Marshal
Version of 6 September 2026
1. Who we are
Marshal is made by Adilia Romanova, who acts as the data controller for the purposes of the GDPR.
Contact: valeevadila95@gmail.com
2. In short
Playing against the bot requires neither an account nor a network connection. Nothing leaves your device.
Playing online requires very little: a random identifier and a few counters. We do not ask for your name and do not collect contacts, location or advertising identifiers. There is no advertising in the app, and no analytics or tracking tools are built into it.
3. What data is processed
Account identifier. On your first online game an anonymous account is created — a random number not linked to your identity. It contains no name, email or password.
Game counters. The date of your first and last game, the total number of games, and how they split between the two board sizes.
Game-start timestamps. Recorded when a game begins, and used to apply limits on free online play.
Current game data. Room, deployment, moves and battle events. These exist while a game is in progress and are deleted automatically within 24 hours at the latest.
Connection technical data. Your IP address and protocol headers are processed by the hosting provider on each request to the server, as with any request to any website. They are needed to make the connection work and to protect against abuse.
4. What we do not collect
Your name. Your email address. Phone number. Location. Contacts. Photos or device content. Advertising identifiers (IDFA). Information about other installed apps.
We do not track you across other companies’ apps and websites, and we do not share data with data brokers or advertisers.
5. Legal bases (for users in the EU and EEA)
- Performance of a contract — creating the account, running online games, and applying free-play limits.
- Legitimate interest — protecting against abuse and keeping the service running, including the processing of connection technical data.
No consent is requested, because there is no advertising or analytics processing that would require it.
6. Who data is shared with
Data is not sold and is not shared for anyone else’s purposes. Two companies are involved:
- Supabase — database hosting, authentication and exchange of game data, on our behalf. Data is stored in Ireland, that is, within the European Economic Area.
- Apple — app delivery. Apple acts as a separate controller under its own privacy policy.
7. Retention periods
| What | How long |
|---|---|
| Current game data | up to 24 hours, usually less |
| Matchmaking queue records | up to 10 minutes after the connection is lost |
| Game counters | as long as the account exists |
| Game-start timestamps | as long as the account exists |
| Anonymous account with no games played | deleted automatically after 30 days of inactivity |
| Account with games played | until you delete it |
8. Deleting your data
You can delete your account from within the app, from the account screen. This removes the identifier, the counters and the timestamps. Games in progress are closed and awarded to your opponents.
Deletion is irreversible; the data cannot be restored afterwards.
If you delete the app without deleting the account, access to it is lost, and the account itself is deleted automatically after 30 days if no games were played.
9. Your rights
Deletion you can carry out yourself, at any time, from the account screen in the app. It takes effect immediately and needs no request.
You also have the right to request access to your data, its rectification, restriction of processing, data portability, and to object to processing based on legitimate interest. Write to valeevadila95@gmail.com.
One practical note. The account holds no name, email address or any other detail that could identify you, so a request sent by email usually cannot be matched to a specific account. Where that is the case, we will say so rather than ask you for extra information about yourself.
You also have the right to lodge a complaint with a data protection supervisory authority — where you live, where you work, or where the alleged infringement took place.
10. Children
The app is not intended for children under 13, and their data is not knowingly collected. In countries where local law sets a higher age of digital consent, that higher age applies.
The app’s App Store age rating is 12+.
If a child has been using the app, the account can be deleted at once from the account screen inside the app — no request is needed, and it is both faster and more certain than writing.
You are welcome to write to valeevadila95@gmail.com as well, bearing in mind the note in section 9: an emailed request usually cannot be matched to a specific account.
11. Transfers outside the EEA
The main data store is in Ireland, that is, within the European Economic Area: game data does not leave it.
Apple delivers the app and processes any related data as a separate controller, on its own terms.
12. Security
Traffic to the server uses an encrypted connection. Access to data is restricted at the database level: a player can see only their own data and the part of the game state they are entitled to see under the rules of the game. An opponent’s deployment is held on the server and is not sent to your device until a piece enters battle.
No method of transmission is completely secure, but reasonable technical measures are in place.
13. Free online play
Playing against the bot is free and unlimited.
Online play is offered free of charge within a limit on the number of games per period. That limit may be introduced, changed or withdrawn at any time, including for an app that is already installed.
14. Changes to this policy
This policy may be updated. The current version is always available at https://valeevadila95-alt.github.io/marshal-legal/ Material changes will be announced in the app.
15. Contact
Adilia Romanova valeevadila95@gmail.com