Fortress Fury — Player Privacy Policy

Effective date: 2026-10-27 Version: ff-privacy-2026-10b Published URL: https://fortressfury.com/privacy.html

Privacy Policy · Terms of Service

1. Who is responsible

ODSOFT LLC develops Fortress Fury under the Kervado name. We decide how the personal data described here is used. Our registered address is Proshyan street, building 1, apartment 11, Kentron district, 0019 Yerevan, Armenia; registration number 264.110.1240778, TIN 08225209. Fortress Fury, Kervado and ShardPilot are operated by the same company. ShardPilot is our own analytics and crash system.

Contact privacy@kervado.com, or use the Prighter privacy portal. Our EU privacy representative is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. Our UK privacy representative is Prighter Ltd, company number 12854033, 20 Mortlake, Mortlake High Street, London SW14 8JN, United Kingdom. These are Article 27 privacy representatives, not an appointed Data Protection Officer.

Our separate Digital Services Act representative is Prighter DSA GmbH, FN 503213 w, Schellinggasse 3, 1010 Vienna, Austria; support@prighter.com, +43 1 997 41 24, with the same Prighter portal. Authorities can contact legal@odsoft.net. Player support is hello@kervado.com.

2. Start here

We use account and match information to run the game, protect fair play and honour purchases. Your privacy choices are separate from accepting the Terms:

Gameplay analytics has a regional choice. In strict regions the analytics selector starts unselected and collection stays off until you opt in. Allow all and Only required are equally prominent; you can also select On or Off and then Continue. Only required turns analytics off and leaves your crash-report choice unchanged. Where our regional rules permit opt-out analytics, both selectors start On, with equally prominent Continue and Allow all buttons and no Only required. Untouched analytics On + Continue records non-objection, not consent; Allow all records consent for device and server analytics; analytics Off + Continue refuses both. Analytics is always off for minors and for provisional or uncertain age bands. The same analytics choice controls optional device and server analytics. You can play without either and change the choice in Settings → Privacy. Necessary gameplay, purchase fulfilment and fair-play processing continue separately.

• Crash reports for eligible players are on by default. You can turn them off on the initial privacy screen or in Settings → Privacy.

You can play without gameplay analytics and can change analytics and crash choices in Settings → Privacy. Players below the privacy threshold, including an uncertain age result, have both analytics purposes and crash reporting off (§8). Accepting the Terms does not grant permission for optional gameplay analytics.

These privacy settings and this policy are in English even when the game interface uses another language. The language note is shown in your interface language. The birth-month/year question uses a reviewed translation where available and otherwise English. Ask a trusted adult or contact us if you need help.

3. What we use and why

Where our regional rules permit opt-out analytics, leaving analytics On and pressing Continue records non-objection from the device and permits ordinary device and server analytics. We do not record it as consent. Allow all records consent for both; analytics Off + Continue refuses analytics. A default or a new non-objection never overrides a previous refusal.

Integrity checks do not scan other applications, files, processes, browsing history or hardware. Additional client information cannot be collected under that purpose to bypass the device-analytics choice.

The random installation identifier is not an advertising or hardware identifier. When device analytics is on under your regional choice, activity recorded before sign-in can be linked to your account when you sign in. Coded or hash-keyed data remains personal data to us; removing names does not make it anonymous.

We may show different versions of features to test them. Behavioural targeting from your device requires your explicit analytics consent. Under-threshold players are excluded from analytics experiments. Feature-configuration requests can process an identifier and attributes even without retaining them. We do not make legal or similarly significant decisions about you through these experiments.

4. Who receives information

Since 2026-09-12, our core game services and their data have been hosted with OVH Hosting Limited (Ireland), in Roubaix, France. Before then, the game backend was hosted with AWS in us-east-1, United States. Historical game-hosting resources were cleaned up on 18 September 2026; deletion of every residual log, snapshot or backup has not been independently verified. Core backups are in Paris and the registry in Gravelines. Our authorised staff access systems from Armenia (§5).

ShardPilot is first-party infrastructure, not a different company receiving your data. Providers working for us receive information needed for their service; stores have independent responsibilities for their own services.

• Internal ShardPilot analysis: Our staff may use Anthropic, PBC and OpenAI OpCo, LLC to understand minimised gameplay aggregates and explain release changes. We permit no raw player events in this scope. Small groups or context can still identify someone, so we treat inputs as potentially personal. Anthropic and OpenAI may process information in the United States or globally under contractual safeguards; we do not promise EU-only processing or support access. Commercial terms restrict training. Provider-standard retention covers service, abuse/safety monitoring and feature/cache lifecycles, with longer retention for safety enforcement or legal requirements. See Anthropic retention and OpenAI data controls. This use has no confirmed Zero Data Retention arrangement. Release explanations are internal; there is no player-facing AI chat.
• Separate game-backend balance analysis: In the game backend, our staff use OpenAI for admin balance/statistics analysis. Release-notes translation is a separate use and contains no player data. The flow uses OpenAI OpCo, LLC, United States, with pseudonymised player identifiers and gameplay statistics. This is staff analysis, not automated decisions about individual players; there is no player-text or player-facing AI path. Processor terms and Standard Contractual Clauses, with UK coverage where applicable, address provider processing. We require EU-region processing and no training for the intended arrangement, but have not confirmed EU residency or Zero Data Retention for this account. Current US processing remains in scope. Default abuse-monitoring logs can be held up to 30 days; feature-specific storage and safety/legal exceptions may apply. You can ask us about the applicable safeguards and retention through the privacy contact.
• Sentry (Functional Software, Inc., United States) receives interim backend diagnostics. Errors can originate in all four backend services; incoming request tracing concerns the main and admin services, with one internal distributor transaction and no game-server request tracing. A game-server panic can attach an account identifier, token identifier and the player's data structure. There is no Sentry in the current game client. Historical pre-removal client records may contain a player identifier, device model and crash-dump content. Historical exposure and provider deletion remain unconfirmed. The four servers share a configuration name, without a demonstrated per-environment separation; deployed settings and the complete transmitted fields remain unconfirmed. The restrictions and retention periods described for ShardPilot do not establish Sentry's controls. Its accepted data-processing terms include Standard Contractual Clauses and the UK Addendum; their scope and historical coverage still require assessment. Removal is not proof of provider deletion. Sentry's account retention and deletion outcome have not been confirmed.
• Valve/Steam, United States receives SteamID-linked scores and achievements through synchronisation. The Steam privacy agreement covers its independent sign-in, purchases and store records. Apple and Google, when their releases launch, independently control their store services; see Apple privacy and Google privacy. Account deletion stops future synchronisation and includes recipient notification where their interfaces permit it; it does not automatically delete all store records.
• Privacy requests: direct mail uses Google Workspace, contracted through Google Cloud EMEA Limited, Ireland. Irish contracting does not mean all processing occurs in the EU. Privacy requests can instead use the Prighter portal. We use these services to receive and handle your request.

Website visitors. fortressfury.com receives IP addresses and request metadata to deliver and protect its pages. The existing public pages use an AWS delivery path; we are confirming the complete hosting and onward-processing chain. This is separate from the game's OVH hosting. Embedded videos and other third-party features may contact their providers; the site's separate cookie information applies. We do not claim that the site uses only EU infrastructure.

The game backend has no active email-sending path. This does not remove the Google Workspace and Prighter services used for support and privacy requests.

4.1 International transfers based on consent

Where we ask for your consent to an international analytics transfer, the recipient and controller is ODSOFT LLC, Proshyan street, building 1, apartment 11, Kentron district, 0019 Yerevan, Armenia; contact privacy@kervado.com. OVH Hosting Limited (Ireland) processes and hosts this data for us in France (EU). Its contact address is Enterprise House, O'Brien Road, Co. Carlow, Carlow, R93Y0Y3, Ireland.

We transfer optional gameplay analytics to improve gameplay, balance and performance: device sessions, progress, performance, device/app details, installation/account identifiers and server match, progression and purchase statistics. Authorised ODSOFT staff in Armenia can access it. China requires your separate transfer consent in addition to the analytics choice; the separate checkbox starts unchecked. Other consent-for-transfer regions use the disclosed analytics choice.

Withdrawing consent in Settings → Privacy stops further consent-based transfers. For access, correction, erasure or other applicable rights about transferred data, contact privacy@kervado.com or use the Prighter portal linked in §1; §9 explains the request and verification process. Retention in §7 and the other processing-location disclosures in §§4–5 continue to apply.

5. Armenia and other countries

ODSOFT LLC is an Armenian company operating from Armenia. Our director and DevOps staff can remotely access the systems in France to operate and support them. Armenia has no EU adequacy decision, and Armenian law can affect requests made to us or our staff. Restricted staff access, multi-factor authentication, access logging and encryption of core stored data reduce but do not eliminate government-access risk. Further protections, including phishing-resistant authentication and technical prevention of local copies, are being completed.

First-party access from Armenia is not a transfer between two companies. Clauses with external processors do not by themselves protect that access. Other providers may process information in further countries as described in §4. You may request information about their safeguards through privacy@kervado.com or the Prighter portal. Your statutory rights continue to apply.

6. Your choices

Turn gameplay analytics off in one action in Settings → Privacy to withdraw consent or object to opt-out analytics for both device and server analytics. We do not repeat the request after refusal. Device withdrawal stops new collection immediately and clears queued device analytics. If cleanup fails, device collection stays off. You can later choose to turn analytics back on.

For server-side analytics, once we receive withdrawal, our servers stop collecting new analytics for you, except that a match already assigned to you may still send events until it ends. This does not recall events already sent. Withdrawal does not affect the lawfulness of earlier consent-based collection or by itself confirm deletion of records already held. Contact privacy@kervado.com or the Prighter portal for help or a data-rights request, including deletion (§9). Necessary integrity use continues; you can object to that processing and we assess your circumstances and any compelling grounds individually.

Native crash reports contain signal/exception type, OS name/version, loaded-module names/debug identifiers/addresses and address-only stack frames. They contain no breadcrumbs, device model, player identifier or dump bytes. The app version describes the current launch, not necessarily the crashed one. Lua errors include error-message/traceback text, screen-transition and login breadcrumbs (screen names only, no content or input), and optional pseudonymous session/anonymous identifiers. The client SDK sends optional identifiers without HMAC hashing. The crash plane hashes those identifiers server-side with HMAC when its hasher is configured. Lua reports do not include OS version or device model; arbitrary error text is not guaranteed to be free of personal information.

Both are structured reports. Fortress Fury does not send a minidump file through ShardPilot; the platform's separate 24-hour minidump-file period does not apply. Reports are kept for 180 days. A sanitised local retry queue holds at most 8 records for up to 7 days. These statements do not establish retention of historical Sentry data (§4).

Turn Send crash reports off on the initial screen or in Settings → Privacy. New capture and sending stop immediately, queued reports are purged and failures keep reporting off. Contact us about reports already held. We keep the versions, language and time of your choices to show what you saw and enforce those choices.

7. How long we keep data

The following periods apply to the corresponding ShardPilot data, separately from Sentry and the game backend:

Backups may retain deleted data for up to 30 days after primary deletion and are then overwritten. Erasure and suppression are reapplied before restored data returns to normal use.

Game accounts and related records: we keep progress, purchases and other game data for the life of your account, with no automatic expiry. Deletion is on request (§9), subject to necessary transaction records below. Game-backend error logs have no automatic expiry; free text can retain references beyond a deleted player's own log rows. This is separate from the ShardPilot periods above.

Post-deletion transaction records are limited to the necessary store transaction identifier, product, amount, currency, date and store-account identifier. They exclude nickname, chat and gameplay. The applicable accounting or limitation period must justify retention; we do not assert an unconfirmed Armenian statutory term. Case-specific holds are limited to their purpose and reviewed. Contact us for the period and reason applicable to your records.

Sentry has its own account retention; we have not confirmed its retention and deletion outcome. The 180-day ShardPilot period does not establish Sentry's retention. The historical AWS cleanup has the verification limit described in §4.

8. Younger players

You must be at least 13 to play. This is separate from the privacy threshold, which is 16 worldwide until a different applicable rule is established. Players aged 13–15 use minimised mode. An uncertain age result also uses that mode.

At first run we ask for birth month and year to derive a privacy age band using server time. The date stays in memory only while deriving the band; it is not saved, sent or logged. We retain the band and necessary rule metadata, not the date.

In minimised mode both analytics purposes, experiments, crash reporting and advertising are off. No analytics or crash switch asks an under-threshold player for permission. Limited information is still needed for permitted accounts, matches, purchases and store functions. Permission to play or buy is separate from optional processing; ask a parent or legal guardian for help where required. These protections do not describe Sentry's unresolved earlier exposure (§4).

Other players can see your generated game name. Chat is disabled. Do not share your real name, address or other private details through account or help requests. Our game computers are in France; people running the game work in Armenia and can access them. Some providers handle information in other countries (§§4–5). Ask a trusted adult if you need help with privacy choices or requests.

Your IP address provides a country estimate, not your exact location. Analytics discards the IP after that lookup; separate security logs may contain it. We do not enable precise-location tracking. Parents or guardians may exercise rights for a child with proportionate verification and regard for the child's rights.

9. Your rights and help

You may request access, correction, erasure, restriction or portability where applicable, or object to legitimate-interest processing. Email privacy@kervado.com or use the Prighter portal. Tell us that your request concerns Fortress Fury and whether you sign in with Steam, Google or Apple, or play as a guest. If available, include the platform user ID for that sign-in, or an existing game/data identifier. Your email address is a contact channel for the request, not a stored game-account key: the game account stores platform IDs, not your email address. A Google or Apple user ID here means the platform identifier, not an email address or display name. You do not need an in-game deletion button to ask. If you cannot find an ID, ask us for help. We ask only for information reasonably needed to locate the records and verify account control for your own request, or your authority to act for the player as a parent, guardian or authorised agent. Do not send passwords or tokens.

If you play as a guest, you can link the guest account to a platform sign-in in the game, after reviewing the effect on progress, items and balances described in the Terms. Then provide that platform's ID for the request. If you cannot or choose not to link, tell us: we record and answer the request, explaining that we cannot identify or verify the unlinked guest account through the current support route. We perform no deletion on an unverified guess.

These rights include personal data held by Sentry and other providers. Per-player handling of Sentry data is still being completed; that does not narrow your rights or suspend our response obligations. Removing Sentry or requesting account-level provider deletion does not by itself fulfil an individual request.

We respond without undue delay and normally within one month. Where law allows an extension for complexity or number of requests, we explain it and the reasons within that first month. For a privacy complaint, use the same contact and explain the concern and desired outcome. UK privacy complaints have a separate 30-day acknowledgement period; we investigate, keep you informed and communicate the outcome without undue delay. That does not replace the rights-request deadline.

You may complain to an EU supervisory authority where you live or work or where a suspected infringement occurred, or to the UK ICO. Our own process does not remove those rights; our representatives can help route contact.

10. Chat, names and safety

Chat is disabled. Generated nicknames and scores can appear to other players in lobbies and leaderboards. Names can be regenerated at a limited rate; you cannot enter a free-text replacement. Ask privacy@kervado.com for help with an inappropriate name. Account help and privacy requests remain available independently of your analytics choices. Earlier private-lobby messages were relayed without a general server history; disabling chat does not remove rights in any earlier records.

Store leaderboards and achievements follow the store's privacy settings. Deleting your game account does not automatically delete every independently controlled store record.

11. Advertising and regional rights

The Steam game has no advertising. Mobile advertising takes effect only with its announced mobile release and updated information about actual partners, data, retention and choices. Personalisation requires the applicable consent choices; on iOS the separate tracking permission follows those choices and precedes advertising-identifier access. Refusing personalisation does not block play. Under-threshold players receive no advertising; eligible under-16 players receive contextual ads only. We do not knowingly sell or share under-16 players' data for personalised advertising.

11.1 California

Where California law applies, the categories described in §§3–4 include account, store and installation identifiers; customer and transaction records; game, network and diagnostic activity; country estimates; age bands; and gameplay inferences. Authentication information and incidental private or sensitive material in reports may also be personal or sensitive information. We do not claim all diagnostic text is free of such information. No government-ID, biometric, health, employment or education profiling is intended.

Sources are players, devices, sign-in/purchase stores and our servers. Uses and recipients are in §§3–4; retention is in §7. The Steam game has no advertising SDK or identified sale or cross-context advertising sharing. Any future mobile personalised advertising will identify its partners and provide applicable Do Not Sell or Share My Personal Information controls, including recognition of Global Privacy Control. A missing signal is not consent.

Applicable rights include knowing/accessing, deleting, correcting, opting out of sale/sharing and limiting sensitive-information use beyond permitted purposes, without discrimination. Use the privacy contact or Prighter. An authorised agent may act with proportionate proof; opt-out signals do not require identity verification. We acknowledge know/delete/correct requests within 10 business days and respond within 45 calendar days, with any permitted 45-day extension explained in time. Applicable sale/sharing and sensitive-use limits are honoured within 15 business days. The general one-month route does not extend a shorter deadline. We offer no financial incentive for personal information.

11.2 Other US states

Where applicable state law covers our processing, the same route handles access, correction, deletion, portability, sale/targeted-advertising opt-outs and qualifying consequential-profiling rights. You can appeal a refused request through the same contact; applicable deadlines and regulator complaint rights remain. Applicable universal opt-out signals, including GPC for covered Colorado processing, apply to any future mobile advertising. Current rights do not wait for a mobile release.

12. Changes

We identify material changes with a new effective date and document version and notify you appropriately. Updated Terms acceptance is separate from privacy choices; a policy change is not a reason to repeat a request you already refused. The Privacy Policy and Terms of Service remain available online.