Privacy Policy

This policy explains how Skalain (“we”) handles the personal data of players of the Android game Arka: Sky of Aeria (package com.skalain.skyofaeria, the “Game”) and of visitors to this website. It follows Indonesia’s Personal Data Protection Law, Law No. 27 of 2022 (UU PDP) and, for players in the European Union, the General Data Protection Regulation (GDPR).

Our approach is simple: you can play the Game without logging in and without an internet connection, and we only collect the data needed to run it. We do not ask for your real name, phone number or email address unless you choose to link a Google account. We do not sell your personal data.

1. Data controller and contact

The controller of personal data for the Game and this website is Skalain. For privacy questions, requests or complaints, contact us at support@skalain.app.

2. Current test builds and the release version

The Game is still in development. This policy covers two situations:

• Current test builds. The Game has no account, server, ads, in-app purchases or analytics SDK yet. All data stays on your phone and is not sent to us automatically (see section 3).
• Release version. An anonymous account, cloud save, optional Google account linking, ads, in-app purchases, analytics and crash reporting are planned for launch. Section 4 describes the data these features will process. They only apply once they are actually present in the version of the Game you have installed.

3. Data stored on your device

The following data is created and stored in the app’s storage on your phone. We cannot see it unless you send it to us yourself.

• Game progress in a save.json file: unlocked and completed levels, coins, keys, upgrade tiers, skins, event items, settings (such as language, music, sound and vibration) and the time it was last saved. The file is signed with an HMAC so it cannot easily be edited by hand. The signature protects integrity; it does not keep the data secret.
• Playtest log (test builds). The Game records gameplay events to a text file on your phone: time, level, steps, result, upgrades bought with coins, settings changes, plus device model, operating system version, screen resolution, app version, language and a random tester code (for example P-1A2B). The log does not contain your name, contacts or location. It only leaves your phone if you tap Send log: the Game saves a copy to the Download/Arka folder and opens the Android share sheet, and you choose the app and the recipient. This feature exists for testing and may be removed in the release version.
• Evolution card. If you tap Share when Arka evolves, the Game creates a card image, saves it to the Pictures/Arka folder and opens the Android share sheet. The image and a short message (with a Google Play link) go to the app you pick, and from then on are subject to that app’s privacy policy.
• Local notifications (planned): reminders such as “Your daily chest is ready” are scheduled on your phone, at most once a day, and can be turned off in Settings.

The Game does not ask for access to your contacts, location, camera or microphone.

4. Data processed in the release version

4.1 Anonymous account and cloud save

The first time you are online, the Game creates an anonymous account on our backend service (Supabase) without asking you for any information. This involves:

• A random player ID (UUID) and session tokens. The tokens are stored on your phone with light encryption.
• A profile: an automatically generated display name (for example “Ksatria Bayu 482”, no free text), a country code from your device settings, an invite code, a profile frame and the creation date.
• Progress: level, coins, keys, upgrade tiers, skins, skin shards, “Remove Ads” status and update time, used to sync and back up your progress.
• Online feature data once those features exist: Daily Challenge and Weekly Tower results (number and order of moves, used to verify scores), league membership and rank, Community Mission contributions, and invite code relationships. In leagues, other players only see your automatic display name, frame and score. The Game has no chat and no friend list.
• Technical request data: IP address, app version and platform, recorded in server logs for security, abuse prevention and troubleshooting.

4.2 Linking a Google account (optional)

You can link a Google account so your progress is safe when you change phones. If you do, Google sends us your Google account ID and email address (and any basic profile information Google includes, such as your name), which our authentication provider stores to recognise your account. Without this link we do not know your email address.

4.3 Ads

The release version shows rewarded ads (only after you tap a clearly labelled button) and interstitial ads between levels. There are no banner ads. Ads are served through the AppLovin MAX mediation platform, which passes requests to partner ad networks (for example Google AdMob and Unity Ads).

• Before the ad SDK starts, the Game shows a Google User Messaging Platform (UMP) consent form where required in your region (for example the EU, the EEA and the UK). Your choice decides whether ads may be personalised. You can reopen this form at any time from Settings → Privacy.
• Ad providers may process your device’s advertising ID, IP address, device and network information and your interactions with ads, in order to serve ads, measure them and prevent fraud. You can also reset or delete your advertising ID in Android settings.
• The full list of ad partners is shown in the consent form.

4.4 In-app purchases

Purchases (for example Remove Ads, the Starter Pack, skin packs or coin packs) are processed by Google Play Billing. We do not receive your card number or payment details. To validate a purchase and grant the item, our server receives and stores the product ID, transaction or order ID, purchase token and receipt, status, time and the related player ID. The server checks the purchase with the Google Play Developer API.

4.5 Analytics, crash reports and attribution

• GameAnalytics: gameplay events such as starting, winning or failing a level; evolutions; upgrade purchases; ad impressions; purchases (product, price, currency); and shares, together with an analytics ID and basic device information. We use this to understand which parts are too hard and to improve the Game.
• Sentry: crash and error reports (stack traces, device model, operating system version, app version) to fix bugs.
• Attribution and deep links (if used): a provider such as Adjust or AppsFlyer to learn which campaigns lead to installs and to create the download link in shared cards. These providers may process your advertising ID, IP address and device information.

5. Purposes and legal bases

Purpose	Legal basis
Running the Game, saving and syncing progress, online features, account linking	Performance of a contract (the Game’s terms of service)
Validating purchases and keeping transaction records	Performance of a contract and legal obligation (tax and accounting)
Personalised ads	Consent (through the UMP form), which you can withdraw at any time
Non-personalised ads, analytics, crash reports, security and cheat prevention	Legitimate interest in keeping the Game running and improving it, or consent where the law in your region requires it

We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.

6. Third parties that process data

We use the following providers as processors or partners, each with its own privacy policy:

• Supabase: backend (authentication, database, file storage, server functions).
• Google: Google Play (distribution and Google Play Billing), Google Sign-In (account linking), Google UMP (consent) and Google AdMob (one of the ad networks).
• AppLovin (MAX) and the partner ad networks it mediates.
• GameAnalytics: gameplay analytics.
• Sentry (Functional Software, Inc.): crash reporting.
• Adjust or AppsFlyer: install attribution and deep links, if used.
• GitHub: private storage for daily database backups.
• Cloudflare: hosting of this website.

We may also disclose data where required by law, a court order or a lawful request from a competent authority, or to protect the rights, safety and property of us or other players.

7. International transfers

Some of these providers store or process data outside Indonesia (for example in the United States, the European Union or Singapore). For such transfers we ensure an equivalent or adequate level of protection as required by the UU PDP and, for players in the EU, the GDPR (for example through the providers’ standard contractual clauses).

8. How long data is kept

• Data on your device (progress, playtest log, tester code, tokens): until you delete your account, clear the app’s data or uninstall the Game. Files you save or share to the Download/Arka and Pictures/Arka folders live in your phone’s shared storage and may remain after the Game is uninstalled. You can delete them with a file manager or gallery app.
• Account and progress on our server: for as long as your account exists. When you delete your account, this data is removed from the database (see Delete account).
• Daily Challenge and Weekly Tower results: deleted automatically after 8 weeks.
• Database backups: daily backup copies are deleted on a rolling basis. Deleted data may remain in a backup until that backup expires, at most 90 days.
• Purchase transaction records: may be kept for as long as tax and accounting rules require, including after account deletion, limited to the data needed for that obligation.
• Data held by ad, analytics, crash and attribution providers: kept according to each provider’s own retention policy.

9. Your rights

Under the UU PDP you have the right to:

• be informed of our identity and of the purposes and basis for processing your personal data;
• access and obtain a copy of your personal data;
• correct inaccurate or incomplete data;
• end the processing of, delete or destroy your personal data (see Delete account);
• withdraw consent you have given, for example for personalised ads via Settings → Privacy;
• object to decisions based solely on automated processing;
• suspend or restrict processing;
• obtain and use your personal data in a common, machine-readable format; and
• sue for and receive compensation for violations in the processing of your personal data.

If you are in the EU, the EEA or the UK, you have similar rights under the GDPR: access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interest) and withdrawal of consent, as well as the right to lodge a complaint with the data protection authority in your country.

To exercise your rights, email support@skalain.app and include the player ID shown in Settings (if any). We may ask for additional information to confirm the request really comes from you, and we will respond within the time limits set by applicable law. You may also complain to the competent personal data protection authority in Indonesia.

10. Children

Arka’s content is suitable for all ages (no blood or graphic violence), but the Game is intended for a general audience and is not designed specifically for children. We do not knowingly collect personal data from children under 13, or under any other minimum age that applies in your country, without the consent of a parent or guardian.

Under Indonesian law a child is anyone under 18, and processing a child’s personal data requires the consent of a parent or guardian. If you are under 18, please ask your parent or guardian to read this policy before you link an account or make a purchase. Parents can also manage purchases with Google Play parental controls or Google Family Link.

If you are a parent or guardian and believe your child has given us personal data without your consent, contact support@skalain.app and we will delete it.

11. Security

We protect data with reasonable technical and organisational measures, including encrypted connections (HTTPS) to our server, per-user access control in the database (Row Level Security) so each player can only read their own data, secret service keys kept on the server side only, server-side purchase validation and restricted internal access. No system is completely secure. If a personal data breach occurs, we will notify you and the competent authorities as required by the UU PDP.

12. This website

This website consists of static pages. We do not place advertising cookies on it. Our hosting provider (Cloudflare) processes IP addresses and technical request data to deliver pages and protect the site from attacks. Links to Google Play and other sites are subject to their own privacy policies.

13. Changes to this policy

We will update this policy as the Game changes, for example when the features in section 4 go live. The “Last updated” date above always shows the current version. If a change is significant, we will also announce it in the Game or on the Google Play listing before it takes effect.

14. Contact us

Skalain · email support@skalain.app

This policy is also available in Indonesian at Kebijakan Privasi. If the two versions differ, the Indonesian version prevails.