Last updated: 17 October 2026.
Who we are
Elder Kingdom (the game, its mobile apps and this website) is operated by Lili's Ark Limited, a private limited company registered in England and Wales (company number 15424953), registered office 106 Hemper Lane, Sheffield, S8 7FE, United Kingdom. Lili's Ark Limited is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact us at support@elderkingdom.com.
What we collect and why
- Account and sign-in data. An internal account identifier and, if you sign in with Apple or Google, the provider's user identifier for your account. We do not store your email address from these providers. If you play as a guest, the app creates a random device identifier; we store a hash of it, not the raw value. We use this data to create and secure your account (contract).
- Session tokens. Hashed tokens that keep you signed in. App sessions last 30 days; website sessions last 8 hours.
- Game data. Your kingdom and city names, avatar, progress, inventory, battle and activity records. We use this to run the game (contract).
- Chat, letters and reports. Messages you send in public, alliance and private chat and letters, plus abuse reports and block lists. Other players can see public and alliance chat and your kingdom name. We use this to provide communication and keep players safe (contract and legitimate interests).
- Purchase records. Store order or transaction identifiers, product, coins credited, timestamps and refund status for purchases through the Apple App Store, Google Play or our website. We use these to verify purchases, credit coins, handle refunds and prevent fraud (contract, legal obligation and legitimate interests).
- Push notification tokens. If you enable notifications, we store your device's push token (issued by Apple or by Google Firebase Cloud Messaging) so we can send you game notifications. You can turn notifications off in the game or in your device settings.
- IP addresses and technical data. Your IP address is processed whenever you connect to our servers. We use it for rate limiting, security and anti-abuse, for example to detect one person trading with themselves. Where we keep an IP-derived value (for market anti-abuse) it is stored as a keyed hash that cannot be turned back into your address, and it is cleared when the listing closes. Our servers also write operational logs of requests and errors, which can include IP addresses; these are rotated automatically and kept for a short period (typically days). Logs are used for security and reliability (legitimate interests).
We do not use advertising, tracking or analytics SDKs, we do not build advertising profiles, and we do not sell personal data.
Website payments
Coin purchases on this website are processed by Stripe Payments Europe, Ltd. and its group companies. Stripe collects your card or wallet details directly; we never see or store them. We receive the result of the payment, an order reference and the amount, and we keep them as a purchase record. Stripe acts as an independent controller for its own purposes, such as fraud prevention and legal compliance; see stripe.com/privacy. Purchases in the apps are processed by Apple or Google under their own privacy policies; we receive the transaction details, not your payment details.
Cookies on this website
We use only strictly necessary cookies, which do not need consent under the Privacy and Electronic Communications Regulations:
__Host-ek_web: keeps you signed in on the website after you sign in. It is HttpOnly, Secure and expires after 8 hours or when you sign out.__Host-ek_oauth: protects the Apple or Google sign-in flow against forgery. It expires after 10 minutes.
We set no analytics, advertising or tracking cookies. Our pages do not use local storage for tracking.
Who receives your data
We share data only with service providers acting on our instructions, and with other bodies where the law requires:
- our hosting and infrastructure provider (DigitalOcean), which runs our servers and database;
- Apple and Google, for sign-in, store purchases and push notifications;
- Stripe, for website payments (see above);
- email forwarding and mailbox providers that deliver messages sent to our support address;
- law enforcement, regulators or professional advisers where we are legally required or need to protect our rights.
International transfers
Some of these providers process data outside the United Kingdom, including in the United States. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or on the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed. Contact us for details of the safeguards for a particular provider.
How long we keep data
- App session tokens: up to 30 days after issue; website sessions: 8 hours. Expired sessions are deleted automatically.
- Chat messages: deleted automatically after 30 days.
- Account, game and sign-in data: until you delete your account, or until we remove an account that is abandoned or breaches the terms.
- Purchase and audit records: kept for as long as needed for accounting, tax, refund handling and fraud prevention, normally up to six years.
- Backups: nightly database backups are kept for 14 days and then overwritten. Deleted data can persist in a backup until it expires, and we do not restore backups into the live game except to recover from a disaster.
- Support emails: kept while we help you and for a reasonable period afterwards to resolve disputes.
Deleting your account
You can delete your account in the app or by email; see account deletion. Deletion takes effect immediately. It removes your sign-in access, linked identities, devices, sessions and push tokens, removes your kingdom and city names, and erases your chat, letters and other social content. Anonymous game-world state (such as map tiles, cities, inventory and generals) remains, with no link to you. Purchase and audit records remain as described above.
Children
Elder Kingdom is not directed at children under 13 and we do not knowingly collect personal data from them. If you are under 13 you must not use the game. If you are under 18 you should have a parent or guardian's permission before making purchases. If you believe a child under 13 has an account, email us and we will delete it. The game contains stylised fantasy combat and player-to-player chat.
Security
Connections to our API and website use TLS encryption. Authentication tokens are stored hashed. Access to our servers is restricted. No system is perfectly secure, and we will tell you and the ICO about a breach where the law requires.
Your rights
Under UK data protection law you have the right to be informed, to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing based on legitimate interests, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. To use these rights email support@elderkingdom.com; we may ask you to confirm your identity and will normally reply within one month.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
Changes
We will post any change to this policy on this page and update the date above. For significant changes we will also tell you in the game.