- We keep only what the game needs to run your account and keep your progress safe on our server.
- No ads, no analytics or tracking SDKs. We never sell your data or share it for advertising.
- On phones you can buy Dream Stones and avatar frames. The App Store or Google Play takes the payment; we never see your card or bank details, only a record of what was bought.
- Other players see your display name, your chosen avatar and frame, and what you write in the chat. They never see your email.
- You can delete your account and everything in it from inside the game, at any time: here is how.
Who we are
War of Dreams is a game made by ironsalvo, an independent developer. This policy covers the game on
Windows, Android and iOS, the server it plays on, and this website (warofdreams.com, also
reachable as warofdreams.ironsalvo.com and worldapart.ironsalvo.com, the game's earlier addresses).
Questions, requests and complaints: [email protected].
What we collect, and why
War of Dreams is played online: your heroes, progress and fights live on our server, not on your device, so that progress cannot be lost with a phone and cannot be cheated. That is the reason for almost everything below.
Your account
The first time the game starts, our server makes a guest account for you. It holds:
- a random account number;
- your display name: a made-up one such as “Wanderer4821” until you choose your own;
- when the account was made and when it was last used;
- only if you choose Keep my progress: your email address and a password. The email is your login, so you can sign in on another device. We never store the password itself, only a salted one-way hash of it (PBKDF2). We do not send you email and never use your address for marketing;
- security records: how many wrong passwords were tried in a row, a short lock after five of them, and a ban if one is ever placed on the account.
Your devices
Each time a device signs in, the server gives it a sign-in token and keeps a record of it: a hash of the token (never the token itself), the device's model name as the operating system reports it, with its platform (for example “Xiaomi 25028RN03A (Android)”), when it signed in, when it was last used, and when the token expires (a year after its last use). We use this to keep the device signed in and to sign devices out when needed, for example after a password change.
Your game progress
The heroes you own, their levels and experience; your banner parts and their upgrades; your campaign and dungeon progress; your Dream Stones and gold; your arena team, rating and win/loss record; and your Endless Dream scores. The server decides all of it and keeps it so you can play on.
Purchases
On Android and iOS the game sells Dream Stones and avatar frames for real money. The payment itself is made to Apple (App Store) or Google (Google Play) under their terms and privacy policies; we never receive your card, bank or billing details, or your Apple or Google account. When you buy, the game sends us the store's receipt and our server asks Apple or Google whether the purchase is real before giving you what you bought. For each purchase we keep: the store's transaction number, what was bought, when, whether it was a test purchase, and which account received it. If a purchase is refunded, the store tells us and we mark it refunded. RESTORE PURCHASES sends us the receipts your store account already holds, so frames you bought come back after reinstalling the game.
Chat, friends and guilds
The game has a world chat, guild chats and private messages between players. We keep what you write, who wrote it and when, so the people it was written to can read it: world chat lines for 7 days, guild chat for 30 days and private messages for 180 days, then they are deleted. Offensive words are masked when a line is kept. We also keep your friends list, the players you have blocked, which chats you have read, your guild and its membership, and the message setting you choose (messages from anyone, or from friends and guildmates only).
You can block a player (neither of you can then message the other, and you no longer see their lines), and report a line or a player. A report keeps a copy of the line or of the player's last lines in the world chat, with the name of who reported it, so we can review it even after the line is deleted. We may take a line down, mute a player in the chat or ban an account that breaks the rules.
Fight records
For every finished fight (arena, practice, campaign and dungeon): the account numbers of the two sides, the heroes each fielded, who won and why, how many turns it took, the rating change, the fight's random seed, and when it started and ended. We use these to balance heroes, find bugs and settle disputes about a result.
Server logs
The server keeps a log for running it and keeping it secure. It does not record every request. It does record:
- downloads of the game from this website (the Windows game, its installer and the Android APK), with the IP address they were downloaded from;
- some game events, with your display name, your account number or both: for example an arena match starting, a summon at the Well of Dreams, parts sold, or an Endless Dream prize given;
- errors and unusually slow requests: the address that was asked for and what went wrong, without your IP address.
Your IP address is also used, only in memory and never stored with your account, to limit how quickly sign-in attempts and new guest accounts can be made from one address.
On your device
The game keeps only its sign-in token and your settings (language, sound, graphics quality, fight speed and the like) on your device. Of these, only the token is ever sent to us, to sign you in. On Android and iOS, uninstalling the game removes them.
Crash reports
The game is made with the Unity engine. When the game crashes, Unity's engine diagnostics may send a technical crash report (the device model, operating system and what failed in the game's code) to Unity Technologies, which shows it to us so we can fix the crash. It carries no account, display name or email. Unity handles it under its own privacy policy.
What we do not collect
No location, contacts, photos, camera or microphone, no advertising ID, and no payment details (Apple and Google handle payments). The game has no advertising, no analytics and no tracking SDKs, and this website has no analytics and sets no cookies of its own.
Bug reports and wishes
When you send a report on our Bugs & wishes page, we keep what you wrote, the photos and videos you attached, the name and contact you chose to give, your platform and game version, and your internet address and browser (to stop abuse). Only the developers see them; they are never shown to other players. Don't put anything private in a screenshot or video that you would not want us to see.
What other players see
- Everywhere your name is shown (the arena, tables, guilds, the chat) players see your display name with the avatar and frame you chose.
- The chat: lines you write in the world chat are seen by everyone in it, guild lines by your guild, private messages by the player you write to. Tapping your name shows your card (name, avatar, level, guild).
- Your arena opponent sees your display name, your arena rating and the heroes you field.
- The Endless Dream table, seen by every signed-in player, shows your display name, your best damage, how far the boss got and the team you did it with.
- The arena ladder (display name, rating, wins, losses and draws) is public: the server publishes it openly, so anyone, not only players, can read it.
Your email, devices and account number are never shown to other players. Since your display name is public, don't use your real name or anything else you would rather keep private. You can change it at any time in the game's ACCOUNT panel.
Who else handles it
- Our server is a virtual private server we rent and run ourselves. Only we administer it.
- Cloudflare carries all traffic between you and our server and protects it from attacks, so it sees your IP address and the requests you make as part of doing that.
- Google Fonts: this website's lettering is loaded from Google, which sees your IP address when your browser fetches it. The game does not do this.
- Google Play and the App Store handle the download of the game and every in-game payment under their own privacy policies. We ask them whether a purchase is real, and they tell us when one is refunded.
- Unity Technologies, for crash reports, as above.
We do not sell, rent or trade your data, and we do not share it with advertisers or data brokers. We would disclose it only if the law required us to.
How long we keep it
| What | For how long |
|---|---|
| Your account, devices and progress | Until you delete your account. We do not delete inactive accounts on our own. A device's sign-in stops working a year after it was last used. |
| Purchase records | Until you delete your account; they are deleted with it. |
| Chat lines | World chat 7 days, guild chat 30 days, private messages 180 days. Lines you wrote stay under the name you had when you wrote them, also after your account is deleted, until they reach that age. |
| Reports | Kept, with their copies of the reported lines, so a decision can be explained later. |
| Bug reports and wishes | Until the matter is closed, then deleted when no longer needed for the game's development. Ask us and we delete yours sooner. |
| Server logs | 14 days, then deleted. |
| Backups | A copy of the database is made every night and before every server update; each copy is deleted after 14 days. Backups are only for recovering from a failure. |
| Fight records | Kept for balance, also after an account is deleted. They then point at an account number that no longer exists and carry no name, email or device. |
| Our record of actions we take | If we ever act on an account (for example a ban, a correction, or deleting it because you asked us to by email), we keep a note of what we did, with the account's display name at the time, and for a deletion its email address, so we can show what was done and why. |
Deleting your account
In the game: open ACCOUNT and press DELETE ACCOUNT twice. Your account, every device sign-in and all your progress are deleted from the server at once. You can also ask us by email. Everything about deleting your account.
Your choices and rights
- Change your display name in the game at any time.
- Delete your account in the game at any time, or ask us to.
- Email us to get a copy of the data we hold about you, or to have something corrected.
If you are in the European Economic Area or the UK: we use your account and progress data because it is needed to provide the game you asked to play, and logs, security records and fight records because of our legitimate interest in keeping the game running, secure and fair. You have the right to access, correct, delete or receive a copy of your data, and to object to or restrict its use, and you may complain to your data protection authority.
Children
War of Dreams is not directed at children under 13, and we do not knowingly collect personal information from them. Playing needs no personal information at all: an email address is optional. If you believe a child under 13 has given us an email address, write to us and we will delete the account.
Security
- Passwords are stored only as salted PBKDF2 hashes.
- Only hashes of sign-in tokens are stored, so even a copy of our database could not be used to sign in as anyone.
- The game and this website talk to our server only over HTTPS.
- Five wrong passwords lock the login for a few minutes, and the number of sign-in attempts from one address is limited.
- The server's administration tools are behind their own password, and only we have access to the server.
No system is perfectly secure, but we keep what we hold small, which limits what could ever be exposed.
Changes to this policy
When what the game collects changes, we update this page and the date at its top. Significant changes are also announced in our Discord and Telegram.
Contact
ironsalvo · [email protected]