Privacy Policy
Last updated: 2026-10-13
1. Who we are
Galaxy in Crisis (the “game” or the “app”) is a turn-based sci-fi strategy game for Android, developed and published by Grinnox, an independent developer (a private individual) (“we”, “us”). Grinnox is the data controller for the personal data described in this policy.
Contact: grinnoxgames@proton.me
This policy covers the Android app (package name com.grinnox.galaxyincrisis) and the online game server that the app connects to for online play.
2. Summary
- You can play offline without sending any data to us. Offline saves and settings stay on your device.
- The game has no user accounts, no ads, no analytics, no crash reporting, no tracking SDKs and no in-app purchases.
- If you choose online play, the app sends to our game server the commander name (nickname) you type, a random session token, and your gameplay (room settings, fleet choices and moves).
- Your nickname and your gameplay are visible to the other players in your room and match.
- Everything travels encrypted (TLS,
wss://). Our server is hosted by Cloudflare, which also processes your IP address to deliver the connection. - Most online data is deleted automatically within minutes after a room or match ends. Server logs are deleted after a few days.
- We do not sell your data and do not share it with anyone for advertising or any other purpose.
3. Data stored only on your device
The app keeps the following in its private storage on your device (Android SharedPreferences):
- your saved match (to continue an offline game);
- your settings (board opacity, sound, music volume and shuffle, AI speed and difficulty) and your tutorial progress;
- for online play: the server address, your commander name and your session token (see section 4).
None of this is sent to us, except the commander name and the session token when you connect for online play. It is deleted when you clear the app’s data or uninstall the app. If Android backup is turned on, Android may include this data in your device backup to your Google Account. That backup is handled by Google under its own terms; we have no access to it.
4. Data processed when you play online
Online play only starts when you open the ONLINE screen and tap CONNECT. From then on, the app sends the following to our game server:
| Data | What it is | Why |
|---|---|---|
| Commander name (nickname) | The name you type, up to 24 characters. | It is shown to other players: in the room list (for public rooms you host), in rooms and in matches. |
| Session token | A random 128-bit code that our server creates on your first connection and your app stores. It is not derived from your device, your Google account, or any hardware or advertising identifier. The server does not store the token itself, only a user ID derived from it one-way (SHA-256). | It recognises you when you reconnect, so you keep your seat in a room or match, and it stops others from taking your seat. |
| Gameplay data | Room settings (map, number of players, mode, turn timer, AI level, public or code-only), your fleet choices (company, flagship, colour), seat and ready status, Quick Match preferences, the moves you make, and the match state, timestamps and turn timers the server derives from them. | To run the match: the server checks every move, plays the AI seats and sends every player their own view of the game. |
| Connection data | Your IP address and basic technical details of the connection, such as the time, the requested address and standard HTTP headers (for example the user agent). The network may derive your approximate country or region from the IP address. | Our hosting provider processes it to deliver the connection and protect the service, and it may appear in short-lived server logs. We do not use it to locate or profile you. |
Please do not use your real name or other personal information as your commander name: other players can see it.
We do not collect your email address, phone number, contacts, precise location, photos, files, microphone audio, advertising ID or device hardware identifiers. Apart from internet access, the app requests no Android permissions.
The game server address can be changed in the app. If you connect to a server other than ours (for example one running on your own network), the data above goes to that server, and this policy does not apply to it.
5. How and why we use the data
We use online data only to provide online play: listing rooms, matchmaking, running matches, reconnecting you after a dropped connection, enforcing turn timers, and keeping the server secure and working (troubleshooting with logs). We do not use it for advertising, analytics, profiling or automated decisions about you.
If the EU/EEA or UK GDPR applies to you, our legal bases are: providing the online service you ask for (Article 6(1)(b) GDPR), and, for connection data and logs, our legitimate interest in operating, securing and troubleshooting the server (Article 6(1)(f) GDPR).
6. Who can see or receive the data
- Other players in your room and match see your commander name, your fleet choices and your moves as part of the game. When you host a public room, your nickname also appears in the public room list.
- Cloudflare, Inc. hosts the game server (Cloudflare Workers and Durable Objects) and processes the data above on our behalf, as our service provider. Cloudflare runs a global network, so the data may be processed in data centres outside your country, including outside the EU/EEA. Cloudflare’s privacy policy: cloudflare.com/privacypolicy
- Google distributes the app through Google Play. Google’s own privacy policy applies to Google Play.
- We may disclose data if the law requires it.
We do not sell personal data and do not share it with third parties for their own purposes. The app contains no advertising, analytics or crash-reporting SDKs.
7. Security
All data between the app and our game server is encrypted in transit (TLS, wss://). The server’s storage is private to the game server. There are no passwords: the session token is random, and the server keeps only an ID derived from it one-way. No method of transmission or storage is 100% secure, but we keep the data to the minimum the game needs.
8. How long we keep the data
Online data is deleted automatically, according to the server’s rules:
| Data | When it is deleted |
|---|---|
| Your lobby sign-in (nickname and user ID) | When you disconnect, unless you are seated in a room or waiting for a Quick Match. |
| Quick Match queue entry | When a match is found or you cancel. If you disconnect, 20 seconds later. |
| Room before the match starts | When the last player leaves, or 30 minutes after the last activity if no player in it is connected. |
| Match data (nicknames, user IDs, fleet choices, moves, match state) | 10 minutes after the match ends. Immediately, when every human player has left the match. |
| An unfinished match that every player disconnected from without leaving it | The match is paused and kept so that the players can come back. There is currently no automatic time limit for this case: the data is deleted when the match is finished, when every human player has left it (LEAVE on the ONLINE screen), or when you ask us. |
| Server logs (may contain IP addresses, connection details, nicknames, room codes and match IDs) | Automatically after 3 days (at most 7 days, depending on the hosting plan). |
| Data on your device | When you clear the app’s data or uninstall the app. |
9. Your choices and rights
- You can play offline. Then no data is sent to us.
- You choose your commander name, and you can change it before connecting.
- You can leave a match at any time (LEAVE on the ONLINE screen). The AI takes over your fleet, and when every human player has left, the match data is deleted.
- Clearing the app’s data or uninstalling the app deletes everything stored on your device, including the session token. Without the token, the server can no longer link you to any remaining data, so use LEAVE first if you want an unfinished match removed.
Depending on where you live (for example under the GDPR), you have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. To exercise these rights or to ask for deletion, email grinnoxgames@proton.me with your commander name and, if possible, the room code and the approximate date and time you played. We do not know who you are, so we need these details to find your data. Much of the data is deleted automatically before we could act on a request. We answer within one month. You also have the right to lodge a complaint with a data protection authority (in Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH, naih.hu).
10. Children
The game is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us at grinnoxgames@proton.me and we will delete it. If you are under the age of digital consent in your country, ask a parent or guardian before you play online.
11. Changes to this policy
We may update this policy, for example when the game or the server changes. We will publish the new version on this page and change the “Last updated” date. If a change materially affects how we use your data, we will also point it out in the release notes on Google Play.
12. Contact
Grinnox – grinnoxgames@proton.me