletion request is completed. Email verification challenges expire after 10 minutes, and checkout sessions and parent approvals expire after 30 minutes. Expired challenges, sessions, approvals and rate-limit buckets are removed by supervised service maintenance; expiration immediately prevents further use even if cleanup is temporarily unavailable. Minimal purchase, delivery, completion and refund records are kept separately for duplicate prevention, recovery, refund reconciliation, disputes and applicable legal obligations. Removing parental controls does not erase settled purchase records or remove items already delivered on a device. Restricted test purchase ledgers remain until the separate test service is retired or manually removed.

Database backups, volume snapshots and retained operational exports may contain copies of data removed from the active service. A deletion request does not immediately erase every backup copy. Provider backup rotation and separate export handling apply; we do not promise a uniform 30-day backup-erasure period. Account and parent deletion requests are recorded using opaque identifiers in a journal held outside the application and database backups. A restored service must remain closed until deletion intents have been replayed from a current independent journal and purchase records reconciled. A journal detects corruption but does not by itself establish that a restored copy is current. Contact support about retained copies affecting your request.

Optional usage sessions and their events are removed from the active reporting database after 90 days without an event. In-game feedback tickets are removed after 180 days without an update. A server maintenance job enforces these periods. Turning off usage sharing stops new collection and requests removal of that installation’s usage history; if offline, the request retries when eligible networking resumes. In-game feedback and restricted management audit records are separate. Backup copies follow the backup limitations described above.

Your choices and deletion

You can permanently delete an optional online game account from the signed-in account controls in the game, or at https://match-squad-live.fly.dev/delete-account without reinstalling the game. Enter the current account password and explicitly confirm deletion. The service removes the account and its associated data and revokes sign-in sessions. If you need help, contact wolfinslimited@gmail.com for access, correction or deletion requests. Sending an email starts a manual support request; it does not automatically erase data.

The password-based deletion flow verifies the signed-in account. For a support request, include your Portal Squad username and describe the request, but never email your password, recovery code or card details. We verify account ownership before changing or deleting data. We explain any information that must be retained and handle requests within the applicable legal timeframe.

Account deletion concerns the online account, cloud saves, ranking entries and the requesting player’s Squad content and membership. Records belonging to other players are not deleted simply because they were in the same Squad. Local device progress and on-device Apple transaction-delivery records must be removed separately using device controls. Deleting an account does not automatically request an Apple App Store or Google Play refund. Minimal opaque deletion receipts and independent deletion intents remain to make retries safe and to prevent deleted data being revived during recovery.

Depending on your location, your rights may include a copy of your information, portability, restriction, objection, withdrawal of consent and a complaint to the relevant supervisory authority. You can turn off notifications through the app or device settings. A store or other independent provider handles rights requests for the information it controls under its own privacy policy.

Updated clients provide Share usage & diagnostics in Settings. It is off by default. Turning it off withdraws consent and requests deletion of that installation’s optional usage history. You can continue local play and send feedback without opting into usage reports.

To delete parental controls, email wolfinslimited@gmail.com from the parent email used for those controls, or follow the parental-controls section at https://match-squad-live.fly.dev/delete-account#parental-controls. You do not need a game username for this request. Never send your PIN, email verification codes or payment-card details. Support verifies inbox ownership and resolves pending purchase or delivery issues before removing parent contact and PIN data and revoking related credentials. Fresh verification is required to set up controls again. This is separate from local device progress, an online game account and a store refund.

Children and families

Portal Squad includes local play for different age groups. The iOS App Store age rating is 13+. Children can play locally without creating an online game account where the game is otherwise available to them. In the family-enabled Android and iOS builds, players under 13 cannot use online accounts, cloud saves, rankings, Squad features, optional usage reports or remote notifications. Optional online features are available only to eligible players aged 13 and over; platform and regional requirements still apply.

Opening a parent shop gate does not change a child’s age band or enable online game accounts, usage reports or Squad features. The Android child and teen purchase flow requires the parent email/PIN approval process in supported builds. The iOS release uses a temporary local parent shop gate and Apple checkout; it does not send a parent email address or PIN to our purchase service. A local gate provides purchase friction, and email verification proves access to an inbox; neither is verified proof of adulthood or parental consent for unrelated collection of child information. Parent approvals are for the selected purchase and do not authorize other data uses.

We do not ask children to provide personal information to use local play. If you believe a child has supplied personal information through an online account or support request, contact wolfinslimited@gmail.com so we can investigate and address it. Any future feature requiring additional notice or parental consent must provide that process before collection.

Contact us

The iOS publisher and controller is Hexadefend LTD. The Google Play developer name is Wolfins limited AI Lab; the Android publisher and controller is Wolfins limited Artificial Intelligence Developing Services CO. L.L.C S.O.C., Al Mateena, Dubai, United Arab Emirates. The platform-specific purchase flows are described above. Use the established privacy contact below for either platform.

Privacy and support contact: wolfinslimited@gmail.com. Support: https://match-squad-live.fly.dev/support. This policy takes effect on 3 November 2026. We will date later revisions and provide notice of material changes as required.