Privacy Policy
Effective Date: May 11, 2026
This Privacy Policy describes the ways we collect personal data about you and why we do so, how we use your personal data, and the choices you have about your personal data.
This Privacy Policy applies to First Flame Studio's games, websites, and related services (the "Service"). We may update this Privacy Policy from time to time. If we make material changes, we will notify you as required by applicable law before the change takes effect.
This notice applies to all our Services, unless a separate notice is supplied with a particular game or other Service. Where a separate notice is supplied, that notice applies instead. In addition, our Services may link to or otherwise allow you to navigate to properties controlled by third parties. Please consider that this Privacy Policy does not apply to properties controlled by third parties and that the operators of those properties may collect and use your data following their own policies.
It is important that you read this Privacy Policy before accessing or using the Services so that you are aware of how and why we may use data relating to you. In addition to this Privacy Policy, we encourage you to carefully review our Terms of Service, which govern your use of our Services.
1. Who we are
By "data controller", we mean an entity that determines how and why personal data is processed. With regard to the activities described in this Privacy Policy, we are the data controller. Our company name is First Flame Studio (Business-ID 3614969-1), with registered address at Itämerenkatu 23, 00180 Helsinki.
While operating the Services, we may share your data with partners we work with. Some of these partners are data controllers independently of us and, therefore, independently determine how and why they process your data. For more information on these partners and the ways in which they may process your data, please refer to section 5 of this Privacy Policy.
2. Data we collect
The categories of personal data we collect depend on the Services you use and the requirements of applicable law.
Data you provide to us directly:
- Contact information (e.g., email address), player name or tag and password, and profile information (e.g., profile photo).
- Your messages and other content submitted through the Service, including chat logs and player support tickets.
- Information provided in connection with surveys, promotions, competitions, and other events.
- Other data you choose to share with us (e.g., voice chat audio where the feature is available).
Data we collect automatically:
- Account and game progress data, including an automatically created internal account ID; your IP address and device identifiers (such as advertising ID); and device information (name, operating system, browser type, language, carrier).
- Data collected via cookies and similar technologies; approximate location derived from IP address.
- Gameplay data, including actions taken, and your interactions with other players.
Data we receive from partners:
- Data from third-party platforms or tools you link to the Service; demographic and coarse location data; fraud-detection signals; payment verification data; advertising and analytics data; and feedback posted on third-party sites.
Partner data is provided in accordance with your choices with those partners and their own privacy policies. Each partner is responsible for obtaining required permissions. You can manage partner sharing through their settings.
3. Lawful bases for processing
We rely on the following legal bases:
| Basis | When we rely on it |
|---|---|
| Contract (Art. 6(1)(b) GDPR) | Provision of the Service: Creating and operating your account, delivering virtual items, sending communications. |
| Legitimate Interest (Art. 6(1)(f) GDPR) | Improving the Service, personalizing gameplay, detecting fraud and cheating, showing relevant offers and ads. |
| Consent (Art. 6(1)(a) GDPR) | Personalized and behavioral advertising, re-engagement campaigns, and any other processing where consent is required. Data is shared with ad partners with your consent so they can deliver the right ad and avoid showing you the same ad repeatedly. You can manage your consent in the game settings or limit ad tracking in your device settings. |
In jurisdictions where we cannot rely on legitimate interest, we will use a lawful basis that is appropriate under applicable law, such as consent.
4. Why we use your data
To operate the Service (contract):
We process data necessary to create accounts and enable gameplay, operate the Service, provide products and services you request, and send service-related communications.
To improve the Service (legitimate interest):
We process data to update and develop player profiles, improve the Service and player experience, manage our relationship with you, provide social features, customize your experience, respond to your questions and provide player support, and send updates and security alerts.
To show personalized advertisements (legitimate interest / consent):
We track the content you access in connection with the Service and your online behavior to deliver, target, and improve our advertising.
To keep the Service safe and fair (legitimate interest):
We analyze and monitor use of the Service and its social features, moderate chat automatically or manually, and take action against fraudulent or misbehaving players. This includes active anti-cheat monitoring, enforcement against exploit use, and security incident response.
5. Who can see your data
Other players.
Social features are a core component of our games. Other players may see your profile data and in-game activities.
Our service providers.
We use vendors to provide the Service, including for hosting, player support, advertising, analytics, and fraud prevention. These vendors process your data only on our instructions.
Advertising and social media partners.
The Service includes features from partners via APIs and SDKs, including in-game advertising. These partners may access data about your activities and device (including IP address, mobile identifiers, pages visited, and time of day) and operate under their own privacy policies. You can manage your choices in the game settings or limit ad tracking in your device settings.
Between joint controllers.
As joint controllers, we share certain data with each other to operate the Service, provide cross-game features, and coordinate security and fraud prevention. This sharing is governed by our joint controller agreement. The following entities are joint data controllers under applicable data protection law, including the EU General Data Protection Regulation (GDPR, Article 26), for the personal data processed in connection with your use of the Service: First Flame Studio (Business-ID 3614969-1), with registered address at Itämerenkatu 23, 00180 Helsinki and Supercell Oy (business ID 2336509-6), Jätkäsaarenlaituri 1, 00180 Helsinki, Finland.
What "joint controllers" means for you.
The data controllers have agreed on how they share data protection responsibilities (summarized below). This doesn't affect your rights as data subject, and you can contact either of the controllers. The essence of the joint controller arrangement is available to you on request. See Section 12 for contact details.
| Processing Activity | Primarily Responsible Controller |
|---|---|
| Operating the Service. This includes account creation/management, player support and gameplay delivery. | First Flame Studio |
| Improving the Service. This includes analytics, A/B testing, debugging, game balancing, feature development. | Both jointly |
| Personalized advertising. This includes delivering, improving and targeting advertising. | Both jointly |
| Safety, anti-cheat and fraud prevention. This includes cheat detection, bot detection, account integrity, ban/enforcement actions, moderation. | Both jointly |
Legal authorities and other companies.
To combat fraud, we may share data with public authorities in response to lawful requests. We may also disclose data based on your consent, to comply with law, or to protect rights, property, or safety.
6. Your rights
You have the right to correct your data, have your data deleted, object to how we use or share your data, and restrict how we use or share your data. You can always withdraw your consent.
In summary:
| Right | What it Means |
|---|---|
| Access | Request a copy of your personal data in electronic format. |
| Rectification | Correct inaccurate or incomplete data. |
| Erasure | Request deletion of your data, subject to legal exceptions. |
| Portability | Receive your data in a structured, machine-readable format. |
| Objection | Object to processing based on legitimate interest. |
| Restriction | Ask us to limit how we process your data. |
| Consent Withdrawal | Withdraw consent at any time without affecting prior processing. |
You have the right not to receive discriminatory treatment as a result of exercising these rights.
To exercise your rights, please contact us using the details in Section 12. We will respond in accordance with applicable law and may verify your identity before fulfilling requests. You may also designate an authorized agent where permitted by law.
Coordinated Rights Handling.
Because of joint controllership, a request submitted to either of the controllers will be handled in coordination. Where the request involves data held by the other controller, we will forward or collaborate to ensure a complete response.
If you have an unresolved concern, you may contact your local data protection authority within the European Economic Area, Switzerland, or UK.
7. Data retention
We retain your data for as long as your account is active or as needed to provide the Service. We periodically de-identify inactive accounts and regularly review data for necessity. If you ask us to remove your personal data, we will retain only what is necessary for our legitimate business interests, such as complying with legal obligations, resolving disputes, and enforcing our agreements.
8. Security measures
We continuously develop and implement administrative, technical, and physical security measures to protect your data from unauthorized access, loss, misuse, or alteration. No system is perfectly secure. Please also take steps to protect your account credentials.
We may use automation in connection with player support services. Where automation is used, we will inform you and you may request manual processing.
9. International transfers
Our Service is global by nature and your data may be transferred outside your jurisdiction. We take steps to ensure adequate safeguards are in place, including EU Commission-approved Standard Contractual Clauses and other lawful transfer mechanisms.
10. Children's privacy
Protecting children's privacy online is important to us. Generally, our Services are not directed to children under 16 (or other age as required by local law), and the Services do not knowingly collect personal data from children.
Where a player indicates they are under 16, we restrict data processing to what is strictly necessary for internal service operation.
If you are a parent or guardian and wish to review, modify, or delete your child's personal data, please contact us using the details in Section 12. If we become aware that a child has provided data contrary to the above, we will delete that data and take appropriate action, including reverting to the underage experience.
11. Policy updates
We may periodically update this Privacy Policy. If we make material changes, we will notify you as required by applicable law before the change becomes effective. Your continued use of the Service after the effective date will be subject to the updated Privacy Policy.
12. Contact us
If you have questions about data protection or any requests relating to your personal data, we encourage you to contact either joint controller directly via email at legal@firstflamestudio.com.
Either controller can be contacted for the exercise of data subject rights. We will coordinate to provide a complete response.