Privacy policy
Last updated 25 October 2026
Sealed Fates is a card game made by Phorma Labs ("we", "us"). This policy explains what the game collects, why, who helps us run it, and how you can see or delete your data. It covers the Android app, the game in a web browser, and this website.
The short version
- The game makes an account for you so your cards and progress live on our server. You can play as a guest or sign in with Google.
- We keep what the game needs to work: your account ID, your player name, your collection and your match results, plus typed chat for a few days in case someone reports it.
- No ads, no advertising ID, no analytics, and we never sell your data.
- You can delete your account at any time, in the game or by email.
Who we are
Phorma Labs Pty Ltd, a company in Victoria, Australia, makes Sealed Fates and is responsible for your data. Write to us at hello@phorma-labs.com.
What we collect
When you play
- Account ID. On first launch the game makes a guest account through Google Firebase Authentication, which gives it a random ID. Our server keeps your data under that ID.
- Player name. The name and number you play under, which other players see. You can change the name in the game.
- Game data. Your cards, decks, card backs, portraits, Gold, Shards and Crystals, quests, Trials progress and packs opened, with a history of every change, so we can put mistakes right and stop cheating.
- Matches. Online results, ratings and ladder standing, the decks and moves played, and how long you waited for a match.
- When you play. When your account was made and when it was last online, for the ladder and the "who's online" count.
If you sign in with Google
Signing in with Google lets you get your progress back on another device. Google Firebase Authentication keeps your Google account's email address and name for this. Our own server receives only a sign-in token carrying your account ID, and doesn't store your email.
Chat and reports
- Quick chat (the fixed phrases) passes straight to the other player and isn't kept.
- Typed chat is kept with the match on our server for 7 days, so it can be checked if someone reports it, and is then deleted.
- When you report a player, or someone reports you, we keep the report, and for a chat report the lines it quotes, for as long as we need them to deal with it and keep the game safe.
On your device
The game saves your settings, a copy of your game data for quick loading, and your sign-in on the device. Uninstalling the app or clearing its storage removes them. On Android the game asks only for internet access and vibration. It doesn't use your location, contacts, camera, microphone, photos or files.
Technical data
Our servers run on Cloudflare. Like any online service, Cloudflare handles your IP address and basic details about your device and browser to deliver the game, and keeps short server logs for a few days, which we use to find and fix problems.
Purchases
The game doesn't sell anything for real money yet. When it does, Google Play will take the payment and we'll receive a record of what was bought and when, so we can deliver it. We never see your card details.
What we don't collect
No ads, advertising ID, analytics or tracking tools, and no precise location. This website sets no cookies and loads nothing from other sites.
What other players can see
Your player name, portrait and card back, your rank and place on the ladder, your record against them, and your recent online results (you can hide your name from those). If your casual deck is picked for a ghost duel, the other player sees that deck labelled with your name, and you can opt out of ghost duels.
Why we use it
- To run the game you asked to play: your account, collection, matches, matchmaking, ladder and rewards.
- To keep it fair and safe: stopping cheating, dealing with reports, pausing typed chat, and closing accounts that break the terms. Some of this is automatic. For example, several reports from different players pause someone's typed chat for 7 days. If you think one was wrong, write to us.
- To fix problems and make the game better.
- To answer you when you write to us.
For players in the EU and the UK, the legal bases are our agreement with you (running the game) and our legitimate interest in a fair, safe and working game (the rest). We never sell your data or use it for advertising.
Who we share it with
Only the companies that run parts of the game for us, under their data protection terms:
- Google (Firebase Authentication) for sign-in, and Google Play to deliver the app and, later, payments.
- Cloudflare for our game servers, database and this website.
We'd also share data if the law required it, or to protect someone's safety. Nobody else gets it.
Where it's stored
Your data is stored and handled outside Australia, mainly in the United States: our database is in the eastern United States, and Google and Cloudflare are US companies with servers around the world. For players in the EU and the UK, both use approved safeguards such as standard contractual clauses.
How long we keep it
- Your account and game data: until you delete your account.
- Typed chat: 7 days after the match.
- Reports: as long as we need them to deal with the report and keep the game safe.
- Server logs: a few days.
When you delete your account, we remove it and its data within 30 days. Two things stay: match results in other players' histories, without your name, and records the law makes us keep, such as purchase records once the game sells anything.
Your choices and rights
- Delete your account in the game under Settings › Account › Delete account (from the first Google Play test build), or see how to delete it without the game.
- See or correct your data: change your player name in the game, or write to us for a copy of your data.
- Control what others see: hide your name from recent results, opt out of ghost duels, leave typed chat off, and block players.
- In Australia, the Privacy Act 1988 gives you the right to see and correct your personal information. If you're unhappy with how we handled a privacy question, tell us first; you can then complain to the Office of the Australian Information Commissioner (oaic.gov.au).
- In the EU and the UK, you can also ask us to restrict or stop using your data, or to give it to you in a portable form, and you can complain to your local data protection authority.
We answer every request within 30 days.
Children
Sealed Fates is for players aged 13 and over and isn't made for children. Typed chat is only for players aged 16 and over who choose to turn it on. If you think a child under 13 has an account, write to us and we'll delete it.
Changes to this policy
When we change this policy we'll update the date at the top, and tell you in the game if the change matters to you.
Contact
hello@phorma-labs.com