Privacy Policy

pocketmmo.app/ppLast updated: 25 September 2026

This Privacy Policy explains which personal data we process when you play PocketMMO, what we use it for and what rights you have.

In short

We only process data we need to run, secure and improve the Game.
No ads in the Game and no selling of your data.
To measure which ads bring new players to us, we use analytics and attribution services – only with your consent where the law requires it (for example in the EU).
We never see payment details – only the app store processes them.
You can delete your account in the Game at any time.

1Controller

Ali Tas, Seitenstettengasse 5/37, 1010 Vienna, Austria
Email: support@mmo-forge.com

We have not appointed a data protection officer, as there is no legal obligation to do so. For any questions about data protection, contact us at the email address above.

2What data we process and why

2.1 Account and login

Data: Player ID (account identifier) and login times. If you link your account: your email address and password. The password is stored only in encrypted form by the login service; we do not know it.
Purpose: Providing your account, login, continuing to play on other devices
Legal basis: Performance of contract (Art. 6(1)(b) GDPR)

2.2 Game data

Data: Character name, class, appearance, level and progress, inventory and equipment, currencies, professions and quests, guild and party membership, friend and block lists, trades and marketplace activity, rankings, and settings such as language and notifications
Purpose: Providing the Game
Legal basis: Performance of contract (Art. 6(1)(b) GDPR)

2.3 Communication

Data: Chat messages, forum posts, reports and support requests
Purpose: Providing communication features, handling reports and requests, enforcing the Terms of Service and protecting players from spam, fraud and harassment
Legal basis: Performance of contract and our legitimate interest in a safe, fair community (Art. 6(1)(b) and (f) GDPR)

2.4 Purchases

Data: Product purchased, price, time, transaction or order number and the app store’s proof of purchase. We do not receive payment details such as card or bank details.
Purpose: Verifying and crediting purchases, preventing fraud, accounting
Legal basis: Performance of contract, statutory retention obligations and our legitimate interest in preventing fraud (Art. 6(1)(b), (c) and (f) GDPR)

2.5 Device and connection data

Data: IP address, device and installation identifiers, device model, operating system and version, app version, language setting, times of connections and game sessions, and the push token
Purpose: Connecting to the game server, stability, security and detecting fraud, cheats, bots and multiple accounts
Legal basis: Performance of contract and our legitimate interest in safe, fair operation of the Game (Art. 6(1)(b) and (f) GDPR)

2.6 Game activity

Data: How you use the Game, for example play times, progress and events such as loot, trades or purchases
Purpose: Operating, balancing and developing the Game, statistics and detecting abuse
Legal basis: Our legitimate interest in a balanced, stable game (Art. 6(1)(f) GDPR)

2.7 Crash and error reports (apps only)

Data: Time and technical trace of a crash, device model, operating system, app version, installation identifier and player ID, collected with Firebase Crashlytics
Purpose: Finding and fixing bugs
Legal basis: Our legitimate interest in a stable game (Art. 6(1)(f) GDPR)

2.8 Push notifications

Data: Your device’s push token (Firebase Cloud Messaging)
Purpose: Notifications about in-game events – only if you allow them on your device
Legal basis: Consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your device settings or in the Game.

2.9 Analytics (Google Analytics for Firebase)

Data: App instance identifier, on Android the advertising ID (unless you have disabled it on your device), in-game events such as completing the tutorial, levelling up or purchases with amount and currency, install source, device model, operating system, app version and approximate location (country and region, derived from the IP address)
Purpose: Understanding how the Game is used, improving it and measuring the success of our advertising campaigns
Legal basis: Consent where required by law (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time in the Game under Settings → Privacy.

2.10 Install attribution (Tenjin)

Data: Advertising ID (on Android; on iOS only with your permission), IP address, device and installation data, install source (for example the ad campaign through which you found the Game), player ID, selected in-game events and purchases (product, price, currency and proof of purchase)
Purpose: Determining which ad led to an install or purchase, and billing and optimising our advertising campaigns
Legal basis: Consent where required by law (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time in the Game under Settings → Privacy.

Whether you must provide data: The Game cannot work without the data in 2.1, 2.2 and 2.5. Everything else is optional, such as linking your account, push notifications, analytics and attribution.

Source: The data comes from you, from your device or – for purchases – from the respective app store.

3What other players can see

Your character name, class, level, appearance and equipment, guild, ranking positions, online status, messages in public chat channels, forum posts and marketplace offers are visible to other players. Private messages are seen by their recipient, and guild and party messages by the members.

4Automated analysis

To detect fraud, cheats, bots and spam, we also analyse game activity, connection data and content automatically. No system makes a decision that has legal effects on you or similarly significantly affects you (Art. 22 GDPR). We only suspend accounts after a manual review.

5Recipients

Google (Google Cloud and Firebase) – server hosting, database, login, push notifications, crash reports, logging and analysis, as our processor. Our contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA.
Tenjin, Inc., USA – install attribution (see 2.10), as our processor.
Advertising networks we use to advertise PocketMMO (for example Google, Meta, Reddit, Apple): they learn – only with your consent where required – whether an install or purchase came from their ads. They are independently responsible for this.
Other technical service providers that support us with operations and security and with detecting abuse and spam – as processors, acting strictly on our instructions.
App stores – Google Play (Google Ireland Limited) and the Apple App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) as independent controllers for downloads, purchases, payment and ratings. Their privacy policies apply.
Other players to the extent described in section 3.
Authorities and courts where we are legally required, and legal advisers where needed to establish or defend legal claims.

We do not sell your data or share it for advertising purposes.

6Transfers to third countries

Our game servers and databases are located in the USA, and some service providers also process data there. Transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (for certified recipients) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We will provide a copy of these safeguards on request.

7How long we keep data

We keep personal data only for as long as needed for the purposes described:

Account and game data: for as long as your account exists.
Purchase data: up to seven years where tax retention obligations apply (Section 132 of the Austrian Federal Fiscal Code, BAO).
Support requests and reports: until resolved and afterwards for as long as needed for follow-up questions or evidence.
Data for security, preventing abuse and fraud, defending legal claims and improving the Game: for as long as needed for these purposes.
Crash reports: deleted automatically by Google after a limited period.
Analytics and attribution data: deleted by the respective services when their retention periods expire.

8Deleting your account

You can delete your account in the Game at any time (Settings → Account → “Delete account…”) or request deletion by email. All steps are at pocketmmo.app/delete. We then delete your account and the game data linked to it, except data we must keep by law or still need for legitimate interests (see section 7). Uninstalling the app does not delete your account.

9Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, write to support@mmo-forge.com. We reply within one month. So that we can match your request to your account, please include your player ID (in the Game under Settings → Account → “Copy player ID”). We may ask you to verify that the account is yours.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the supervisory authority in your EU country.

10Children

PocketMMO is for players aged 13 and over. We do not knowingly process data of children under 13. If you are a parent and find that your child under 13 is using the Game, please contact us and we will delete the account promptly.

11Data security

The connection between the Game and our server is encrypted (TLS). Only we have access to our servers and databases; we keep permissions as narrow as possible and make regular backups.

12Storage on your device and in your browser

The Game stores what is technically necessary for it to work on your device or in your browser, such as your login status, settings and cached game data (Section 165(3) of the Austrian Telecommunications Act 2021). We only use identifiers for analytics and attribution (see 2.9 and 2.10) with your consent where it is required. You can change your choice at any time in the Game under Settings → Privacy. Our web pages at pocketmmo.app do not set cookies.

13Changes

We update this Privacy Policy when the Game or the law changes. The current version is always available on this page. We will inform you of material changes in the Game.