Privacy Policy

1Controller and contact#

The controller responsible for data processing in TraderLegends (“the Game”) is:

WolfWare-Technology
[Address]
Email: WolfWare-Technology@proton.me

You can also reach us via /paysupport in @TraderLegendsBot. We are not required to appoint a data protection officer and have not done so.

2Starting the Game#

When you open the Game in Telegram, Telegram passes signed launch data to us. We check the signature to make sure the request really comes from your Telegram account. From this data we use and store:

• your Telegram user ID (to identify your game account),
• your Telegram username or, if you have none, your first name (shown as your player name),
• the link to your Telegram profile picture, if your Telegram privacy settings make it available.

We do not receive your phone number, your contacts or your chats. Legal basis: Art. 6(1)(b) GDPR (performance of the contract – providing the Game).

3Game data#

While you play, we store the data needed to run your game account, in particular:

• level, experience, energy, talents, quest, achievement and season pass progress;
• inventory, equipment and the history of your virtual currencies (Gold and Gems), including the reason for each change;
• expeditions, gacha openings, market listings and sales;
• quests: the quests assigned to you per day, week and month, your progress and when you collected each reward; bonus tasks completed per day;
• arena results: rating and league per season, wins and losses, arena tokens, season rewards and your fight records (opponent, result, rating change and the course of the fight);
• settings such as your time zone offset and the time of its last change (taken from your device at the first start so that daily resets happen at your local midnight; you can change it every 30 days), whether you have completed the tutorial, which tips you have already seen and whether you want to receive bot messages;
• first steps: which “Getting started” goals and welcome week gifts you have collected, and the days on which you reached certain first steps (for example first start, first expedition, tutorial finished or skipped, played again on day 2, 3, 7, 14 or 30). We use these dates only in aggregated form to see where new players get stuck and to improve the beginning of the Game;
• in-game messages from us to you and whether you have read them.

Legal basis: Art. 6(1)(b) GDPR. Some data also serves to prevent cheating and abuse (Art. 6(1)(f) GDPR, our legitimate interest in a fair game).

4What other players see#

Competing with others is part of the Game. Other players can therefore see your player name, profile picture, avatar frame, the badge you choose to show, level and game statistics – for example on leaderboards, on the market and in the arena. You decide whether a badge is shown and which one. Supporter badges are based on the total of your purchases; if you show one, other players can infer a range of your spending. If you do not want to appear on leaderboards, contact us and we will hide you.

If you joined via an invitation link, the player who invited you sees your player name, profile picture, avatar frame and level in their friends list. If you win in an airdrop, your player name, rank and prize are shown to all players.

In the arena, other players can be offered a fight against you while you are not playing. They then see a snapshot of your fighter – player name, profile picture, avatar frame, level, combat power and set bonus – and fight against it. Both of you can replay the fight in your fight log. The arena ranking shows your player name, profile picture, avatar frame, level, rating, league and number of wins and losses to all players.

Legal basis: Art. 6(1)(b) and (f) GDPR.

5Purchases with Telegram Stars#

Purchases are paid with Telegram Stars. Telegram processes the payment as an independent controller under its own privacy policy. We receive and store per order:

• the product, the price in Stars, the order status and the times of order, payment, delivery or refund;
• the payment ID assigned by Telegram and, for subscriptions, the renewals;
• the version of the Terms you accepted and when you accepted them, including your consent to immediate delivery.

We never receive payment card, bank or app store account details. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for statutory retention obligations under commercial and tax law.

6Rewarded ads (AdsGram)#

The Game offers voluntary rewarded ads from AdsGram Ltd (Republic of Seychelles). The AdsGram script is loaded when the Game starts so that an ad is ready when you choose to watch one; this transmits technical data such as your IP address and browser information to AdsGram. When you watch an ad, AdsGram processes – according to its privacy policy – data available to Mini Apps such as your Telegram ID, username and device type, under its own responsibility, to deliver ads and prevent fraud.

After a completed view, AdsGram reports your Telegram ID to our server. We store the time and the type of reward to grant the reward and enforce daily limits.

Legal basis: Art. 6(1)(b) GDPR (you request a reward) and Art. 6(1)(f) GDPR (our legitimate interest in financing the free Game and preventing reward fraud).

7TON wallet (optional)#

To connect a TON wallet, the Game uses TON Connect. Its script is loaded from the content delivery network unpkg.com when the Game starts, which transmits your IP address and browser information to that provider. If you connect a wallet, we store your wallet address to process airdrops and payouts; your wallet app processes data under its own responsibility. Records of payouts (amount, transaction ID, time) are kept for statutory retention periods. Transactions on the TON blockchain are public and cannot be deleted.

If you request the payout of a remaining TON balance from the former affiliate program, we store the amount, the status and the time of your request and later the transaction ID. To process it, our team is notified in Telegram with your player name, Telegram ID, the amount and your wallet address.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for retention obligations.

8Invitations (Friends)#

Your invitation link contains your Telegram ID. If a new player starts the Game with it, we store who invited whom (both game accounts), when, and which rewards the inviting player has collected. We use your account's creation time to check that only new players count. The inviting player is informed in the bot chat that a friend joined (without your name) and sees you in their friends list as described in section 4. Legal basis: Art. 6(1)(b) GDPR.

9Airdrop (free prize draw)#

When an airdrop is running, we store the number of tickets you received from quest bonuses for each round. After the round, the winners are drawn among the players with a connected TON wallet. For each winner we store the rank, the prize, the wallet address used for the payout, the payout status and the transaction ID; winners are informed in the bot chat and our team receives the Telegram ID, prize and wallet address for the payout. The winners list with player names is shown in the Game (section 4). Legal basis: Art. 6(1)(b) GDPR (participation under the conditions in the Terms); Art. 6(1)(c) GDPR for payout records.

10Bot messages#

The bot sends you messages in your Telegram chat – for example when your hero is back from an expedition, when your energy is full (at most once per day), in your first days a reminder that a welcome gift is waiting (at most on two days, during the day in your time zone), when you were attacked in the arena (at most one summary per hour), when an arena season ends with your reward, when a friend joined via your invitation link, when you won in an airdrop, or to confirm a purchase. For this we use your Telegram ID and your time zone setting. You can switch off the messages about expeditions, energy and welcome gifts in your profile under “Notifications”, or stop all messages at any time by blocking the bot in Telegram. Legal basis: Art. 6(1)(b) GDPR.

11Support requests#

If you contact us via Telegram, email or Discord, we process the content of your request and your contact details to answer it. Discord processes data under its own privacy policy. We keep support conversations as long as needed to handle your request and possible follow-up questions. Legal basis: Art. 6(1)(b) and (f) GDPR.

12Technical data and security#

We operate our game server ourselves on our own hardware; no hosting provider has access to it. Our server necessarily processes technical data for every request: your IP address, the time, the requested address and your browser's identification (user agent). In addition:

• When the Game starts, we store your IP address, user agent and device type in our security and statistics log, to detect abuse such as multiple accounts and to count how many players are online at the same time.
• Requests that probe for security vulnerabilities are recorded on a block list with IP address, time and request details.
• In exceptional cases we may ask for a security check with Cloudflare Turnstile, which processes your IP address and browser data.

We remove IP addresses and user agents from the log after 90 days; block list entries are deleted after 90 days. Counts of players online contain no personal data. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and fair Game).

13Cookies and local storage#

The Game does not set cookies for players and does not use tracking or analytics tools. It saves a few display preferences – for example how you sort your inventory – in your browser's local storage on your device; this data never leaves your device. Telegram may store data in its app under its own privacy policy. Storing these preferences is technically necessary for the function you requested (§ 25(2) no. 2 TDDDG).

14Recipients#

We do not sell personal data. We share it only with the following recipients, as far as necessary:

We also disclose data to authorities if we are legally obliged to do so.

15Transfers to third countries#

Some recipients are located outside the EU/EEA. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses. Telegram and AdsGram process data under their own responsibility outside the EU; these transfers occur because you use Telegram and choose to watch ads, and are necessary to provide the requested function (Art. 49(1)(b) GDPR). Data processed outside the EU may be subject to access by local authorities.

16Storage periods#

17Your rights#

Under the GDPR you have the right to:

• access your data and receive a copy (Art. 15),
• rectification of incorrect data (Art. 16),
• erasure of your data (Art. 17) – for example deletion of your game account,
• restriction of processing (Art. 18),
• data portability in a common machine-readable format (Art. 20),
• withdraw consent at any time with effect for the future (Art. 7(3)),
• lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence (Art. 77).

To exercise your rights, contact us via /paysupport in @TraderLegendsBot or by email. So that nobody else can request your data, we may confirm your identity through your Telegram account. We answer within one month.

18Minors#

The Game is intended for players aged 16 and over. If we learn that a younger person has created an account, we delete the account and its data.

19Automated checks#

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). Automated plausibility checks may flag unusual activity – for example suspicious trades or impossible progress – for review; sanctions are decided by a human.

20Changes to this policy#

We update this policy when the Game or the law changes. The current version is always available on this page; we announce significant changes in the Game.