Privacy Policy

Last updated: 6 October 2026

This policy explains how Sameen Ul Arifeen, trading as Ashfire Gaming Labs in India ("we", "us"), processes information for Fickle Allies on Steam (Windows), Android, iOS, and related game services. Features differ between platforms and builds; a platform-specific section applies when you use that feature.

Privacy contact: admin@ashfiregaminglabs.com. You can use this address for privacy questions, access requests, corrections, and account or data deletion.

1. Information we process

Game accounts: username, internal account identifier, account creation and login times, account status, and preferences or acknowledgements associated with the account. For password accounts, we process your password to authenticate you and store a salted password hash, not a readable password. Standard game registration uses a username and password, rather than requiring an email address.
Steam identity: SteamID, display-name information supplied during sign-in, verified ownership and authentication results, and relevant restriction or ban results from Steam. A Steam identity is linked to an internal game account. Steam authentication tickets are processed for sign-in; the game does not request your Steam password.
Gameplay: match identifiers, maps, match timing, player actions and positions needed for multiplayer, groups and invitations, results, wins and losses, crystals, XP, statistics, leaderboard entries, achievements, and other progression. Practice matches run on your device: Practice results and the guest Practice allowance are kept on the device and are not stored on our server. Private-room codes and participant information are processed to operate private matches.
Purchases and access: store provider, product and transaction identifiers, purchase verification information or tokens, purchase status, entitlement records, virtual balances and transaction history, refund or revocation events, and records that prevent duplicate grants. Apple, Google, or Steam handles store checkout; we do not receive your complete payment-card number or card security code from that checkout. This includes the items, matches and appearance packs you buy, the look you choose for your character, and when a purchase was first used in a match.
Guest and trial access: guest/session identifiers, installation references where used, trial starts and consumption, introductory benefits, registration attempts, and device-integrity or device-recall results on supported mobile platforms.
Connection and security information: IP address while connecting, request timestamps, authentication failures, security-event identifiers, and information needed to detect abuse, rate-limit requests, and maintain service reliability. Application security logs use pseudonymous references for source addresses and identities; hosting infrastructure can separately process connection information. A hashed or pseudonymous identifier is not necessarily anonymous.
Local settings and diagnostics: language, graphics, audio, controls, accessibility/scare preferences, cached assets, and locally stored progress or synchronization state. Performance tools can measure frame timing or memory on your device. If you send us a diagnostic report, screenshot, or log, we receive the information it contains.
Support: your email address, message, platform/account details, attachments, and correspondence when you contact us. Please avoid sending passwords, authentication tickets, full payment-card information, or unrelated personal information.

2. How we use information

We use information to provide and secure the game; authenticate players; host and synchronize matches; display statistics and leaderboards; save and restore progression; verify purchases and access; administer trials and introductory benefits; prevent fraud, cheating, duplicate claims, and abuse; diagnose problems; respond to support and privacy requests; and comply with applicable legal obligations.

Some information is necessary for the selected feature. For example, online matches require a network connection and player/session information, and store purchases require verification. You can decline to send optional support attachments. Clearing local storage may remove settings and Practice progress, but does not by itself delete server records or restore consumed Public trials.

3. What other players can see

Other players may see your game/display name, presence in a match or group, gameplay actions, and results or statistics presented by the game. Leaderboards expose the names and scores or rankings they display. Private rooms are access-controlled game rooms, not a promise that participants cannot record or share what they see. Do not put sensitive personal information in a public username.

4. Platforms and service providers

Render: hosts our game servers in Singapore, the United States and Germany, and our account service and its database in Singapore, and processes server data and connection information to provide hosting. The server that handles your connection may be outside your country.
Valve / Steam: provides Steam distribution, account authentication, ownership verification, and applicable platform features such as achievements. Valve also processes information under its own privacy policy.
Google: provides Google Play distribution and billing verification on Android, and Sign in with Google, which confirms your Google account before an Android account is deleted. Where enabled, Play Integrity and Device Recall help validate the app/device and enforce device-level trial or registration state. On Android, Google Play Games Services shows the game's achievements: if you are signed in to Play Games, the app reports the achievements your game account has earned to Play Games. Your Play Games player ID stays on your device and is not sent to our servers. If you choose Save progress with Google, Google confirms your Google account to our server and we keep a keyed, non-reversible link between that account and your game account, so you can restore your progress on any phone; it is deleted with the account. We do not receive your Google password.
Apple: provides App Store distribution and purchase verification on iOS. Where enabled, DeviceCheck and App Attest process device/app proofs and limited persistent state to protect trials and registration. On iOS, Game Center shows the game's achievements: if you are signed in to Game Center, the app reports the achievements your game account has earned to Game Center. Your Game Center identity stays on your device and is not sent to our servers. If you choose Save progress with Apple, Apple confirms your Apple ID to our server and we keep a keyed, non-reversible link between that Apple ID and your game account, so you can restore your progress on any iPhone; it is deleted with the account. We do not receive your Apple ID password. Optional, iOS only: if you turn on sharing how you use your purchases with Apple and later ask Apple for a refund, we tell Apple whether that purchase was delivered, how much of it was used in matches, and that the game offers free content to try first, and, if it was used, that we ask Apple to decline the refund. Apple makes the refund decision. You can turn this off at any time in Settings.
Cloudflare: where a registration security challenge is enabled, Turnstile processes verification tokens and connection information, including the IP address sent for verification.
Zoho: provides our support email service and processes correspondence sent to our admin address.
Website infrastructure: the provider serving this privacy page processes network requests needed to deliver it. The policy page itself contains no advertising, analytics scripts, or tracking pixels.
Google Analytics (website): our download page ashfiregaminglabs.com/play uses Google Analytics to count visits, the ad campaign that led to a visit, country, device type and which store button was clicked. In the EEA, the UK and Switzerland it runs without analytics cookies. It is not used for ad personalisation.

We share information with providers as needed for these functions, with other players as described above, and where required by law or reasonably necessary to protect safety, investigate abuse, or defend legal rights. If the business or game is transferred, relevant information may be transferred with it, subject to applicable protections and notices. We do not sell personal information or use it for cross-context behavioral advertising.

Provider policies: Render, Steam, Google, Apple, Cloudflare, and Zoho. Our policy covers our processing; those services also have their own responsibilities and controls.

5. Mobile device integrity and trial state

Mobile integrity services can process app/device proof, verification outcomes, limited benefit-state flags, and attestation key references. While a guest identity or account exists we keep the related verification, registration, consumption, and audit records to prevent repeated benefits or unauthorized access. When an account is deleted, only the keyed device registration marker described in section 7 remains on our server. Provider-backed state (Apple DeviceCheck and App Attest state, Google Play Integrity and device recall) may remain after uninstalling the app, clearing its storage, or deleting a game account. These mechanisms do not give us a permanent hardware identifier and are not used for advertising. The game does not use advertising identifiers, IMEI numbers, or hardware serial numbers as the authority for these benefits.

6. Storage on your device

The game uses necessary cookies or equivalent session storage, local application storage, and asset caches for sign-in, settings, performance, and progress synchronization. The exact mechanism differs between browser, desktop, and mobile versions. These are functional mechanisms rather than advertising cookies. Your platform may separately collect store, operating-system, or diagnostic information under its own settings and policy.

7. Retention and deletion limits

Account information is retained while the account exists to provide its features. Deleting an iPhone or Android account permanently removes from our server the username and password hash, sessions, statistics, XP and rankings, match history, server-side achievements, Points balance and the full transaction ledger, match-entry and bonus records, scare preferences and entitlements, the linked pre-registration guest and device-trial records (including encrypted device proofs and trial usage), the device-registration record with its sealed retry proof, and sign-in attempt records for that username. Deleting a Steam profile permanently removes the SteamID link, display name, sessions, statistics, XP and rankings, match history, server-side achievements, Points and ledger, game-side entitlements, preferences, and the cached licence record; the Steam account, licence, and achievements held by Valve are not affected. Your chosen look (sticker and colours) and your choice about sharing purchase use with Apple are removed too.

Two record classes remain after an iPhone or Android deletion. First, the store purchase record needed to restore or refund a Full Game purchase: store provider, platform, store transaction and product identifiers, verified or refunded state with dates, a fingerprint of the store token, and the environment. It is unlinked from any account, username, password, gameplay, or balance. Second, a keyed, non-reversible device registration marker (platform, keyed hash, registration slot, registration and deletion times) that stops deletion from resetting the five-accounts-per-device limit; it contains no username, password, gameplay history, device token, or attestation proof and cannot be turned back into a device identifier without the server secret. Server security logs keep pseudonymous references only. These records are pseudonymous rather than anonymous and are used only for the purposes stated here. The same kind of unlinked store record is kept for bought items, matches and appearance packs such as Halloween Pack 1, so these purchases can also be restored or refunded. Each kept store record also notes when the purchase was first used in a match, so a later refund request can be answered.

There is no single automatic deletion period for all retained records. Retention depends on the continuing purpose, applicable obligations, unresolved disputes, and the operation of provider services. You may request a review and deletion of information no longer required. We will explain any information we need to retain and the applicable reason when handling your request.

Authentication sessions expire, and short-term rate-limit records are aged out during normal operation. Expiry of a token is not a guarantee that every related audit record or backup has been erased. Infrastructure logs and any backups follow the configured hosting lifecycle and may not change immediately when the active database changes. Information retained in backups remains subject to this policy.

8. Request account or data deletion

You can request deletion without reinstalling the game. Email admin@ashfiregaminglabs.com with the subject Fickle Allies account deletion. Include your game username, platform (Steam, Android, or iOS), and whether you want the entire game account or particular data deleted. For Steam, include your SteamID or profile link so we can identify the game account. Do not send your password. Step-by-step instructions are on the account deletion page.

We will verify control of the account before acting and request only information reasonably necessary for verification. We will explain the steps, expected handling time, and any permitted retention exceptions. We handle requests without undue delay and within the period required by applicable law. If a request needs additional time or cannot be completed in full, we will explain why.

In the game, the route is Settings → Delete Account. iPhone and Android accounts enter the current password and type DELETE; on iPhone, Apple is also asked to confirm the Apple ID, and on Android, the player confirms their Google account with Sign in with Google. Steam players type DELETE and the game obtains a fresh Steam ownership proof, so only the Steam account signed in right now can delete its profile. Deletion takes effect immediately.

Deleting a Fickle Allies account does not delete your Apple, Google, or Steam account, remove platform-owned records, automatically refund a purchase, or reset device-level trial/registration limits. Contact the relevant store for store-account or refund requests. Deletion can remove game progress and affect access associated with the deleted game account; ask us about a purchase before deleting if you are unsure. Uninstalling alone is not an account-deletion request.

9. Your privacy rights

Depending on your location and applicable law, you may have rights to access or obtain a copy of your personal information, correct it, request deletion or portability, restrict or object to processing, or withdraw consent where processing relies on consent. Withdrawal does not undo lawful prior processing. You can contact our privacy address to exercise applicable rights, raise a grievance, or ask about an authorized representative. We may need to verify a request and may be required to retain some information. You may also complain to the competent privacy authority.

Where a legal basis is required, providing requested game/account services and purchase access relies on performance of our agreement with you; security, fraud prevention, and service maintenance rely on legitimate interests where permitted; mandatory records rely on legal obligations; and consent applies where a specific optional activity requires it. We do not treat merely playing the game as blanket consent to unrelated processing.

10. International processing

We operate from India and use international hosting and platform providers. Information may be processed outside your country, where privacy laws differ. Applicable transfer requirements and safeguards depend on your location and the provider involved. Contact us for information about the processing relevant to your account.

11. Children and sensitive information

Fickle Allies contains thriller, combat, and jump-scare elements and is not designed specifically for children. Follow the age rating and account requirements applicable to your platform and country. We do not ask players to provide health information, contacts, precise location, or government identification as part of ordinary gameplay. If you believe a child supplied information in circumstances requiring parental consent or other protection, contact us so we can investigate and take appropriate action.

12. Security

We use safeguards such as password hashing, session controls, secure connections in production, access checks, and purchase/integrity verification. No system can guarantee absolute security. Keep your account credentials private and contact us if you suspect unauthorized access. Please do not send credentials or sensitive payment details in a support message.

13. Changes and contact

We may update this policy when the game, providers, or requirements change. The date above identifies this version. Where required, we will provide additional notice or obtain consent for a material change.

Sameen Ul Arifeen, trading as Ashfire Gaming Labs · India
Privacy and support: admin@ashfiregaminglabs.com