Privacy Policy

1. Who we are

World of Relics is run by Axcelsoft Information Technology Solutions, 174 Sitio Danga, Barangay Colgante, Apalit, Pampanga, Philippines ("we", "us"), which is responsible for your personal data. For any privacy question or request, email support@axcelsoft.com. Our Data Protection Officer can be reached at support@axcelsoft.com.

2. What we collect and why

From Google or Facebook when you sign in

• Google gives us your account id, your email address, whether that address is verified, your name and, if it sends one, the address of your profile picture.
• Facebook gives us your user id, your name, the address of your profile picture (or that you have none) and, if your account has one, your email address.
• We store which of the two you used, the account id, the email address if we got one, and when you first and last signed in. We use these to recognise you, to show which account you are using and to match requests you send us. The email is updated whenever you sign in and Google or Facebook sends one.
• We also give your account a random player number, which the app receives, and record your account's standing (for example whether it is restricted), which decides whether you can sign in.
• Your name only fills in the suggested display name on the Welcome screen. It is stored only if you keep it.
• Your profile picture is stored only if you tick "Use my picture", on the Welcome screen or later under More. It starts unticked. The Welcome screen shows you the picture first, loading it straight from Google's or Facebook's servers. If you tick it, we keep a copy, because the address Google or Facebook gives us for it stops working after a while. We download it again each time you sign in, and delete our copy if Facebook tells us you no longer have a picture. It is shown in your player bar and, if you are 16 or older, on the relic cards you share. A shared card is a public post, so for players aged 13 to 15 it always shows a stand-in figure instead. Unticking "Use my picture" deletes our copy at once. Your phone keeps the picture only in its memory while the app is open, apart from the images of cards you have shared.
• Everything else, such as the verified flag, is never stored. We keep no Google or Facebook access tokens, and we never receive your password, friends, posts or contacts.

What you give us

• Display name: 3 to 30 characters, the name other players will know you by. If you are 16 or older, other players see it in the Museum (with the relics you put on show and on your collector page) and in the Colosseum (when you are someone's opponent, and in battle results and battle histories). If you are 13 to 15, no other player ever sees it: you are shown to them as "Anonymous Explorer". It also appears on relic cards you choose to share. The suggestion on the Welcome screen is the name on your Google or Facebook account, which is often your real name. You can change it before you join, and we suggest a nickname. To change it later, email us (see section 8).
• Birth year: used only to check your age and set your age group (13 to 15, 16 to 17, or 18 and over). We ask only the year, so you can join from the start of the year you turn 13, and your age group is worked out from the year alone, which can put you one group older than your exact age. We keep only the age group, never the birth year.
• Your agreement: when you accepted the Terms of Service and this policy. We record when you agreed, not which version.
• Your picture choice: whether "Use my picture" is on, and since when.
• Your hero: the character you chose. It stands on your player bar and walks on your map, and other players see it as your portrait in the Colosseum (also if you are 13 to 15, since it shows nothing about you).

Game data

• The relics you own and the ones you mark as favorites.
• Each relic's ownership history: when it came to you (found at a Relics Chest, or given by our team with a short note of why) and when you salvaged it.
• A salvaged relic is destroyed in the game, but its record stays permanently, naming you as its first recipient and as the player who salvaged it.
• Relics you find. When you open a Relics Chest and it gives you a relic, we record which spot it stood at and when you opened it, plus two figures in metres: how far from the spot your phone said you were, and how accurate its GPS reading was. We do not keep the coordinates your phone sent. But a chest is a fixed place and you must be within about 30 m of it, so this record does show where you were, to within about 50 m, at that moment. The relic you receive points to that record as the proof of where it came from. We also use the spot and time of the last chest you opened to check your pace to the next one: a chest refuses if you got there faster than a person on foot could have (about 25 km/h, so from a vehicle) or within about 15 seconds of the last. This compares the two chests' positions and times, never your own position, which we still do not store.
• Gems and energy: your balance of Gems, the game's currency, and every change to it: when, how many, why, the relic it was spent on, the quest it rewarded and, for a gift from our team, a short note of why. There is nothing to buy yet: Gems come only as gifts from our team and as quest rewards. We also keep your energy, which opening a chest uses up and which refills by itself.
• Grading and polishing: for each relic you send for grading or polishing, that you sent it, when, what it cost in Gems and when it is ready. Anyone looking up the relic by its serial number can also see when it was sent for grading and when it was graded.
• Quests: for each quest, how far you have got and when you finished it. That covers the welcome gift (once), each day you open the app (its date, for the daily login and your days in a row), and, for the daily walk, how far you walked that day, in metres. These records show which days you played, not where you were. For the daily walk we store only the day's total distance, never your route or a position (see "Your location").
• The Museum: the relics you put on show and when, the players you follow, your reactions (Love, Haha, Wow) and which exhibits you have opened. Other players see your exhibits, how many followers you have, how many players you follow and how many relics you have found. They see the total reactions and views on an exhibit, never who reacted or viewed. If you are 13 to 15, your exhibits show "Anonymous Explorer" and no one can follow you.
• The Colosseum (battles): your Battle Relic, your rating (Elo), and every battle you fight, whether you attacked or were attacked while away: when, the two players and their relics, who won, how each rating changed, the wear each relic took and the battle's turn-by-turn record. Other players see your display name (if you are 16 or older), your hero, your rating, your Battle Relic and its condition when you are listed as an opponent, and your name in the results and histories of battles fought against you. Your wins, losses and highest rating are shown only to you.

Anyone with a relic's serial number can see its details, including when it was found, but not where, who owns it or who found it.

Sign-in sessions

The app keeps a random session key. Our database stores only a one-way fingerprint of it (a SHA-256 hash), plus when the session started, was last used (to about the day), expires and was ended. A session expires after 30 days without use. Signing out ends it on that phone.

Technical data

• Your location. While the World tab is open, the app uses your phone's location to show the streets around you and to ask our server which Relics Chests are near you. It sends your position when the World tab opens, as you walk (every 250 m or so), after you open a chest, when you bring the app back to the front, and otherwise about once a minute. While your daily walk is unfinished, the app sends your position every 30 seconds instead, with how accurate your phone says it is. To measure the walk, our server adds up the straight-line distance between your updates: only on foot (under about 10 km/h), only from 5:00 am to 8:00 pm, and only with a precise reading. For that it keeps the last point it counted in its memory only, for at most 90 seconds after your last update, and forgets it once the walk is done for the day or the server restarts. That point is never written to our database or logs. The server answers with the chests within about 1 km and otherwise forgets the request: it neither stores nor logs your position. When you open a chest, the app sends your position once more, with how accurate your phone says it is (and again if you tap Try again after a lost answer). It sends only a fresh, precise reading: without one, the chest stays shut and the app asks you to turn on precise location. The server checks that you are at the spot: within about 30 m, with a small allowance for GPS error, and that you have not reached it faster than a person on foot could have from the last chest you opened (see "Relics you find"). If the chest opens, we keep only the two figures described under "Relics you find"; a refused attempt is not written to our database.
• The World tab is the first screen after you sign in, so the app asks for your location as soon as you enter the world. You can say no and still use the other tabs; the map then shows a fixed area of Manila, or the last place it showed you (kept on your phone), and chests can't be opened. You can turn location off again at any time in your phone's settings. Your phone's location is read only while the app is open and the World tab is showing, never in the background, and only a live reading is ever sent to our server.
• Our game software does not store your IP address or device identifiers, and does not log your requests or your positions (a position travels inside a request, never in its address). Our hosting necessarily sees your IP address to connect you, and the web server in front of our game software keeps the usual access log for a short time: your IP address, the time and the address called. The address used to open a chest names that chest, so that log can show that your IP address opened a chest at a place and time. Section 7 says how long logs are kept.
• If a Google or Facebook sign-in fails, we log the provider and the error it reported. Our server also logs other errors, which can include your Google or Facebook account id. If a chest refuses you because of a problem on our side (your account is restricted, or the chest has nothing to give), our server logs the chest's id and the reason; for a restricted account the reason includes your internal account number, so that line shows which chest you were at and when. It never logs your position. We never put names, email addresses, birth years or session keys in our logs.
• We use no analytics or advertising services, and we have added no crash-reporting service. Unity's own analytics and ads are switched off. The Unity engine the app is built with may still send Unity Technologies technical details about your device, such as its model and operating system, and crash and diagnostic reports from the engine.
• Your camera. Opening a Relics Chest can show the chest over your phone's camera picture. The picture is shown live on your screen only: nothing is recorded, saved or sent to us. The app asks for the camera when you open a chest. If you say no, it does not ask again until you next start the app (an iPhone asks only once; after that you can allow it in your phone's settings). If you say no, or your phone has no back camera, a painted backdrop shows instead. The camera runs only while the chest is on screen, and stops when you close it or leave the app.
• The app does not use your microphone, contacts or photos. Motion sensors only tilt relics on screen, and their readings never leave your phone.

What stays on your phone

• Your session key, in the app's private storage, until you sign out or it expires.
• Your collection view and sort choices, and the map pieces for the areas you have visited, kept in the app's cache so the World map still shows them without a connection. Your phone may clear that cache to free space, and you can clear it yourself from the app's settings on your phone.
• Your last known position, so the map can open where you were last, and whether you have declined location before, so the app knows when to stop asking. Both stay until you uninstall the app or clear its data.
• Images of relic cards you have shared, until you uninstall the app or clear its data.
• A shared relic's caption, copied to your clipboard, where other apps can read it. It describes the relic, not you.

3. Nothing is stored until you join

The first time you sign in, what Google or Facebook sent us is held only in our server's memory while you fill in the Welcome screen. It is written to our database only when you accept the terms. Our server downloads your profile picture only then, and only if "Use my picture" is ticked. The Welcome screen's preview is loaded by your phone straight from Google or Facebook and is not kept. If you leave, are refused (for example because you are under 13), or 30 minutes pass, nothing is stored in our database. After 30 minutes the details can no longer be used, and they are cleared from our server's memory soon after, or when the server restarts.

4. How we use your data

We use your data to sign you in and keep you signed in, to run the game (your collection, favorites, salvage and relic histories; the map around you, the chests near you, the check that you are at a chest when you open it, and the check that you did not reach it faster than on foot from your last chest), to run quests and give their rewards (the days you open the app, and how far you walk with the World tab open, for the daily walk), to apply our rule that players are 13 or older, to keep the game secure and fair, to look into problems and abuse, and to answer your requests. We never use it for advertising.

5. Our legal reasons

Where the law requires one, our legal reasons are:

• Providing the game you asked for, under our Terms of Service.
• Legitimate interests: security, fair play, preventing abuse, fixing problems and keeping relic histories complete, weighed against your rights.
• Consent, where we ask for it, such as your phone's permission to use your location and your camera. You can withdraw it at any time: location and camera in your phone's settings, anything else by emailing us (section 8).
• Legal obligations, where the law requires us to keep or disclose data.

6. Who we share it with

• Google or Meta (Facebook): you sign in on their pages, under their own privacy policies. We send them only what the sign-in needs, nothing about your game. When the Welcome screen shows your profile picture, your phone loads it from their servers, so they see your IP address as they do for any picture.
• Our hosting provider, which runs our servers and database at a data centre in Singapore on our behalf.
• OpenFreeMap (openfreemap.org), which supplies the World tab's street map. Your phone downloads the map pieces for the area around you directly from it, so it sees your IP address, standard request details and which pieces you ask for. Each piece is a square about 2.4 km across, and the app fetches the one to four pieces around you, so OpenFreeMap can tell roughly where you are (to within a couple of kilometres), but not exactly, and it gets no account or game data.
• Unity Technologies, as described in section 2.
• Apps you share to: a relic card, showing your display name (and your profile picture if you use it and are 16 or older), goes only where you send it through your phone's share sheet. The app itself posts nothing anywhere.
• Authorities, when the law requires it or to protect someone's safety.

We do not sell your personal data. There are no ads in the game, and we share nothing with advertisers or data brokers.

7. How long we keep it

• Your account, sign-in details, favorites and session records: for as long as your account exists.
• Your profile picture: while "Use my picture" is on, until you turn it off or your account is deleted.
• Relics and their ownership histories: permanently, like every relic and serial number. After your account is deleted they point only to an internal number, with no name, email or sign-in attached.
• Where and when you found each relic (the spot, the time and the two distance figures): with the relic's history, permanently. After your account is deleted the record points only to that internal number.
• Quest records (the quests you finished and when, the days you opened the app, how far you walked each day, and the Gems quests paid): for as long as your account exists. After your account is deleted they point only to an internal number.
• Museum and battle records (your exhibits, follows and reactions; your battles and rating): for as long as your account exists. Battles also become part of each relic's history (who has fought with it and how it did), so after your account is deleted they stay, pointing only to an internal number, with no name.
• Your positions: the positions your phone sends are never stored by our server. While your daily walk is under way, it holds the last point it counted in its memory for at most 90 seconds (see "Your location"). The only record of where you were is the chest record above (the spot, the time and the two figures). Your phone keeps only your last known position, until you uninstall the app or clear its data.
• A newcomer's details: in our server's memory only. They can no longer be used after 30 minutes and are cleared soon after.
• Server logs, including the web server's access log: up to 30 days, then deleted.
• Backups: if we keep backup copies of our database, deleted data may stay in them until they are overwritten. If we ever restore a backup, we delete again everything people asked us to delete.

8. Your rights

Depending on where you live, you can ask us for a copy of your personal data, to correct it (for example your display name), to delete it (see section 9), to limit or object to how we use it, and to withdraw any consent you gave. You can also complain to the data protection authority where you live. In the Philippines that is the National Privacy Commission.

Email support@axcelsoft.com from the email address linked to your sign-in. To confirm the request is yours, we reply to the email address stored on your account rather than relying on the sender line. If your account has no email address, see section 9. We will reply within 30 days and may ask for more details. We will never ask for your password.

10. Children and teenagers

• World of Relics is for players aged 13 and over. We ask only your birth year, so you can join from the start of the year you turn 13. Registration refuses anyone who turns 13 in a later year and stores nothing about them in our database.
• We keep only each player's age group, never their birth year.
• If you are under 18, you need your parent's or guardian's permission to play. Please read this policy with them. They can contact us at support@axcelsoft.com about your account.
• If you believe a child under 13 has an account, email support@axcelsoft.com and we will delete it.
• If you are under 18, ask your parent or guardian before you allow location. The app asks for it only when you enter the World tab, you can say no, and you can turn it off again at any time in your phone's settings (section 2). The daily walk counts only from 5:00 am to 8:00 pm and is never timed. No other player can see where you are or where you have been. If you are 13 to 15, other players never see your name either: in the Museum and the Colosseum you appear as "Anonymous Explorer" and can't be followed. They can see your hero, your rating and the relics you show or fight with. The record of where and when you opened each chest (section 2) is kept for players of every age.

11. How we protect your data

• You sign in on Google's or Facebook's own pages, in your phone's browser, so World of Relics never handles your password.
• Session keys come from a secure random generator, and our database stores only their hashes.
• The released app will connect to our servers only over encrypted HTTPS. The game is not released yet; this is how it will be served.
• The keys for our Google and Facebook connections are kept out of our code.
• Your email address and Google or Facebook account id are not separately encrypted inside our database.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

12. International transfers

Our servers and database are at a data centre in Singapore. Google, Meta, OpenFreeMap and Unity Technologies may handle data in other countries, under their own policies. When we move your data to another country, for example to our hosting provider, we stay responsible for protecting it.

13. Changes to this policy

We will update this policy, and the date at the top, before the game collects anything new or uses your data differently. The app cannot yet tell you about changes or ask you to agree again, so please check this page from time to time.

14. Contact

• Operator: Axcelsoft Information Technology Solutions
• Address: 174 Sitio Danga, Barangay Colgante, Apalit, Pampanga, Philippines
• Email: support@axcelsoft.com
• Data Protection Officer: support@axcelsoft.com