Trinity Labs

Tiny Guild Tactics: Privacy Policy

Last updated 15 October 2026

This policy explains what personal data Tiny Guild Tactics ("the game") collects when you play on iOS, Android or the web, why we collect it, who processes it, how long we keep it and what rights you have. It is written to cover the game as it grows, so it also describes things that only some versions of the game do, such as showing ads or offering purchases. Where a feature is not in the version you play, the data it needs is not collected.

In short:

  • You play as a guest. We do not ask for your name, email, phone number or password.
  • Analytics, session recordings, install attribution and personalised ads are optional. The game asks before it turns them on, and you can turn them off at any time in the game's Privacy panel.
  • If you allow analytics, the Android and iOS apps tell our attribution provider about your install, so we and the ad networks we buy from can see which ad campaign, if any, led to it (section 2.2).
  • If the game shows ads, they come from ad networks. They are personalised only if you allow it (section 2.3).
  • We do not sell your data.
  • You can delete your data from the game: Privacy → Delete my data.

1. Who we are

The game is published by Trinity Labs Pte. Ltd., a company incorporated in Singapore ("Trinity Labs", "we", "us"). We are the controller of the personal data described in this policy.

Privacy contact and Data Protection Officer: admin@trinitylabs.io

This policy covers the game only. The Trinity Labs website has its own privacy policy.

2. What we collect, and why

2.1 Data the game needs to work

The game cannot work without this data, so we do not ask for consent to it.

  • Guest account. A random account ID and session token, created when you start your first run. The server can give the account a generated display name; it is not your real name and other players do not see it. We use it to keep your game data together and to tell players apart. Legal basis: contract.
  • Server game data. The game mode you play and the game data the online features need. Legal basis: contract.
  • Your choices. That you accepted the Terms and this policy, your analytics and ads choices and when you made them, stored on your device. We use them to respect your choices. Legal basis: legal obligation and contract.
  • Technical data. Your IP address and the time and type of each request, as logged by our servers and hosting providers. We use it to run the servers, prevent abuse and fix faults. Legal basis: legitimate interests in keeping the service secure and working.
  • Purchases (if the game offers them). Apple or Google handles the payment. We receive a receipt with the item, price, currency, country and a transaction ID, linked to your guest account, so we can deliver what you bought, restore it and handle refunds. We never see your card or bank details. Legal basis: contract.

2.2 Data we collect only if you allow analytics

On first launch the game asks whether you want to help us improve it. If you say no, none of the data below is collected. You can change your choice at any time in the Privacy panel on the camp screen; turning analytics off removes the analytics IDs from your device.

  • Gameplay events: for example rounds reached, fights won or lost, skills and items picked, heroes unlocked, quests completed, buttons tapped, ads watched, purchases made and session length. We use them to find what is confusing, too hard or not fun.
  • Session recordings: what the game screen shows, where you tap, and the game's technical log messages. Opponent names are hidden. The game has no text fields, so nothing you type is recorded. We use them to see where players get stuck and to find faults.
  • Crash and performance data: what the game was doing when it crashed or slowed down, to fix it.
  • Analytics IDs: a random install ID and analytics ID, linked to your guest account ID, to count players and connect one player's sessions.
  • Device and app data: device model, operating system, screen size, language, app and build version, and whether you play in the app or a browser, to fix device-specific problems.
  • Approximate location: country, region and city, derived by our providers from your IP address. We do not use GPS.
  • Install source: the store link or ad campaign that led to your install, as the app store reports it.
  • Install attribution (Android and iOS apps): the app sends our attribution provider (currently AppsFlyer) your device's advertising ID (on iOS only if you allow tracking when your device asks), your IP address, device model, operating system, app version, the time of installs and app opens, and your guest account ID. The provider matches the install with the ad clicks and views that ad networks report, and tells us, and the ad network involved, which campaign led to the install, or that no ad did. We use it to measure which campaigns bring players, and the ad network uses it to count and improve its campaign for us. We do not use it to show you ads.
  • Game tests: which version of a feature you see when we compare two versions.

Legal basis: your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on storing data on your device). Withdrawing consent does not affect data collected before.

2.3 Ads

Some versions of the game may show ads, for example a video you can choose to watch for an in-game reward. Ads are served by ad networks, which receive your IP address, device model, operating system, language and app version to show the ad, limit how often you see it, count views and rewards, and detect fraud.

  • Personalised ads use your device's advertising ID and what the ad network knows about you from other apps and websites. You see them only if you allow it in the game (and on iOS, also allow tracking when your device asks). Legal basis: your consent.
  • Non-personalised ads are chosen from the game and your approximate location only, without your advertising ID. If you do not allow personalised ads, these are the ones you see. Legal basis: legitimate interests in funding a free game.

You can change your ads choice at any time in the Privacy panel. You can also reset or delete your advertising ID, or turn off ad personalisation, in your device's settings.

2.4 Data that stays on your device

Your game save (heroes, quests, settings, current run) and your choices are stored on your device. They do not leave it, except through your device's own backup (see section 6).

2.5 Data we do not collect

We do not collect your name, email address, phone number, contacts, photos, precise location, microphone or camera input or payment card details. We collect your device's advertising ID only for install attribution and personalised ads, as sections 2.2 and 2.3 describe. The game has no chat. If you email us, we use your email address and message only to answer you.

3. Who processes your data

Our providers process data only on our instructions, under a data processing agreement. Today they are:

  • Mixpanel, Inc. Analytics and session recordings, only if you allow analytics. Data is stored in the EU.
  • AppsFlyer Ltd. Install attribution in the Android and iOS apps, only if you allow analytics.
  • Supabase, Inc. Guest accounts and the game database.
  • Vercel Inc. Hosting for the web version and the game servers, in the United States and other regions.
  • Apple and Google. App distribution and, if the game offers them, payments. If you play on iOS or Android, they also process data under their own privacy policies.

If we add or change a provider of one of these kinds (analytics, crash reporting, attribution, hosting, accounts), we list it here.

Ad networks. When we buy ads to find new players, our attribution provider tells the ad network that showed an ad, currently Google Ads or AppLovin, whether your install came from that ad, with the device's advertising ID where the network needs it to match the install. If the game shows ads, the networks that serve them receive the data in section 2.3. Ad networks use this under their own privacy policies.

We do not sell your data or share it with data brokers. We may disclose data where the law requires it, to protect someone's safety, or to enforce our Terms of Service. If Trinity Labs or the game is sold or merged, the data can pass to the new owner, who must protect it as this policy describes.

4. International transfers

Trinity Labs is in Singapore and some of our providers are in the United States and Israel, so your data can be processed outside your country. For transfers out of the EEA, the UK or Switzerland, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or the European Commission's Standard Contractual Clauses with the UK Addendum. For transfers out of Singapore, we make sure the recipient protects the data to a standard comparable to Singapore's Personal Data Protection Act. You can ask us for a copy of these safeguards.

5. How long we keep it

  • Guest account and server game data: until you ask us to delete it, and no longer than 12 months after you last play.
  • Purchase records: as long as tax and accounting law requires, usually 5 to 7 years.
  • Analytics events and install attribution data: 24 months.
  • Session recordings: 30 days.
  • Server logs: 30 days.
  • Support emails: as long as needed to answer you, and no longer than 12 months after the last message.

6. Deleting your data

In the game: open the Privacy panel on the camp screen, tap Delete my data and confirm. The game deletes your guest account, your game data and the analytics data linked to it from our servers, then resets the game on your device as if it were freshly installed. If it cannot reach us, it tells you that nothing was deleted, so you can try again. Install attribution data and the game server's guest record are deleted when you email us, as below. Backups can take up to 30 more days to expire. We keep purchase records the law requires us to keep.

Without the game: email admin@trinitylabs.io with the subject "Delete my data" and the Player ID shown in the Privacy panel. We do not know your name or email, so without the Player ID we may not be able to find your data. We delete your guest account, server game data, analytics data and install attribution data within 30 days and confirm by email.

On your device: uninstalling the game removes the data stored on your device. On Android, if Google backup is on, a copy can remain in your Google account backup until Google deletes it.

7. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. You can withdraw consent at any time (for analytics and personalised ads, in the Privacy panel).

To use a right, email admin@trinitylabs.io with your Player ID. We answer within 30 days, or sooner where your local law requires, free of charge. We may ask for information to confirm that the data is yours.

You can also complain to a data protection authority: in Singapore the Personal Data Protection Commission (PDPC), in the EEA your national authority, and in the UK the Information Commissioner's Office (ICO).

We do not make decisions about you by automated means that have legal or similarly significant effects.

United States. We do not sell personal information. Install attribution measures our own campaigns and does not target ads to you, so we do not treat it as sharing for cross-context behavioural advertising. Personalised ads can count as such sharing under some US state privacy laws; you can opt out by leaving personalised ads off in the Privacy panel, and we honour a Global Privacy Control signal where the law requires it. We do not use sensitive personal information. These rights are open to residents of every US state, and we will not treat you differently for using them.

Brazil and other countries. The rights above apply as your local law grants them. For Brazil (LGPD), our data subject contact (encarregado) is admin@trinitylabs.io.

8. Children

The game is not directed at children under 13, and we do not knowingly collect personal data from them (or from children under the minimum age in your country). If you are under the age of digital consent where you live (13 to 16 in the EEA, depending on the country), ask a parent or guardian before you allow analytics or personalised ads. If you think a child has given us personal data, email admin@trinitylabs.io and we will delete it.

9. Security

All data the game sends is encrypted in transit (HTTPS). Access to our databases is limited to the people who need it, and each guest account can read only its own data. No system is completely secure, but we take reasonable steps to protect your data.

10. Changes to this policy

When we change this policy, we update it on this page and change the date at the top. If a change means we collect data for a purpose that needs your consent, the game asks you before it starts. If a change significantly affects how we use data we already have, we also tell you in the game.

11. Contact

Trinity Labs Pte. Ltd., Singapore · admin@trinitylabs.io