Privacy Policy

Effective Date: September 5, 2026 · Last updated: September 5, 2026

Kawa Royale ("Kawa Royale", "we", "our", "us") is a free-to-play social casino game published by Embergrove Software LLC, a California limited liability company. This policy covers the Kawa Royale mobile app ("the App") and the websites at kawaroyale.com and kawaroyale.app (together with the App, "the Service"). The Service is intended only for users aged 21 and over, in the United States excluding the State of Washington. This Privacy Policy describes the categories of information the Service collects, how that information is used, who it is shared with, and the choices you have.

The App uses virtual currency only. No real money is wagered or won, and virtual coins cannot be redeemed for real money or anything of monetary value.

1. Information We Collect

1.1 Information stored locally on your device

The following data is stored in your device's local storage by default and is not transmitted to our servers unless you sign in for cloud sync (see §1.2):

Virtual coin balance, game progress, level, XP, and per-machine statistics
Daily bonus and login streak status
Charm collection and album progress
Sound, haptic, and notification preferences
Tutorial and onboarding completion state
Game Pass and Battle Pass entitlement status

1.2 Authentication data

The App supports the following sign-in methods:

Sign in with Apple — primary authentication method on iOS. We receive an Apple-managed user identifier and, if you choose to share it, your email address. We do not receive your real name unless you choose to share it. Apple's "Hide My Email" relay is fully supported.
Sign in with Google — available on the web. We receive a Google-managed user identifier, your email address, and your Google display name and profile picture if your account has them. Google Privacy Policy
Email and password — available on the web. We receive your email address. We never see or store your password: it is handled by Firebase Authentication, which stores only a salted hash.
Anonymous authentication — if you don't sign in, we provision an anonymous Firebase account so the game works and progress can be kept on that device. This generates a random opaque identifier with no personal information attached.

1.3 Cloud-synced game data

When you sign in (Apple or Anonymously), the following game data is synced to our backend (Google Firebase Firestore) so you can play across devices and so social features work:

Your Firebase user identifier (UID)
Virtual coin balance and game progression
Display name and avatar selection (visible to other players — see §1.7)
Charm and theme inventory
Friends list, gifts sent and received, club memberships
Leaderboard rank and recent big-win events
Active limited-time offers and personalized promotional eligibility

1.4 Purchase data

In the app: purchases are processed by Apple via StoreKit. Apple, not Kawa Royale, handles your payment information. After a successful purchase, the App sends Apple's signed receipt to our server-side validator (a Firebase Cloud Function) to confirm the transaction is legitimate before granting virtual goods. The receipt contains the product ID, transaction ID, and purchase timestamp; it does not contain your name, email, or payment method.

On the web: purchases are processed by our payment processor, which is identified to you at checkout and may act as the merchant of record. You enter your payment details directly with that processor. We never receive or store your full payment card number. We receive a confirmation of the transaction — the items purchased, an order or transaction identifier, the amount, and the billing country used for tax — which we use to grant your virtual goods, to honour refunds and chargebacks, and to meet our tax and record-keeping obligations.

1.5 Diagnostic and crash data

The App uses Firebase Crashlytics to collect anonymous crash reports and diagnostic data when the Service crashes or encounters a fatal error. This includes:

Device model, operating system version, and app version
Stack trace at the point of failure
Coarse system state (memory, orientation) at the time of the crash

Crashlytics data is anonymous and cannot be linked back to you personally. We use it strictly to identify and fix bugs.

1.6 Analytics data

The App uses Firebase Analytics to understand aggregate usage patterns (which features are used, where players drop off, how long sessions last). Analytics events are pseudonymous — they are tied to a randomized installation identifier, not to your real-world identity. We do not use this data to build advertising profiles, and the Service does not include third-party advertising SDKs.

1.7 Public-profile data (visible to other players)

The following information is visible to other players inside the Service when you participate in social features:

Your display name (chosen by you)
Your selected avatar
Your level and recent big wins (in the Big Win Feed and friend leaderboards)
Your club membership status (if you join a club)

Your virtual coin balance, IAP history, email, and Apple account identifier are never shown to other players.

1.8 Push notification tokens

If you grant notification permission, the App registers an Apple Push Notification (APNS) device token with our backend so we can send time-sensitive alerts (daily bonus reminders, limited-time offers, gift received notifications). The APNS token is opaque and is not personally identifying. You can revoke notification permission at any time in iOS Settings.

1.9 Website-specific data

When you use kawaroyale.com or kawaroyale.app in a browser, the following additional processing applies.

Browser storage. We store game state, your session, and preferences in your browser's local storage. This is used to run the game, not to track you across other websites. We do not use advertising or cross-site tracking cookies.
IP address and approximate location. Our content delivery provider, Cloudflare, processes your IP address to serve the site and to determine the country and state you are connecting from. We use that to enforce where the Service is available (see §1.10). Your IP address is processed in transit; we do not store it in our own database.
Security and abuse prevention. The Service uses Google reCAPTCHA to verify that requests come from a genuine app rather than an automated script. reCAPTCHA collects hardware and software information, including device and application data, and sends it to Google for analysis. This use is subject to the Google Privacy Policy and Terms of Service, and the information is used to provide, maintain, and improve reCAPTCHA and for general security purposes — it is not used for personalized advertising by Google.

1.10 Geographic eligibility data

The Service is offered only in the United States, excluding Washington. When a request is blocked on that basis we log the country and state code, the path requested, and the reason for the block. We do not log the IP address itself in that record. These logs exist to demonstrate that the restriction is enforced, and are retained for up to 12 months.

2. How We Use Information

Operate the game: persist your progress, validate purchases, run social features (gifts, clubs, friends, leaderboards), credit daily bonuses
Improve the game: aggregate analytics tells us which features players enjoy, which they ignore, and where the difficulty curve breaks
Detect and prevent abuse: server-side receipt validation, anti-cheat economy ledger, anti-fraud monitoring on club pools and gift transfers
Diagnose problems: Crashlytics tells us when the Service is crashing so we can ship fixes
Send notifications: APNS push alerts you've explicitly opted into

3. Information We Do NOT Collect

We do not collect your real-world name, address, or government identifiers.
We do not collect your raw contact list, photos, microphone audio, camera image, location, or browsing history. (Optional contact-discovery uses on-device hashing — see §4 below.)
We do not include third-party advertising SDKs (no AdMob, Facebook Audience Network, IronSource, AppLovin, Unity Ads, etc.).
We do not sell, rent, or trade your personal information to third parties.
We do not use your data to build advertising profiles or to target you with ads outside the Service.

4. Contact access (optional)

If you grant Kawa Royale access to your contacts to find friends who already play, we process your contacts as follows:

We never send your contact list to our servers in raw form.
On your device, we normalize each contact's phone number and hash it using SHA-256 with a Kawa-specific salt.
Only the hashed values are sent to our servers, where we match them against the hashed phone numbers of other Kawa users who have explicitly opted to be discoverable.
You can revoke contact access at any time in your device Settings, and you can remove your own phone number from our discovery database in Settings → Privacy.
We do not sell, share, or use your contacts for any other purpose.

5. Third-Party Services

Kawa Royale uses the following third-party services:

Apple Inc. — Sign in with Apple, Apple Push Notification service (APNS), StoreKit (in-app purchases). Apple Privacy Policy
Google Firebase (Google LLC) — Authentication, Firestore database, Cloud Functions, Crashlytics, Analytics, Cloud Messaging, App Check. Firebase Privacy Policy and Google Privacy Policy
Google reCAPTCHA (Google LLC) — bot and abuse prevention on the web and in the app, via Firebase App Check. See §1.9. Google Privacy Policy · Google Terms of Service
Cloudflare, Inc. — content delivery, DNS, TLS, and IP-based geolocation for the websites. Cloudflare Privacy Policy
Our payment processor — for purchases made on the web. The processor is identified at checkout and may act as the merchant of record. It receives the payment details you enter and the items purchased. We never receive or store your full payment card number.

We do not embed advertising SDKs, and we do not sell or share personal information for cross-context behavioral advertising.

6. Data Sharing

We do not share your personal information with third parties except in the following limited circumstances:

Service providers: Google Firebase processes data on our behalf to provide authentication, database storage, and crash reporting. Firebase is contractually obligated to protect your information.
With other players, when you choose to participate in social features: see §1.7 for what is visible.
Legal compliance: we may disclose information if required by law, valid subpoena, or to protect the rights, property, or safety of Kawa Royale, our users, or the public.
Business transfer: if Kawa Royale is sold or merges with another company, your information may transfer to the successor entity, subject to this Privacy Policy.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account or have not signed in for 24 months, we will delete or anonymize your personal data within 90 days, with the following exceptions:

Receipts and IAP transaction records — retained for 7 years to comply with tax and audit obligations.
Aggregated analytics events — retained indefinitely in anonymized form (cannot be traced back to you).
Records required by law — retained for the period legally required.

8. Children's Privacy

The Service is intended only for adults aged 21 and over, and our Terms of Service require you to be 21 to use it. The App carries a 17+ App Store content rating, which describes its content; it is not a grant of eligibility, and our own minimum age of 21 controls. We do not knowingly collect personal information from anyone under 21. If you believe a child under 13 has provided us with personal information in violation of the Children's Online Privacy Protection Act (COPPA), please contact us using the email below and we will promptly delete that information.

The App contains simulated casino mechanics. No real money is wagered, and virtual coins cannot be cashed out, redeemed, or exchanged for anything of value.

9. Your Privacy Rights

9.1 General rights

Regardless of where you live, you can:

Access the data we have about you — email us and we'll send a copy.
Correct inaccurate data (e.g., display name) directly in the Service.
Delete your account and associated data — in the app, open Profile → Account → Delete Account; on the web, open Profile → Account → Delete Account. You can also email us and we will action it.
Opt out of notifications in iOS Settings → Notifications → Kawa Royale. The web version does not send push notifications.

9.2 California residents (CCPA / CPRA)

California residents have the right to: know what personal information we collect, request deletion of personal information, opt out of the sale or sharing of personal information (we do not sell or share — there is nothing to opt out of), and not be discriminated against for exercising these rights. Email us at the address below to exercise any of these rights.

9.3 European Union and UK residents (GDPR / UK GDPR)

EU and UK residents have the right to: access, rectify, erase, restrict, or object to processing of your personal data; data portability; and lodge a complaint with your local data protection authority. The lawful basis for processing is your consent (when you sign in or accept notifications), the performance of our contract with you (operating the game and your account), and our legitimate interest (preventing abuse, improving the Service). Email us to exercise any of these rights.

10. Data Security

Cloud-synced data is stored in Google Firebase with TLS encryption in transit and at rest. Firestore security rules restrict each user's data so only that authenticated user (or our server-side Cloud Functions) can read or write it. Local data is stored in your device's standard storage and is protected by iOS device security. No system is perfectly secure; if we detect a data breach affecting you, we will notify you as required by applicable law.

11. International Data Transfers

Our servers are operated by Google Firebase in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to that transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted at the top of this page with an updated effective date. Continued use of the Service after a change indicates your acceptance of the updated policy.

13. Contact

The data controller is Embergrove Software LLC, a California limited liability company.

If you have questions, requests, or complaints about this Privacy Policy or our handling of your personal information, contact us at:

support@kawaroyale.app

← Back to Kawa Royale · Terms of Service