Catality: Privacy Policy
Last updated: 13 October 2026
Catality is a fighting game, played on the website catality.app and in the Catality app. This policy explains what personal data the game processes, why, how long it is kept, and the rights you have. It covers the website and the apps.
Who we are
The game is run by Max Berggren, Sweden, who is the controller of your personal data. Contact us about anything in this policy at maxberggren@gmail.com.
In short
- No ads, no tracking across apps or websites, and we never sell or rent your data.
- On the website, matches are logged anonymously (which knights, which moves, the result) so we can keep the game balanced and make the computer opponents better. Nothing in them identifies you, and you can turn it off (Options → Share match stats). The apps send none.
- You can play without an account. An account only stores what the online features need.
- Chat is never written to disk (and the apps have no chat at all).
- You can delete your account in the game at any time (Profile → Delete account).
What we process and why
Playing offline
Fights against the computer, local versus and training run entirely on your device. Your settings (volume, blood level and similar) and your last picks are saved in your device's local storage and are never sent to us. The one exception is the anonymous match statistics below, for local versus and fights against the computer on the website.
Match statistics (website only)
When a match ends on the website (local versus, a fight against the computer, or an online match you played in), the game sends us an anonymous record of it, so we can find knights and moves that are too strong, keep the game fair, and teach the computer opponents to play more like people. It holds which knights fought, the battlefield, the rules, the result, and each move used (with where on the battlefield the knight was), hit, block and knock-out with the frame it happened on, plus the game's version, the computer opponents' levels, and whether each local player used a keyboard, a gamepad or a touch screen. It holds no player name, account, device identifier or anything else about who played. We don't store your IP address or any cookie with it, and keep its date only to the day, not the time. For an online match we check that it was a real match on our server and keep one record per match; its match id is used only for that check and isn't stored. Training, the tutorial and the computer playing itself are never sent. The apps send none. Turn it off at any time in Options → Share match stats; a record that couldn't be sent yet then stays on your device and is deleted.
Playing online as a guest
You can play Quick Match without an account. You get a random guest name and an identifier for the session, kept in the server's memory only. A short-lived token in your device's session storage lets you rejoin a match after a dropped connection. If you play against someone who is signed in, your guest name appears in their match history.
Your account (Sign in with Apple or Google)
When you sign in, Apple or Google tells us a unique identifier for your account there and your first name (Apple only the first time). We use the first name only to suggest a player name. We do not request or store your email address, and we get nothing else from your Apple or Google account. We then store:
- your Apple or Google account identifier, so you can sign in again (and for Sign in with Apple the token Apple issues, kept only so we can revoke it when you delete your account);
- your player name, the country flag shown next to it (suggested from your device's language setting; you can change or remove it) and your name colour;
- your rating, experience points, level and number of ranked games;
- your friends, friend requests and the players you ignore;
- your match history: when, against whom, which knights, the result and the rating change;
- a record of ranked matches that ended without a result (used for a short ranked-queue cooldown);
- when the account was created and last used;
- a session, kept in a cookie, that keeps you signed in for up to 30 days.
Other players can see your public profile: player name, flag, name colour, level, rating, wins and losses and recent matches. Your friends also see whether you're online and what you're doing (such as "in a match").
Online matches
To connect you to other players, our server processes your IP address. During a match your device may connect directly to the other players' devices (peer-to-peer, WebRTC), which lets their devices see your IP address. If a direct connection isn't possible, the traffic is relayed through our servers instead. Match inputs are kept in the server's memory while the match runs, so spectators can follow it, and then discarded.
Chat (website only)
On the website you can chat in public channels, in your party and with friends. Messages are relayed live and never written to disk; the last 30 messages of a channel are kept in memory for up to 15 minutes so people who join late can catch up. The apps have no chat.
Reports
You can report a player for an offensive name, cheating, harassment or something else. We store the report (who reported whom, the reason, an optional note, the match and the time) so we can review it and act on it. Reports about you are kept for the same purpose, also if you delete your account.
Notifications
If you turn on notifications so friends can challenge you while the game is closed, we store the push address your browser or device gives us. Notifications are delivered through your platform's push service (for example Google, Mozilla or Apple). Turn them off in the game or in your device settings at any time.
Server logs
The server logs errors and moderation events (such as a report being filed) with the time and player identifiers, but not your IP address. Logs are kept for at most 30 days.
Legal bases
- Contract (GDPR art. 6(1)(b)): your account, rankings, friends and online matches, to provide the game you signed up for.
- Legitimate interests (art. 6(1)(f)): keeping the service secure, preventing cheating and abuse, and handling reports, so the game stays fair and safe for everyone; and the anonymous match statistics, to keep the game balanced and improve the computer opponents (you can turn them off).
- Consent (art. 6(1)(a)): notifications. You can withdraw it at any time by turning them off.
Who else gets data
- Our hosting provider, which runs our servers in the EU and processes data only on our behalf.
- Apple or Google, when you sign in with them. Their own privacy policies apply to your account there. When you delete your account, we ask Apple to revoke the sign-in it gave us.
- Push services (see Notifications), only if you turn notifications on.
- Other players see your public profile, and during a match their devices may see your IP address (see Online matches).
We don't sell personal data or share it for advertising. We disclose it to authorities only when the law requires it. All our own storage is in the EU. Apple, Google and push services may process data outside the EU under their own safeguards (such as the EU's standard contractual clauses).
How long we keep it
| Data | Kept |
|---|---|
| Account, profile, friends, ignore list, match history | Until you delete your account |
| Sign-in session | Up to 30 days, or until you sign out |
| Ranked no-contest records | Until you delete your account (only the last 7 days are used) |
| Reports | 180 days |
| Guest sessions, match inputs, channel chat | In memory only: until the session or match ends; chat at most 15 minutes |
| Server logs | Up to 30 days |
| Anonymous match statistics | As long as they help balance the game or improve the computer opponents (they can't be tied to you) |
Deleting your account
In the game: Online → Profile → Delete account, then type your player name to confirm. This works in the app and on the website (sign in at catality.app with the same Apple or Google account). It deletes your account at once, along with your profile, friends, ignore list, sessions, notification settings and the reports you filed. In other players' match history your seat stays as a nameless "Deleted knight", because those results are theirs too. Reports other players filed about you are kept for up to 180 days.
You can also email maxberggren@gmail.com and ask us to delete your account. We'll do so within 30 days.
Your rights
You have the right to access your personal data, to have it corrected, to have it deleted, to restrict or object to how we process it, and to get a copy of it in a portable format. Email us to use any of them; we answer within a month. You can correct your name, flag and colour yourself under Profile. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority where you live.
Age
Catality is for players aged 16 and over. We don't knowingly collect data from anyone younger. If you believe a child under 16 has an account, email us and we'll delete it.
Security
All traffic is encrypted (HTTPS and secure WebSockets). Sessions are stored only as hashes, and we keep as little data as the features need.
Changes
If we change this policy, we update it here with a new date, and tell you in the game when the change matters.