Effective September 11, 2026 · Version 1.1
This Policy explains what Royal Valor collects, why, and what you can do about it.
Royal Valor is separate from Pixla's other products. A Royal Valor account is not a Pixla account. Pixla's platform Privacy Policy covers Pixla Hosting, Pixla Mail and the Pixla websites; this one covers the Game.
1. The short version
- We collect an email address, and what you do in the Game. That is nearly all of it.
- Chat messages are never stored. They pass between players and are gone.
- We never see your card. Payment details go to Apple or Stripe and never reach our servers.
- No advertising, no ad networks, no third-party analytics, no tracking across other apps or sites. Nothing is sold or shared for advertising, for anyone of any age.
- Children under 13 need a parent's consent before the account works, and a parent can delete everything at any time.
- You can delete everything yourself from inside the Game, immediately.
2. What we collect
When you make an account
- Email address — given by you, or by Apple when you use Sign in with Apple. If you ask Apple to hide it we receive Apple's private relay address and never learn the real one.
- Password, stored only as a bcrypt hash. We cannot read it.
- Apple user identifier, if you sign in with Apple: an opaque id specific to this app.
- A date of birth, asked once. We do not keep it. We store only the date you turn 13, so we know when a parent's consent is no longer needed — and, if you are under 13, a parent's email address.
When you play
- Your heroes: their generated names, race, colour, weapon and finish, worn cosmetic, level, experience, health, mana, crowns and valor, and counts of what you have defeated.
- Progress: quests, items owned, and when you were last online.
- Settings: your chat mode, and whether a Guardian Lock is set. The PIN and its recovery code are stored only as hashes; we cannot read or recover either.
When you buy
- In the app: a signed receipt from Apple, from which we read the product and the transaction identifier. Apple is the seller; we never see your payment details.
- On the website: a Stripe payment identifier, the amount, the bundle, and the email you gave Stripe for a receipt. Card details go straight to Stripe and never reach our servers.
Automatically
- Server logs — the requests our server handles, kept briefly for operating and debugging and held by our hosting provider. These can include an IP address as part of ordinary network operation. We do not use them to build a profile of you or to target anything.
3. What we do not collect
- We do not store chat. There is no message table and no archive. One consequence is worth knowing: we usually cannot investigate a chat report after the fact.
- No advertising identifiers, no ad SDKs, no third-party analytics SDK, no cross-app or cross-site tracking, no location, no contacts, no microphone, no camera.
- No card numbers, in any channel.
- No date of birth, once the date you turn 13 has been worked out from it.
4. Why we use it
To run your account and sign you in; to run the Game and keep your progress; to deliver what you buy and keep a record for accounting and to avoid granting the same purchase twice; to seek and record a parent's consent where one is needed; to enforce the Guardian Lock and safe chat; to keep the service secure and diagnose faults; and to comply with the law.
Legal bases (EEA/UK): performance of a contract for your account, progress and purchases; legitimate interests for security, fraud prevention and debugging; legal obligation for records we must keep and for children's consent; consent where we ask for it.
5. Children
Royal Valor is made for a general audience and children are welcome. We ask for a date of birth when you register, on a neutral screen that does not suggest which answer to give.
If a player is under 13, US federal law (COPPA) requires a parent's verifiable consent before we collect personal information from them, and we obtain it before the account can be used:
- We ask for a parent's or guardian's email address and send them a request for consent.
- The account cannot be used until that adult confirms it. Until then we hold the parent's address, a scrambled confirmation token and the child's sign-in details — nothing else, and no gameplay data, because none has been created.
- After consent is given we send a second notice to the same address, so an adult finds out even if a child answered the first email.
- Children's accounts are never used for advertising, are never profiled, and their data is never sold or shared for anyone else's purposes.
- A parent may withdraw consent at any time using the link in either email, or by writing to privacy@pixla.app. Withdrawing deletes the account and everything in it.
- A parent may review what we hold for their child and delete it by writing to privacy@pixla.app; we verify they are the parent who consented before answering.
If a player is 13 or over, no parental consent is sought and no parent's address is collected. Anyone under the age of majority where they live still needs a parent's agreement to the Terms.
6. Who we share it with
We do not sell your data and do not share it for advertising. We share only with the providers who run the service:
| Provider | For | What they get |
|---|
| Apple | Sign in with Apple; in-app purchases | An opaque identifier, and on a first sign-in only, an email address |
| Stripe | Payments on the website | Your card details, which they process; we never receive them |
| Fly.io | Running the game server | Data in transit, and whatever appears in server logs |
| DigitalOcean | The database | Everything described in section 2, stored |
| Cloudflare | DNS for our domains | Ordinary network data |
| Postmark | Parental-consent and account emails | The recipient's address and the message |
We may also disclose data where the law requires it, or to protect the rights and safety of players.
7. Where it is held
Our servers and database are in the United States, and playing from elsewhere means your data is transferred there. For players in the EEA and UK, transfers rely on the European Commission's Standard Contractual Clauses with our providers, together with the UK Addendum where it applies.
8. How long we keep it
- While your account exists, we keep it.
- When you delete your account it is destroyed immediately — heroes, progress, crowns, settings and the account itself. There is no grace period.
- An under-13 account whose parent never consents is deleted, along with the parent's address, within 30 days of the request being sent.
- Records of purchases outlive the account, and are no longer linked to it. When an account is deleted we keep the store's transaction identifier, what was bought and when — with nothing that leads back to the account — so that the same purchase can never be paid out twice, and for as long as accounting and tax law requires.
- Server logs are kept briefly by our hosting provider and then discarded.
9. Your rights
Depending on where you live you may have the right to access, correct, delete, export or port your data, to object to or restrict processing, to withdraw consent, and to complain to a regulator. Two of these are built into the Game:
- See it — Settings ▸ Account shows the address and sign-in method we hold.
- Delete it — Settings ▸ Account ▸ Delete Account, immediately and completely.
For anything else write to privacy@pixla.app; we answer within 30 days. We do not discriminate against anyone for exercising a right.
California residents: we do not sell or share personal information as those terms are defined by the CCPA, and have not done so in the preceding twelve months.
10. Security
Passwords, guardian PINs and recovery codes are stored only as hashes. Traffic is encrypted in transit; the database accepts connections only from our own server and our own administrative address; payment details never reach us. No system is perfectly secure, and we will not pretend otherwise — report anything you find to security@pixla.app.
11. Changes
We may update this Policy. Material changes are posted with a new effective date and announced in the Game. Where a change affects children's data we will seek a parent's consent again if the law requires it.
12. Contact
Pixla LLC
5706 Neubert Springs Rd, Knoxville, TN 37920
Privacy: privacy@pixla.app
Support: support@pixla.app
Security: security@pixla.app
Website: https://royalvalorgame.com