Illurant
Back

Privacy Policy

Last updated: 8 October 2026

1. Controller

Mustafa Ayar
Kornstraße 7
68649 Groß-Rohrheim
Germany
Email: info@illurant.com

2. Purposes and legal bases

  • Providing the game and your account — performance of a contract (Art. 6(1)(b) GDPR).
  • Payment processing (gems) — contract and legal obligations (Art. 6(1)(b) and (c) GDPR). On the website gem packs are paid through Stripe; in the Android app through Google Play, which processes the payment and tells our server which pack was bought so we can credit it. We never receive card or bank details.
  • Reach measurement via the Meta pixel — in the EU, the EEA, the United Kingdom and Switzerland only with your consent (Art. 6(1)(a) GDPR): nothing loads before you allow it, and consent is revocable at any time. Elsewhere the pixel starts on page load on the basis of our legitimate interest in knowing which advertisements bring players here (Art. 6(1)(f) GDPR); you can switch it off at any time under Settings → Appearance, and that choice is stored on your account, so it holds on every device you sign in on. Conversions (an account created, the tutorial finished, a purchase) are reported to Meta from the browser and, outside the consent countries, once more from our server (Conversions API), each with the same event id so nothing is counted twice. For a registered account these reports carry your email address, name, user id and country as SHA-256 hashes — never in plain text — together with your IP address, browser identification and the pixel's own cookies; Meta uses the hashes only to match the event to an account it already knows.
  • Usage analysis via Microsoft Clarity — the same regional rule: consent only in the EU, the EEA, the United Kingdom and Switzerland (Art. 6(1)(a) GDPR), legitimate interest elsewhere (Art. 6(1)(f) GDPR) with the same off-switch under Settings → Appearance. Clarity records how pages are used (clicks, taps, scrolling, a pseudonymised replay of your session) so we can find confusing or broken screens; text content is masked, and a recording carries your user id so a broken screen can be traced to the account it happened to. The battle itself is drawn on a canvas and is never recorded.
  • Battle diagnostics — legitimate interest in keeping the game running on the devices our players own (Art. 6(1)(f) GDPR). When a battle opens, and if its graphics fail, the game sends our own server one short line: your device model, its graphics chip and driver, the app or browser build, how long the battle took to load and how smoothly it ran. It goes to no third party and is kept only in our server log.
  • Push notifications — your consent only (Art. 6(1)(a) GDPR). Only if you turn them on does your browser create a delivery address for that device; we store this address together with its technical keys, the device's timezone and your language, so notifications arrive at a sensible hour and in your language. Revocable at any time — Settings → Notifications or your browser's site settings — and the stored address is deleted when you disable them and when the account is deleted.
  • Server operation and security — legitimate interest (Art. 6(1)(f) GDPR).
  • Coarse statistics about new accounts — legitimate interest (Art. 6(1)(f) GDPR). When an account is created we store its country (a two-letter code, derived locally from the IP address, which itself is not stored for this purpose) and how the visit arrived — for example whether it followed an advertisement link. This tells us which countries and which advertisements our players come from; it is not used to profile individuals.

3. Recipients / processors

  • Stripe — payment processing on the website. Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
  • Google — payment processing in the Android app (Google Play) and distribution of the app. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Hetzner — server operation / hosting. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
  • Meta — reach measurement: after consent in the consent countries, on legitimate interest elsewhere, and never once you have switched it off. Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
  • Microsoft — usage analysis (Clarity), under the same rule as the pixel. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
  • Your browser's push service — delivery of push notifications, only after you enable them. Which service that is depends on your browser (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari); notification content is encrypted and readable only on your device.
  • DB-IP — IP-to-country lookup for shop currency selection, the consent rule above and the account statistics, performed locally against a downloaded database; your IP is not sent to DB-IP.

4. Transfers to third countries

Payment processing (Stripe, Google Play), reach measurement (Meta) and usage analysis (Microsoft Clarity) may involve transfers to the USA, based, where applicable, on the EU-US Data Privacy Framework and/or the EU Commission's Standard Contractual Clauses. Push notifications you have enabled are delivered through your browser vendor's push service, which may likewise involve transfers to the USA on the same bases.

5. Retention

Account data is kept for the life of the account. Purchase records are retained for the statutory commercial and tax retention periods. Server logs, including the battle diagnostics above, are rotated after a few weeks.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. Any consent (e.g. to the Meta pixel, Microsoft Clarity or push notifications) can be withdrawn at any time with future effect — via Settings → Appearance, Settings → Notifications or the cookie banner. Where the pixel and Clarity run on our legitimate interest instead, the same switch under Settings → Appearance is your objection, and it takes effect at once. You may lodge a complaint with a data-protection supervisory authority. Requests: info@illurant.com.

You can delete your account yourself at any time: log in, open Profile → Settings → Profile and choose "Delete Account" — on the website and in the app alike. Details of what is deleted and what is retained: Account deletion.

7. Cookies and local storage

The website, and the app, which shows the same website inside it, use:

  • Session cookie — technically required for login and security.
  • coh.consent (localStorage) — your tracking choice (Meta pixel and Microsoft Clarity).
  • _fbp / _fbc (Meta pixel) — set by the pixel once it runs (after consent in the consent countries, on page load elsewhere); they recognise the browser and remember the advertisement click that brought you here.
  • coh.attrib (localStorage) — the advertisement parameters of your first visit, kept for seven days so a signup can be matched to the advertisement; not written if you have declined tracking.
  • _clck / _clsk (Microsoft Clarity) — set under the same rule as the pixel; they recognise the browser across page views for the usage analysis above.
  • coh.beta_notice (localStorage) — remembers the beta notice was dismissed.
  • coh_sound (localStorage) — sound preferences.
  • coh.push-nudge (localStorage) — remembers that the notification hint on the contract board was dismissed.