Privacy Policy

1. Controller and contact

Stratal is responsible for personal information processed to run Ironvale. Contact sales@stratal.co.uk for privacy questions or rights requests. This notice covers the Android app, game accounts, community features and the administrator service.

2. Information collected

Account data includes your username, email, password hash, eligibility confirmation and optional two-factor settings. Gameplay data includes progress, balances, inventory, vehicles, races, trades, buildings, actions and rewards. Community data includes profile photos and biography, messages, chat, forum posts, friendships, blocks and reports. Security records may include IP address, device name, user-agent, session identifiers and sign-in/action timestamps.

3. Why it is used

Account, gameplay and service communications are used to provide the game and fulfil the service agreement. Security, anti-cheat, moderation and dispute records support Stratal's legitimate interests in protecting players and operating a fair service, balanced against players' rights. Information may also be retained where required by law. Optional device notification permission can be withdrawn in Android settings.

4. What other players can see

Your username, public profile photo, biography and game statistics may be visible to players. Posts are visible to their intended audience. Gang chat is restricted to current members of that gang. Email addresses, passwords and account contact information are not exposed in public profiles. Avoid putting personal details in your name, photo, biography or messages. When the Hall of Fame is running, its monthly boards show the usernames of top players and the names of top gangs with their totals for that month, and a title you choose shows on your profile.

5. Staff and service providers

Authorized staff may review account, transaction, message and report records for support, security and moderation. Messages are not end-to-end encrypted. Hosting, backup and email providers may process information needed to provide the service. We do not sell player personal information. We may disclose necessary information when legally required or to address abuse or protect rights.

6. Devices, photos and notifications

The app stores sign-in/session information and preferences locally. Passwords are stored on the server as hashes. Profile photos are processed and resized, with metadata removed, and are displayed publicly. Photo selection uses Android's picker; the app does not request unrestricted access to your photo library. The app has no advertising SDK. Optional reminders can be disabled in the app or Android settings. Push notifications are optional: if you allow them, the app gets a device token from Google Firebase Cloud Messaging and sends it to Ironvale so the server can alert you to game events. A push carries only the notification title, a short summary and where it opens, never the text of private messages. The token is removed when you sign out or delete your account, and Settings lets you choose which kinds you get and set quiet hours. To keep play fair, the app asks Google Play to check that it is the genuine Ironvale app installed from Google Play and that the phone passes Google’s security checks (Play Integrity). Google sends a signed verdict to Ironvale’s server, which keeps it with your session for up to 30 days (pass or fail, the app and device results and the app version) and uses it only to stop modified apps, bots and tampered phones; Google handles the check under its own privacy policy. While the game is open it may keep a short connection to Ironvale to hear about changes sooner; this uses your existing sign-in and stores nothing new. If daily rewards are running, the app also sends your phone's time zone (for example Europe/London) so your day starts at your own midnight. It is kept with your account, can change once a week, each change is kept in your security history for up to 180 days, and it is removed when the account is deleted. App analytics are optional and off unless you say yes. If you agree, the app sends a random install identifier and a small fixed set of usage events: the app opening, which screen you viewed, the first use of a feature, tutorial steps, your answer to the notification prompt, checkout steps for purchases, and collecting daily rewards, contracts, badge rewards and battle pass tiers. No messages, names, contacts, location or advertising identifiers are included, and nothing is sent before you choose. You can switch it off in Settings at any time, which deletes the events already sent from that install and from your account. Raw events are kept for up to 60 days, then only daily totals. Separately, Ironvale records which days each account was active, from its own server records, to measure overall player retention.

7. Retention

Account and gameplay records remain while the account is held. You can delete your account in the app (Settings, Delete account) or on the account deletion page. Deletion happens seven days after the request unless you sign in before then. It removes your email address, password, two-factor setup, biography, profile photo, friends list and blocks, and replaces your username with an anonymous name; game records other players rely on, such as completed trades, races and messages already sent, stay under that anonymous name. Security, dispute and legally required records may remain as long as needed for those purposes. Scheduled cleanup normally retains security events for 180 days, removes chat after seven days or its channel history cap, removes read notifications older than 90 days, and removes expired sessions or sessions revoked for more than seven days. Operational logs, backups and unresolved reports have separate retention needs; contact Stratal for details of records held about you.

8. Hosting and transfers

The service relies on its configured hosting and email providers. Contact Stratal for the providers and locations relevant to your account. Where a provider processes personal data outside the UK, Stratal must use the applicable lawful transfer safeguards. This notice does not imply that every provider or backup is located in the UK.

9. Your choices and rights

You can edit your biography and profile photo, control online visibility and messaging preferences, revoke other sessions in Security, and delete your account in Settings or on the account deletion page. Depending on the circumstances, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Email sales@stratal.co.uk from your registered address; we may verify your identity. Requests are handled within the applicable legal time limits, and we explain any lawful reason for a refusal.

10. Children, complaints and changes

Ironvale is for players aged 16 or older. Contact Stratal if you believe a younger child has an account. You can raise a concern with Stratal and complain to the UK's Information Commissioner's Office at ico.org.uk/make-a-complaint. This notice is dated 10 October 2026. Material changes will be communicated through the service and an updated notice.

Google Play purchases

Google Play handles payment. Ironvale stores product identifiers, encrypted purchase tokens, purchased packages, subscription reward periods and refund records to verify, deliver and restore rewards. Obfuscated player and checkout identifiers are supplied to Google Play to link a purchase to the correct game account. Payment card details are not sent to the Ironvale game backend.

Purchased profile pictures are saved in your collection. A paid Custom Photo Studio unlock permits custom uploads and saved photo selection. Uploaded photos are processed into PNG files with metadata removed and displayed publicly.

Contact Stratal

ICO: make a complaint