Privacy Policy

1. Information we collect

• Account — your email address and a password (hashed, never stored in plain text), or, if you sign in with Google or Apple, the basic profile that provider shares (name, email, avatar).
• Profile — a display name, chosen avatar, region, and faction you set yourself.
• Gameplay — match results, decks, progression, currencies, and cosmetics, so your account works across sessions and devices.
• Purchases — payment is handled by Stripe on the web, and by the App Store or Google Play (via RevenueCat) in our mobile apps. We never see or store your card number; we keep only a record that a purchase happened (amount, item, date).
• Device & usage — standard technical data (IP address, browser/OS, and basic logs) needed to serve the Game and keep it secure.
• Notifications — if you opt in, a push-notification token so we can alert you to your turn or a new season. You can revoke this any time.
• Audience measurement — a count of which pages get visited, with a coarse country and the referring site. It’s first-party (our own database, no analytics SDK), it is not linked to your account, and page addresses are stripped of anything identifying before they’re stored — a visit to another player’s profile is recorded only as “a profile was viewed”, never whose or by whom. You can switch it off in Settings.

We do not sell your data, and we don’t run third-party advertising.

2. How we use it

• To create and run your account, save progress, and sync across devices.
• To match you with opponents, rank you, and run leaderboards and seasons.
• To process purchases and grant the items you buy.
• To send notifications you’ve opted into, and account emails (e.g. password reset).
• To keep the Game secure, prevent cheating and abuse, and diagnose problems.

3. Service providers

We share data only with the providers that operate the Game, each handling only what their job requires:

• Stripe — payment processing on the web (privacy).
• RevenueCat — validates in-app purchases made through the App Store or Google Play (privacy).
• Apple, Google — process in-app purchases and deliver push notifications on mobile.
• Railway — application hosting and database.
• Cloudflare — real-time multiplayer infrastructure.
• Google, Apple — only if you choose to sign in with them.

4. Cookies & local storage

We use a small number of first-party cookies, and no others. There are no advertising or cross-site tracking cookies, and no third-party analytics SDK:

• Sign-in — a session cookie that keeps you logged in.
• Language — remembers whether you chose English, Portuguese, or Spanish.
• Audience measurement — a random id, kept for up to 13 months, so a returning visit isn’t double-counted. It identifies a browser, not a person: it’s never joined to your account, and we can’t use it to see what any individual read. Turning it off in Settings replaces it with an opt-out cookie and stops the counting.

Your device’s local storage holds preferences (sound, visual settings). That never leaves your device.

5. Your rights

You’re in control of your data, directly in the Game:

• Access & export — download everything we hold on you as JSON from Settings.
• Deletion — delete your account from Settings. This removes your sign-in, profile, decks, progression, purchases-to-account links, and any push tokens; match history is anonymized, and if you ever won a Pantheon War your name is removed from that season’s public record.
• Withdraw consent — turn off notifications or audience measurement, or stop using OAuth, any time.

Under the GDPR you also have the rights to access, correct, delete, restrict, and port your data, and to object to processing. We rely on these legal bases: performance of a contract (running your account and the Game),consent (notifications, optional features), and our legitimate interests(security, anti-cheat, improving the Game). You can withdraw consent at any time. If you believe we’ve mishandled your data, you may lodge a complaint with your local supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt).

6. Data retention

We keep your data while your account is active. When you delete your account, personal data is removed and gameplay records are anonymized. Two deliberate exceptions:

• Purchase records are retained as long as tax and accounting law requires, which we’re obliged to do even after you leave.
• Audience-measurement counts are deleted automatically after 13 months. They aren’t tied to your account, so deleting it doesn’t affect them either way.

7. Children

Pantheon is not directed to children under 13 (or the minimum age in your country, e.g. 16 in parts of the EU). We don’t knowingly collect data from children under that age; if you believe a child has, contact us and we’ll remove it.

8. Security

Connections are encrypted (HTTPS), passwords are hashed, and access to data is limited to operating the Game. No system is perfectly secure, but we take reasonable measures to protect your information.

9. Changes

We may update this policy as the Game evolves. We’ll update the date above and, for material changes, notify you in-game.

10. Contact

Questions or requests: [email protected].