Privacy Policy

1. Who we are

The data controller is Arsha Software LLC, registered at Sharjah Media City, Sharjah, United Arab Emirates. We operate the game and the website at orbitlegacy.com. For any privacy question or to exercise your rights, write to [email protected].

This policy explains what personal data we handle and why. Short version: we collect what the game needs to run, and nothing else.

Where your data is: the game and website servers are located in the European Union. Our company is established in the United Arab Emirates, so our staff access that data from outside the EU. We rely on your explicit consent and on the necessity of that access to provide the service you asked for.

2. Data we collect

• Account data. Your email address and a hashed password. Passwords are stored with bcrypt; we cannot read them.
• Sign in with Google or Apple. If you use it, we store your provider ID and the email the provider shares. We never see your Google or Apple password.
• Game data. Your pilot name, faction, progress, items, purchases and similar gameplay records.
• Purchase records. Product, amount, date and payment reference for each Qcoin purchase.
• Technical data. IP addresses and basic request logs, used for security, abuse prevention and rate limiting.
• Support messages. What you send us through the contact form or the forum.

3. What we do not do

• No advertising trackers and no analytics cookies. See the Cookie Policy.
• We do not sell or rent your data to anyone.
• We do not read your card details. Payments are processed by Stripe; card numbers never touch our servers.

4. Why we process your data

To run your account and the game, to deliver purchases, to keep the service safe (anti-cheat, anti-fraud, rate limiting), to answer support requests, and to meet legal obligations such as accounting records.

5. Third parties we rely on

• Stripe processes web payments and applies its own fraud checks.
• Apple and Google process in-app purchases and optional sign-in.
• Our email provider sends verification, password reset and support emails on our behalf.

Each of them handles your data under their own privacy terms, only as needed for those tasks.

6. Public information

Your pilot name, clan, level, rank and similar gameplay stats are visible to other players in the game and on the public Pilot and Clan Registry pages. Your email is never public.

7. Retention and deletion

We keep your data while your account exists. You can delete your account from your web profile; after a 15 day grace period the account and its game data are removed. Purchase records may be kept longer where tax or accounting law requires it. Security logs rotate automatically.

8. Your rights

You can ask us to access, correct, export or delete your personal data, and you can object to processing. Write to us through the contact form from your account email and we will handle it.

9. Children

The game is intended for players aged 12 and over. We do not knowingly collect data from younger children; if that happens, contact us and we will delete it.

10. Changes

If this policy changes in a meaningful way we will post a notice on the website. The date at the top always reflects the current version.