Battle Arena Worlds Privacy Policy

Effective 25 October 2026

Battle Arena Worlds is a multiplayer battle royale game for Android, published by ST Projects ("we", "us"), an independent developer based in the United States. This policy explains what information the game collects, why, and what happens to it. It applies to the Android app published under the package name com.stprojects.battlearenaworlds.

In short: you don't need to sign up or log in. Once you accept the Terms of Service and this Privacy Policy, the game signs you in to Epic Online Services in the background with an anonymous player account that is tied to your phone, not to your name or email. If you choose, you can sign in with Google so the account survives a reinstall or a new phone. That account is used for online matches and for your shop wallet (coins, gems and the cosmetics you own), which we keep on our server. Purchases go through Google Play. The game has no ads, no chat, no voice, and no analytics or crash-reporting services of our own, and it cannot access your location, contacts, photos, camera, microphone or files.

Your player account (Epic Online Services)

Online features use Epic Online Services (EOS), provided by Epic Games. The game never asks you for an Epic account, an email address or a password. Instead, once you have accepted the Terms of Service and this Privacy Policy, it signs in with an anonymous device ID:

• On the first sign-in, the Epic SDK in the game creates a device ID for this install and keeps it in the app's storage on your phone. When it does, it sends Epic your phone's make and model, which Epic uses for diagnostics.
• Epic then gives the game a player ID (Epic calls it a ProductUserId): a random 32-character code that identifies your account in this game. It is not linked to any Epic account or email address, and it is linked to a Google account only if you choose to sign in with Google (see below).
• The game makes up a player name for you, "Player" followed by four random digits (for example Player4821), and sends it to Epic with the sign-in. You can't change it, and it never contains your real name.

Epic processes this information to provide the sign-in, matchmaking and connections between players, under the Epic Games Privacy Policy.

Optional Google sign-in

On the game's Settings tab you can tap Sign in with Google. It is optional: the game, online matches and the shop all work without it. Its only purpose is to keep your player account, and so your wallet, if you reinstall the game, clear its data or move to a new phone.

• Android shows Google's sign-in sheet. The first time, Google tells you it will share your name, email address and profile picture with the app. Google then gives the game a signed Google ID token.
• The game sends that token only to Epic. Epic checks it and links your Google account's ID to your player ID. The game does not read or keep your name, email address or picture, and our server never receives the token or any of your Google account details.
• After a reinstall or on a new phone, signing in with the same Google account brings back the same player ID and wallet. If the phone already has progress under another player ID, the game asks which progress to keep. Epic deletes the player ID you don't keep; its wallet stays on our server, where nobody can sign in to it, until you ask us to delete it.
• The game keeps a small file on your phone recording which player ID your Google account is linked to.
• Sign out keeps the Google link and returns the phone to a new, empty guest account. Signing in again brings your account back.

The Settings tab also shows your player code: the first 12 characters of your player ID, which you can copy and quote when you contact us.

Online matches

When you tap to play online, the game looks for a room (an EOS lobby) of up to 10 players. While you are in a room, the game publishes these details for the other players' games to read:

• Your player ID and player name, and the hero you picked.
• Technical details used to choose which player's phone hosts the match: how much memory your phone has, its graphics performance level, whether it is on Wi-Fi or mobile data, whether battery saver is on, and your ping times to the other players.
• The game's version, and the state of your connection to the match.

One player's phone hosts each online match, and the other phones connect to it through Epic's peer-to-peer service. When a direct connection is possible, the phones in a match exchange network traffic directly, so each one can see the others' IP addresses. Otherwise the traffic goes through Epic's relay servers. During the match, the host's game receives your moves, your hero, the cosmetics you are wearing and your match results, and passes copies of the match state to other players' phones so the match can carry on if the host leaves. Other players see your player name in the elimination feed and on the results.

The game has no text chat and no voice chat, and it has no friends list, invites or presence.

Your shop wallet (our server)

The shop sells cosmetics only. To stop balances being edited on the phone, your wallet is kept on our server and is filed under your player ID. Once you are signed in to Epic, the game sends our server the sign-in token Epic issued for you, which proves your player ID, and our server gives the game a session that lasts 30 days. Our server stores:

At the end of each match, the match host's game (or your own game, in a solo match) reports to our server each player's player ID, placement, number of eliminations and time alive, with the match ID, the match length and the date. Our server works out the coins from that report, with daily limits, and adds them to each player's wallet.

Our server does not store your player name, your email address, your phone model or your Epic sign-in token.

Purchases (Google Play Billing)

Gems and the starter pack are bought through Google Play Billing. You pay Google, and Google's payment terms and the Google Privacy Policy apply to the payment. We never see or store your card number, bank details, billing address or Google account email. The game also asks Google Play which country your Play account is in; the answer stays on your phone and is not sent to us.

When you start a purchase, the game gives Google Play a one-way (MD5) hash of your player ID as the order's account tag (Google's "obfuscated account ID"). After you pay, the game sends the product and Google Play's purchase token to our server. The server asks Google Play to confirm the purchase is genuine, has not been used before and has not been refunded, and only then adds the gems to your wallet. We keep a record of each purchase so we can confirm purchases, prevent fraud, handle refunds and meet tax and legal obligations:

• The product, the Google Play order number, the purchase time, whether it was a test purchase, and its status (for example refunded, with the date and reason Google gives).
• Your player ID, and the account tag Google Play reports for the order (the hash of your player ID).

The record is filed under a one-way hash (SHA-256) of the purchase token. The token itself is not kept. Google also tells our server when a purchase is made, refunded or cancelled, and our server asks Google for a list of refunded purchases several times a day. Our server keeps a log of those notices, filed under the same hash and the order number.

Age and spending limit. Real-money purchases are for players 18 or older. Before your first real-money purchase the game asks whether you are 18 or older. If you answer that you are under 18, real-money purchases are turned off on that phone (coins still work). Your answer is kept on your phone only. Real-money purchases are also limited to US$200 per calendar month (UTC). The game checks the limit on your phone, and our server checks it for your account, counting each purchase at its US list price, before the Google Play purchase screen opens.

The shop has no loot boxes or random paid items.

Information stored on your phone

The game saves the following in the app's own storage on your phone:

• Settings: the hero you picked, control sensitivity, auto-fire and tap-to-build, the number of bots, sound volumes and graphics quality, and the graphics level the game has learned suits your phone.
• Your level, experience points and your last placement and eliminations.
• Your generated player name, and the Epic device ID (kept by the Epic SDK). If you signed in with Google, which player ID your Google account is linked to.
• A copy of your wallet as our server last sent it, so the shop works offline; match results and purchases waiting to be sent to our server; your answer to the age question; and this month's spending total.
• A random ID for this install, used only by the shop on the phone before Epic sign-in completes. It is never sent to our server.
• Your acceptance of the Terms of Service and this Privacy Policy: the effective dates of the versions you accepted and when you accepted them. It stays on your phone and is never sent to our server.
• While you are in an online match, a short note of the room and match (so the game can rejoin if it closes). It is deleted when the match ends.
• One small performance file per session (the game's frame rate and graphics settings), kept on your phone and never uploaded.

The app turns off Android's backup and device transfer, so Android does not copy this data to your Google account's backup or to a new phone. Your wallet is kept on our server: to keep it when you move to a new phone, sign in with Google first.

Permissions

The game never asks you for a permission. Its Android manifest declares only permissions that Android grants without asking:

• Internet access, and viewing network and Wi-Fi state (for online play, and to know whether you are on Wi-Fi or mobile data).
• Google Play Billing, and Google Play's license check.
• Vibration, keeping the phone awake, and changing audio settings (used by the game engine).
• Foreground service (data sync), and starting after the phone restarts: used by the libraries that download and set up the game's data from Google Play, and by Android's background-task library.
• One permission of the app's own, which only the app itself holds, used by Android libraries inside it.

The game does not request location, contacts, camera, microphone, photos or storage permissions, and it cannot access them. The optional Google sign-in uses Android's Credential Manager and Google's sign-in library, and only runs when you tap Sign in with Google (or, once you have signed in, to check the link when needed). The app package also includes Google Play services libraries that the game engine adds by default: the older Google Sign-In library and Play Games Services (which initialise themselves when the app starts; we have not set up a Play Games game, so no Play Games sign-in or profile is created), and location, Drive and FIDO libraries that nothing in the game calls. Without the matching permissions the location library cannot access your location.

Ads, analytics and crash reports

Battle Arena Worlds shows no ads and contains no advertising SDK. It contains no analytics or crash-reporting services of our own, and it does not track you across other apps or websites.

Information shared with third parties

Epic Games (Epic Online Services) provides the anonymous sign-in, rooms and connections between players, and receives the information described under "Your player account" and "Online matches". If you sign in with Google, Epic also receives your Google ID token and keeps the link between your Google account and your player ID. Epic Games Privacy Policy.

Google provides the optional Google sign-in, so if you use it, Google knows you signed in to Battle Arena Worlds. Google Play handles payments and receives the hashed account tag on your orders. Our server contacts Google Play to verify purchases. Google Privacy Policy.

Google Cloud hosts our server and database. Google processes this data on our behalf. Google Cloud Privacy Notice.

Other players in your online matches see your player name, your hero and the cosmetics you wear, and their phones receive the match details described under "Online matches".

We do not sell your information, and we do not share it with anyone else, except where the law requires it.

Where your information is stored

Our server runs on Google Cloud in us-central1 (United States). The game is offered through Google Play in many countries. Wherever you use it, the information described under "Your shop wallet" and "Purchases" is sent to our server in the United States, where data protection laws may differ from those where you are. Epic processes the information it receives as described in its privacy policy.

How your information is protected

All communication between the app and our server is encrypted in transit (HTTPS). Our server opens a session for a player ID only with a sign-in token signed by Epic, and its sessions are tied to this app and your player ID and expire after 30 days. It limits how many requests it accepts, to prevent abuse.

Our server's logs record the time, the type of request and its result, how long it took, and the IP address it came from. Google Cloud's request logs also record the full request address and your device's user agent (which can include the app and Android version). Some log lines include the first 12 characters of your player ID, the product, the Google Play order number, the items you buy with coins or gems, the coins credited after a match, or the first 12 characters of the purchase token's hash. The logs never contain your full player ID, your sign-in or session tokens, or purchase tokens. We use them for security, to limit abuse and to fix problems. Google Cloud keeps them for about 30 days by default.

How long we keep it

• On your phone: until you clear the app's data or uninstall the app. The rejoin note is deleted when each match ends.
• Your wallet, and the records of matches and purchases already credited to you: as long as your account exists, until you delete them in the game or ask us to by email. There is currently no automatic deletion of inactive wallets. If we introduce one, we will say so here. At most 2 earlier versions of your wallet are kept, at least an hour apart.
• Purchase and order records: kept for 7 years after the purchase, for tax, refunds and fraud prevention. A daily clean-up job then deletes each record, with its order record and its refund or cancellation notices.
• Server logs: about 30 days by default, then deleted automatically by Google Cloud.
• Database backups: we also keep encrypted copies of our whole database on Google Cloud: a point-in-time recovery history of the last 7 days, daily backups kept for 7 days and weekly backups kept for 14 weeks. We use them only to recover from data loss or to restore a player's wallet at their request. Backups can't be edited, so data you delete (including your player ID removed from purchase records) stays in them until they expire: up to 14 weeks after you delete it.
• Epic Online Services: kept by Epic under its privacy policy. The Google link is kept until you delete your data in the game.

Deleting your data

In the game: on the Settings tab, under Account, tap Delete my data and confirm twice (you need an internet connection). It deletes straight away:

• on our server: your wallet (coins, gems, owned and equipped cosmetics, spending total) and the records of matches and purchases credited to you. Your player ID and Google Play's account tag are removed from your purchase records, which are kept without them for tax, refunds and fraud prevention (see "How long we keep it"). Your session is ended. A purchase that was already credited can't be credited again;
• at Epic: the link to your Google account, if you made one, and the device ID, so nobody can sign in to that player ID again;
• on your phone: the shop files (the copy of your wallet, purchases waiting to be sent, your answer to the age question and this month's spending total), the record of your Google sign-in and the rejoin note.

The earlier versions of your wallet are deleted with it. Deleted data is removed from our live database straight away, but it can remain in our encrypted database backups until they expire: up to 14 weeks. We never use them to bring back a deleted wallet.

The game then starts a new, empty player account. If you play again, you start with an empty wallet. Deleted coins, gems and cosmetics cannot be restored. If you uninstalled the game but had signed in with Google, you can reinstall it, sign in with the same Google account and delete from there.

By email: if you can't use the game, email battlearenaunlimited@gmail.com, say it is about Battle Arena Worlds, and include your player code (Settings > Account) or the order number (it starts with GPA.) from the Google Play receipt of any gem or starter pack purchase. We will reply within 30 days, and we will confirm when your data has been deleted. When we delete it by email, your phone still holds the same player ID, so the game will open a new, empty wallet under it the next time it starts. To stop that, clear the game's data or uninstall it. If you have never bought anything and no longer have the game, your wallet holds no name, email or contact details and we have no way to identify it.

Google Play keeps its own copy of the hashed account tag on each order, and we cannot remove it. The rest of the record Epic holds for your player ID (the player name and the phone model) is kept by Epic under its own privacy policy. The full steps are on the data deletion page.

Your rights

If you are in the EEA, the UK or Switzerland, data protection law (GDPR or UK GDPR) gives you the right to access the personal data we hold about you, correct it, have it deleted, restrict or object to how we use it, and receive a copy of it. You can also complain to your local data protection authority. We use your information to provide the game, online matches and the shop you use, for our legitimate interests in preventing fraud and cheating and keeping the service secure, and to meet legal obligations such as keeping tax records.

If you are in California or another US state with a privacy law, you have the right to know what personal information we collect, to have it deleted or corrected, and to opt out of its sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will not treat you differently for using these rights.

You can delete your data yourself in the game (see "Deleting your data"). To use any of these rights, email us at the address below with your player code (Settings > Account) or your Google Play order number. We will reply within 30 days.

Children

Battle Arena Worlds is a combat game that is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has used the game, contact us at the address below and we will delete the data we can find.

Changes to this policy

If this policy changes, the updated version will be published at this address with a new effective date. If the change is significant, we will also mention it in the app or its store listing. Whenever the effective date of this policy or the Terms of Service changes, the game asks you to accept them again, and until you do, it does not sign in to Epic, contact our server or use Google Play Billing.

Contact

battlearenaunlimited@gmail.com

Data safety summary

This table summarises the data the app handles, in the terms used by Google Play's Data safety section. "Collected" includes data processed for us by Epic and Google Cloud as our service providers.

All of this data is encrypted in transit. You can delete your data in the game (Settings > Delete my data) or ask us by email, as described under "Deleting your data". Purchase records are then kept until 7 years after each purchase, without your player ID.