Privacy Policy for Idle Celestial Harvest

This policy explains what information the game Idle Celestial Harvest for iPhone and Android (“the game”) uses, why it uses it, and the choices you have. It covers the game, optional Guild Hall and in-game Feedback features, and email you send us about the game. Feature availability depends on your version and platform. The Guild Hall described here is offered only on platforms with its supported sign-in method; it is not currently offered on iPhone. Our studio website has its own privacy policy.

Cloud saves are available in supported releases: iCloud on iPhone and Google Play Games on Android. Releases without the relevant cloud-save support save locally and offer clipboard Export and Import.

1. Who we are

Idle Celestial Harvest is made and sold on the App Store and Google Play by Paul Ryan Troxel, an individual developer publishing as Spellwright Studios, based in the State of Missouri, United States (“we”, “us”, “our”). We decide how the information described here is used. Some privacy laws call this role the “controller”.

You can reach us at paultroxel@spellwrightstudios.com.

2. Game saves and backups

On Android, the cloud copy is kept in Google Play Games instead of iCloud; section 15 explains the differences.

The game saves your progress on your device every 15 seconds and when you leave the app. The save holds your game progress, your settings and the in-game activity log, which records events such as milestones and gem spending. It also holds a record of the purchases already delivered (App Store transaction IDs, which product each one was and when it was bought, which permanent purchases you own, and any purchase waiting for a parent’s approval), so nothing is delivered twice. It also holds a save identifier that distinguishes one game from another. An exported save includes this record. Optional guild snapshots are separate from these cloud backups: when you sign in to Guild Hall in a version offering it, the game sends the studio-hosted service a copy of the save as described in section 16. That copy is not a player-facing backup or restore service.

• iCloud copy. If you’re signed in to iCloud and iCloud is on for the game, the game copies your save to the private iCloud database of your Apple Account. The copy is everything described above, plus a short summary: your Halo, level, best level, Rebirths, deepest floor, play time, number of purchases, the game’s version, your device type, when it was saved and your time zone. It also holds a random code for each installation of the game that saved to it, with a fingerprint of the last save that installation made, so your devices can tell their own saves apart. The game makes these codes itself; they don’t come from your device or account, and they’re never sent to us. This lets you continue on another device or after reinstalling. Apple stores the copy, and it counts toward your iCloud storage. The studio cannot view that private copy through its developer account. Apple processes it to provide the CloudKit service. Apple’s Privacy Policy applies to it. To notice when you sign in to a different Apple Account, the game keeps a short code made from your iCloud account’s anonymous ID on your device, next to your save. That code is never sent to us. iCloud saves are free. You can turn syncing off on each device in the game’s Cloud screen.
• When two copies differ. If your device and iCloud have different progress, the game normally asks which save to keep. It never merges your progress. It only decides on its own when the iCloud copy simply continues the one on your device, and then it may drop up to two minutes of play on the device that follows. When an automatic update replaces changed local progress, the game attempts to keep a recovery copy, but that copy is not guaranteed. When you choose which save to keep, the save you don’t keep stays on that device for up to 30 days.
• Previous saves. When you choose another copy, Reset Game, Import, or restore an earlier save, the game keeps the replaced save on your device for up to 30 days. It also keeps a local copy when a sync replaces your iCloud save with another game or an older copy. It also happens when you delete your iCloud save, unless it is the save your device last synced and has kept playing since. You can bring a replaced save back with Cloud › Restore Previous Save. The game keeps the 3 most recent ones, plus every save that a choice, a reset, an import, a restore, such a sync or such a delete replaced, and the furthest one of each game, and never more than 12. Saves older than 30 days are deleted the next time you open the game (if your device’s clock was set ahead and then back, they are kept until the date passes the newest one). If a save on your device or in iCloud can’t be read, the game keeps that damaged copy on your device for up to 30 days, only for support; it is never offered for restoring.
• Device backups. Your device may include the save in its own backups, such as iCloud Backup or a backup to a computer. Apple and you manage those backups, and we can’t see them. Device backups are separate from the game’s own iCloud copy and its clipboard controls.
• Export and Import. The game’s Cloud screen can copy your save to your device’s clipboard (Export) or read a save from the clipboard (Import). The game uses the clipboard only when you tap one of those buttons. If you paste an exported save somewhere, such as a note or a message to yourself, that app handles it from then on.
• Resetting or deleting it. Options › Reset Game starts a new game. It keeps a recovery copy of the previous game for up to 30 days and retains purchase-delivery records so purchases already delivered to the old game are not delivered again. When iCloud sync is on, this also replaces the iCloud copy with the new game, unless the confirmation says the change stays on this device (for example while an “Update Required” or “Different Apple Account” notice is open). To delete the iCloud copy, go to Cloud › Delete iCloud Save (turn on Sync with iCloud there first if it is off). This also turns iCloud sync off on that device. The game checks iCloud again before deleting. If that check detects a different copy, it asks you to review it first. Unless the iCloud copy is the save that device last synced and has kept playing since, a copy of it stays on that device for up to 30 days. You can also delete the copy in your device’s iCloud storage settings. Deleting the app removes everything the game stored on that device, but not the iCloud copy.

3. Purchases: Apple and RevenueCat

You can play without buying anything. If you do buy something, two companies are involved.

Apple handles the payment. You pay with your Apple Account through the App Store. Apple processes the payment and handles taxes, receipts and refunds. We never receive your name, the email address of your Apple Account, your billing address or your card details. Apple’s Privacy Policy covers what Apple does with your information.

RevenueCat helps us manage purchases. RevenueCat, Inc. is a service provider. The game uses it to load prices, confirm purchases with Apple, deliver what you bought, keep permanent purchases active and restore them. The game contacts RevenueCat when you open or return to it while connected to the internet, when you buy something or restore purchases, and when a save moves between your devices or you import or restore a save (described below). This happens even if you never buy anything, because the game needs to load prices and check whether you own any permanent purchases.

RevenueCat receives the following information:

We use this information only to:

• show prices in your currency;
• deliver your purchases and keep permanent purchases working;
• restore your purchases;
• spot and prevent fraud and errors;
• handle refunds that Apple grants;
• answer your questions about a purchase;
• see overall sales figures and purchase history in RevenueCat’s dashboard, such as how many of each item sold.

For purchase support, we may associate an order ID you provide with the matching purchase record. If you use Guild Hall, we also check the transactions in your uploaded save with RevenueCat for fair-play review and link the result to your guild account, as described in section 16. We don’t use this information for advertising, and we don’t combine it with information from our other games or apps. We haven’t turned on RevenueCat’s optional features that collect the advertising identifier (IDFA), connect to advertising or attribution services, or send diagnostic data.

When a save from another of your devices replaces the one on your device (unless it is only a routine catch-up of the same game with nothing new), when you keep your device’s copy of the same game, and after you import a save or restore a previous one, the game asks RevenueCat to check that device’s App Store purchases. This doesn’t show a sign-in screen. If your Apple Account bought something on another device, RevenueCat links the two devices’ anonymous IDs, so your permanent purchases work on both. When you choose between two copies of the same game, purchases delivered only to the copy you don’t keep are added to the one you keep, once each. When you switch to a different game, the purchases of the game you leave on that device are added to it; a game you keep on your device takes nothing from another game, and the game doesn’t ask RevenueCat to check purchases then. A new game you start (Start New Game or Reset Game) starts without them, and so does a game another device started, reset, imported or restored, if you haven’t played on your device since it last synced; permanent ones come back with Restore Purchases. A purchase that was charged but not yet delivered when you reset goes to the new game. Purchases made before this update aren’t moved with a save: when both saves are the same game, the one you keep receives them once the App Store reports them again; another game receives one only if it was started before that purchase.

RevenueCat handles this information for us as our service provider and stores it in the United States, on Amazon Web Services. Like all our service providers, it must protect your information at least as well as this policy describes (see section 8). See RevenueCat’s privacy policy for more.

4. Advertising and information the game does not request

The game does not show ads, include advertising code, read the advertising identifier (IDFA), or track you across other companies' apps and websites. It does not ask for access to your location, contacts, photos, camera, microphone or health data. In-game Feedback accepts text, not file, photo or audio attachments; information you choose to email us is handled as support correspondence.

We do not add continuous gameplay analytics for the studio. We receive purchase and sales reports, store reports, optional feedback and its attached details, and the guild account, progress and fair-play information described in this policy. We use these to provide the game, help players, diagnose problems and protect guild play. Google Play Games separately sends Google usage and diagnostic information under Google's own terms (section 15).

The game does not upload its own crash reports. Apple or Google may provide developer crash and performance reports under their platform settings (sections 5 and 15).

Guild player and guild names are generated from the game's lists; there is no player chat. Public guild information is described in section 16. Feedback text and support correspondence are sent to the studio, not posted to other players.

5. Information Apple shares with us

Apple gives developers some information about their apps:

• Sales and payment reports. These show things like which items sold, in which country and for how much. They don’t show who bought them.
• Crash reports and app usage statistics, but only if you have turned on Share With App Developers in Settings › Privacy & Security › Analytics & Improvements. Apple provides these in a form that doesn’t identify you. You can turn the setting off at any time.
• Ratings and reviews you post on the App Store. These are public, and Apple’s terms cover them.

6. Support and optional in-game Feedback

Email support

If you email us, we receive your email address, message and attachments. We use them to answer you and investigate the problem. For purchase support, we may use an order ID you provide to find the matching purchase. We keep support correspondence for up to two years after our last message with you, then delete it unless needed longer for a legal claim. Google Workspace stores these messages for us. This rule concerns correspondence with you; internal service-digest emails have the separate retention described below.

Please do not send passwords, payment card numbers or identity documents.

In-game Feedback

In versions offering Feedback in the Miscellaneous menu, you can send a bug report, idea or other message without signing in. Feedback is optional. We receive the category, text and submission time. The form accepts up to 1,000 characters and does not ask for a name or email address, but we receive anything you choose to include.

Include game details starts on when the app launches. You can turn it off before sending. When on, it includes the platform, game version, Android build number where available, device make/model, operating-system version, game render size, language, top Halo, deepest floor and level. It also includes a guild Player ID if one is available in the game. These details help us understand your report. Feedback does not automatically attach the save file or purchase history; the separate guild snapshot flow is described in section 16.

The game creates a random installation code and sends it over HTTPS with submissions and inbox checks. The database stores a one-way hash of it. This links messages from the same installation and lets the game retrieve its replies; reports are not anonymous. The code is stored separately from the game save. Our hosting service receives your IP address and keeps request-log information such as time, status, user agent and connection details. A keyed, shortened hash of the address and a shortened installation hash are also used in daily spam-limit counters.

We use reports and attached details to answer requests, investigate bugs and improve the game. Authorized studio operators can read them. Google Firebase and Google Cloud host the database, functions and logs. When we use Claude to help handle a report, Anthropic processes the report content and context we provide to it (section 8). We do not post feedback to other players or use it for advertising.

Replies appear in Your Feedback and may include a support thank-you promo code. The game checks when you open Feedback and, while a message waits for a reply, once about 30 seconds after a later launch. The server records delivery. There are no feedback push notifications or email replies to the player.

Internal summaries and separate copies

A daily internal digest records the number of recent reports, their references and categories, and short message excerpts in service logs. It includes up to 80 characters from each report and up to 900 characters in the combined summary. These excerpts can contain information you wrote. The service is configured to send this summary to the studio's support mailbox through Google Cloud Monitoring and Google Workspace when there are recent reports. Internal digest emails remain in that mailbox until we delete them; no fixed deletion period is currently set for those emails.

Administrative support operations can also write short excerpts of their results to service logs, including feedback text and details or guild case identifiers, findings and progress. These administrative excerpts are separate from the daily digest and are included in the 30-day service-log retention described below.

The main feedback record is scheduled to expire 730 days after submission, including its details and reply. Replies do not restart that period. Daily spam-limit records expire seven days after the day's last accepted submission, so an early entry can remain nearly eight days, plus background-deletion time. Request logs, digest-log excerpts and administrative support excerpts are retained for 30 days. Required administrative audit logs are retained for 400 days and do not contain feedback message bodies. Expiry runs in the background and is not an exact deletion deadline.

The phone keeps its installation code, message references, previews, status, replies and any promo codes until the app's stored data is removed. Deleting a server record does not automatically remove the phone's copy. Separate support-tool and AI-assistance copies are described in sections 8 and 9.

To request deletion of a feedback record, email paultroxel@spellwrightstudios.com with the FB-reference shown in the game. Server deletion removes that message and reply, but does not automatically erase request or digest logs, internal digest email, separate support records or the phone's cached copy. Tell us if your request concerns those other copies too. We may need further information before disclosing stored information or handling a broader request.

Removing app data also removes local game progress, so save or export any progress you intend to keep first. Reset Game and deleting a cloud save do not delete server feedback records. Removing the local installation code can prevent retrieval of that installation's replies.

7. Legal bases (EEA, UK and Switzerland)

If you live in the European Economic Area, the United Kingdom or Switzerland, the law requires us to give a reason (a “legal basis”) for each use of your information:

• Delivering, keeping and restoring your purchases: we need to do this to provide what you bought (performance of a contract).
• Loading prices and checking what you own when the game starts: our legitimate interest in running the Store.
• Preventing fraud, keeping business records, understanding overall sales, answering support and feedback, diagnosing reported problems, preventing spam and reviewing guild fair play: our legitimate interest in running the game safely and reliably. You can object to these uses (see section 10).
• Providing optional guild accounts and membership features you request: performance of a contract.
• Keeping records the law requires, such as tax and accounting records: our legal obligations.

8. Who we share information with

We share information only with:

• Apple, which provides the private CloudKit storage for iCloud saves, as described in section 2;
• Google, which handles Google Play payments for the Android version, as described in section 15;
• Google, which also runs Google Play Games for the Android version. It keeps the Android cloud copy of your save, and its code in the game sends Google some usage and diagnostic information for Google’s own purposes, as described in section 15;
• RevenueCat, Inc., which manages purchases for us, as described in section 3;
• Google Firebase and Google Cloud, which host guild accounts, snapshots, feedback, service logs and internal alerting, as described in sections 6 and 16;
• Google Workspace (Google LLC), our email provider, which stores support correspondence and internal feedback and guild-case digests;
• Anthropic, when we use Claude to assist with player support or guild fair-play review. We provide the report, case or save information and context needed for that work. This can include feedback text and details, guild identifiers, progress, purchase-verification information and review findings;
• other players and visitors, who can read public guild information described in section 16;
• authorities, when the law requires it, or when we need to protect people’s rights or safety;
• a new owner, if the game or the studio is sold or transferred. The new owner must keep protecting your information as this policy describes.

RevenueCat, Google Firebase/Cloud and Google Workspace provide services used to operate these features. For AI-assisted support and fair-play investigation, we use a personal Claude Max account with its model-improvement/training setting disabled. Anthropic's consumer-service terms and privacy rules apply. Turning that setting off does not mean no data is retained or that every use is excluded: Anthropic describes exceptions for conversations flagged for safety review and for content explicitly submitted through its feedback mechanisms. See its model-improvement settings and training and feedback information.

AI-assisted work can create provider-hosted and local session records. Those records are separate from the game database; deleting a game record does not automatically delete them. Anthropic generally removes a deleted conversation from its backend within 30 days, subject to its retention exceptions for safety, legal obligations, disputes and feedback submitted to Anthropic. Local session copies require separate handling. Contact us about access or deletion of information used in this workflow. Anthropic's retention information and privacy policy describe its practices. We do not promise immediate or complete erasure of every copy.

Apple handles your App Store payment and Apple Account under its own terms. It also provides and processes the private CloudKit storage used for the game-save feature (section 2). The studio cannot view that private copy through its developer account. Apple’s Privacy Policy also applies.

Google handles your Google Play payment, your Google Account and Google Play Games under its own terms (section 15). Google’s Privacy Policy also applies.

We don’t sell personal information. We don’t share it for targeted advertising, also called “cross-context behavioral advertising” in some US state laws.

9. How long we keep information

RevenueCat retains IP addresses in its request logs under its own retention policy. Google-hosted feedback and guild services also retain request-log IP addresses for 30 days. Section 6 describes the separate keyed network hash used for feedback spam limits. Third-party account and platform records are subject to the relevant provider’s terms.

10. Your choices and rights

Delete your local game data. To remove everything the game stores on your device at once, delete the app. Options › Reset Game starts a new game and retains purchase-delivery records; the previous game and any earlier saves listed under Cloud › Restore Previous Save stay on your device for up to 30 days. To delete the iCloud copy, use Cloud › Delete iCloud Save (with Sync with iCloud turned on), or delete it in your device’s iCloud storage settings. Deleting the app doesn’t delete the iCloud copy. These actions do not delete copies on other devices, copies you exported to another app, or device backups managed by Apple or your computer; manage those copies where they are stored.

Delete your purchase records. Email us the Apple order ID of one of your purchases, with the subject “Data deletion request”. You can find the order ID in Apple’s receipt email or in your App Store purchase history; our Support page explains how. We’ll find the matching record at RevenueCat, delete it there, and reply to confirm within 30 days. Please note:

• Deleting the record doesn’t cancel or refund anything, and it doesn’t change your purchase history with Apple.
• The anonymous ID stays on your device. The next time you open the game online, a new record is created with the same anonymous ID. To prevent that, delete the app too. Deleting the app also erases your progress on that device; it doesn’t delete your iCloud copy or, on Android, your Play Games copy, if you use one. Export your save first if you want to keep a copy of your own.
• Your permanent purchases may stop working in the game until you tap Restore Purchases. Restoring creates a new record from Apple’s purchase data.
• If you’ve never bought anything, the record at RevenueCat holds only the anonymous ID and device details, so we can’t tell which record is yours. Deleting the app removes the ID from your device.

Delete your support emails. Ask us, and we’ll delete them.

Other rights. Depending on where you live, you may have the right to:

• get a copy of your information;
• correct it;
• delete it;
• limit or object to how we use it;
• move it to another service;
• appeal if we turn down your request.

To use any of these rights, email us. We may ask for an Apple order ID to confirm the records are yours. We won’t treat you differently for using your rights. If you live in the EEA, the UK or Switzerland, you can also complain to your local data protection authority.

Stop sending information to RevenueCat. The game contacts RevenueCat only when your device is online. You can play offline, but the Store needs an internet connection. You can also delete the app.

Guild account and feedback deletion. In versions offering guild accounts, use Options › Guild Account › Delete Guild Account. Section 16 explains what is deleted and the fair-play evidence that can remain. Sign Out does not delete the account. To delete feedback, use the FB-reference request described in section 6. You can also request guild-account deletion without the app using the web instructions on our Support page. We may need information to identify the right records and verify the request.

Cloud saves are separate. Your iCloud copy belongs to your Apple Account and your Play Games copy belongs to your Google Account. Delete them through the controls described in sections 2 and 15. Deleting a guild account or feedback record does not delete those cloud saves, your local game or store purchase history.

11. Children

The game is for a general audience. It isn’t directed to children under 13. We don’t knowingly collect personal information from children under 13, or under the minimum age in your country. The game does not ask for age. Optional guild sign-in provides account profile data through Google and Firebase; feedback or email may contain information a player chooses to send. The game sends information as described in sections 2, 3, 5, 6, 15 and 16. On Android, that includes the optional Play Games save and Google’s automatic Play Games usage and diagnostic collection. Clipboard exports and device backups are described in section 2. We use information we receive only for the purposes listed in this policy, never for advertising or profiling. Google’s own Play Games processing is described in section 15.

If you believe a child has sent us personal information, for example by email or in-game feedback, contact us and we’ll delete it. Parents can control purchases with Apple’s Ask to Buy and Screen Time.

12. Security

The game keeps your save on your device, where the operating system protects it, and, if iCloud sync is on, in your private iCloud storage, which Apple encrypts in transit and at rest. Copies you export or retain in device backups are handled by the apps and services you choose. The game connects to RevenueCat only over encrypted (HTTPS) connections. Access to our RevenueCat dashboard, support mailbox and administrative tools is restricted to authorized operators. Guild sign-in, requests and snapshot uploads, and feedback submissions and inbox checks, use HTTPS. Guild tokens and feedback installation codes are stored in app-private storage on Android. Public guild information remains publicly readable as described in section 16. No system is perfectly secure, but we work to protect the information we hold.

13. Where information is processed

We are based in the United States, and RevenueCat stores data in the United States. The guild and feedback database and snapshot storage are hosted in Google’s us-central1 region in the United States. This does not mean every log, mailbox, account or support-tool copy is limited to that region. Apple, Google and Anthropic may process information under their applicable terms and in the locations their services use. If you live elsewhere, information may be processed in countries whose privacy laws differ from yours.

14. Changes to this policy

If we change this policy, we’ll post the new version on this page and update the effective date. If a change significantly affects how we use your information, we’ll also tell you in the game or in the App Store or Google Play release notes before the change takes effect.

15. The Android version (Google Play)

Idle Celestial Harvest is also sold on Google Play for Android. Everything in this policy applies to the Android version, with the differences below. Where this section differs from the rest of the policy, this section applies to the Android version.

Saves and the cloud copy. On Android, the game keeps its cloud copy with Google Play Games instead of iCloud. The menu item for your saves is Cloud.

• Signing in. If you use Google Play Games, it signs you in when the game starts. You can decline, and sign in later from the game’s Cloud screen. Without Play Games, your progress is saved only on your device.
• For cloud saving, the game asks Play Games only for your player ID, to find your saved game. It keeps a short code made from that ID on your device, to notice when you sign in with a different account. That code is never sent to us.
• The game doesn’t ask for your gamer name or avatar. If you create or change your Play Games profile when the game asks you to sign in, Google collects them under its own terms.
• The copy. While you’re signed in and sync is on, the game keeps its cloud copy as a saved game in your Play Games account.
• It holds what section 2 describes for the iCloud copy.
• Play Games also stores a short description of it: the same line the Cloud screen shows, with your Halo, level, Rebirths, deepest floor, play time and device type. It also stores your play time and a progress number.
• Google stores the copy with your Google Account, and only this game can read it for you. We can’t view it. Google’s Privacy Policy applies to it.
• How it works. Everything section 2 says about the iCloud copy applies to this copy, with Google Play Games in place of iCloud and your Google Account in place of your Apple Account. That includes what happens when two copies differ, the replaced saves the game keeps for up to 30 days, turning sync off, and Cloud › Delete Play Games Save. You can also delete the game’s saved games in your Play Games profile settings, or all your Play Games data in your Google Account.
• What Google Play Games collects for Google. Its code in the game also collects some usage and diagnostic information automatically, to keep its software stable and improve Google’s products. This happens under Google’s Privacy Policy, and we don’t receive it. Google describes it in its Play Games Services data disclosure.
• Device backup. Android’s own backup, such as Google One backup, may include the save if you turned it on. Google and you manage that backup, and we can’t see it.

Purchases: Google Play and RevenueCat. You pay with your Google Account through Google Play. Google processes the payment and handles taxes, receipts and refunds. The purchase flow does not ask for your Google Account email address, billing address or payment card details, and it does not receive your payment card details. Optional Guild Hall sign-in is separate and supplies Google profile information to Firebase Authentication (section 16). Google provides the developer order and sales records described below. Google’s Privacy Policy covers what Google does with your information. The game uses RevenueCat as described in section 3, with these differences:

• Purchase records include the details Google Play provides, such as the order ID and the purchase token, instead of Apple’s.
• Device and app details include your device’s model and manufacturer, your Android version, the game’s version, your preferred languages, your Google Play country, and whether the game is a test or debug build.
• No device identifiers. The game turns off RevenueCat’s collection of device identifiers. RevenueCat doesn’t receive your Android ID or your advertising ID, and the game doesn’t send RevenueCat diagnostic data.
• Keeping purchases linked. After you buy something, RevenueCat’s code in the game may store the anonymous ID in Google’s Block Store, which Google keeps with your Google Account’s backup data. If you reinstall the game, or move to a new Android device with your backup, your purchases stay linked. We can’t see that copy. Google’s terms and your backup settings apply to it.
• When the game checks your purchases. Section 3’s checks apply, with your Play Games copy in place of iCloud and Google Play purchases in place of App Store purchases.
• Purchases don’t move between stores. App Store and Google Play purchases are separate. Restore Purchases brings back only the permanent purchases made with the store account you’re using.

Information Google shares with us. Instead of section 5, Google Play gives developers:

• order and sales records, including order IDs, products, dates, amounts and buyer country; depending on the transaction, Google’s reports may also include buyer state, city or postal code. We use these records for purchase support, accounting and sales reporting, not for advertising. For support, we may use an order ID or email address you give us to find the matching order;
• crash reports, “app not responding” reports and performance statistics (Android vitals), only from people who chose to share usage and diagnostics data with Google, in a form that doesn’t identify you;
• the ratings and reviews you post on Google Play, which are public.

Order IDs. Where this policy asks for an Apple order ID, use your Google Play order ID instead. It starts with “GPA.”. You can find it in Google Play’s receipt email, or in the Play Store app under your profile picture › Payments & subscriptions › Budget & history. Deleting your records at RevenueCat (section 10) doesn’t change your purchase history with Google.

Permissions. The Android version doesn’t ask for any permission you need to approve. It uses internet, network and Wi-Fi status to load prices and confirm purchases, Google Play’s billing service, vibration, audio settings, and keeping your device awake while you play.

Children and parental controls. Section 11 applies. Parents can control purchases with Google Play’s parental controls and with purchase approvals in Google Family Link.

Security. Section 12 applies, except that the cloud copy is in Google Play Games, which encrypts it in transit. Android protects the save on your device.

16. Optional Guild Hall, accounts and fair-play review

In versions offering Guild Hall, guild play is optional and unlocks at Halo 5. The single-player game remains playable without a guild account. These guild features use Google sign-in on Android; they remain unavailable on iPhone while its sign-in support is not offered. Google Play Games cloud saving and Guild Hall sign-in are separate features.

Account and public guild information

When you choose Sign in with Google for Guild Hall, Android Credential Manager supplies a Google identity token, which is exchanged with Firebase Authentication. Firebase creates an account in our project containing the Google account identifier and the profile data Google supplies, including email and usually display name and photo URL. Firebase Authentication also processes user-agent and IP information for authentication security and abuse prevention. We do not copy the email into the player database. The player record contains a Player ID, generated player name, guild membership, provider, creation date, latest progress summary and any human-set guild restriction. The phone stores its signed-in state, including its Firebase user ID and refresh token, masked email, Player ID, generated name and guild ID.

Player and guild names are generated from the game's lists. There is no guild chat. Guild documents are publicly readable so people can browse guilds before signing in. They show the guild name, emblem, level, member count and capacity, joining settings, minimum Halo, leader's Player ID and dates. For each member they show the Player ID, generated name, rank, joining date, contribution counter, top Halo, deepest floor, worn champion and last-seen information. Your Firebase user ID and Google email are not displayed to other players. Browsing public guild information still makes requests to the hosting service and can generate request logs.

Save snapshots and checks

While signed in, the game sends a copy of the whole sealed save, up to 256 KB, to our Google Cloud storage for guild functionality and fair-play checks. It includes game progress, settings, integrity counters and the purchase ledger with store transaction identifiers. This is separate from your private cloud backup. Uploads occur at most once per UTC day, with up to three additional uploads that day when joining or founding requires a fresh Halo check.

Our server checks the save's integrity, progress and resource records. It asks RevenueCat about store transactions in the save and caches the purchase-verification results. It records per-day summaries and findings, and a latest player summary including Halo, deepest floor, level, champion and day. These checks link the uploaded progress and purchase information to the guild account.

An automated finding opens a notice for a person to review; it does not itself block play. Authorized studio operators review notices and may use Claude to help investigate, as described in section 8. Internal guild-case summaries are sent to the studio mailbox. Administrative review operations can also log excerpts of case results, including identifiers, findings and progress, under the service-log retention in section 9. If a person determines that guild access should be restricted, the game shows that person's note. Guild restrictions do not block offline single-player play. Contact support with your Player ID if you want us to review a restriction.

Retention and deletion

Routine snapshot files and per-day summaries are scheduled for deletion after 90 days. A snapshot held as evidence remains while its notice is under review and for two years after a person decides the notice; background cleanup then removes expired evidence. Undecided notices do not have a promised two-year deadline starting at upload. Player account records remain until account deletion. Purchase-verification cache, request logs, internal digest emails and support-tool copies have the separate retention described in section 9.

Options › Guild Account › Delete Guild Account leaves the guild, passes leadership or closes the guild if you were its last member, frees the generated player name, deletes the player record and routine snapshot summaries/files, and initiates deletion of the Firebase Authentication user. Google documents a separate removal period for authentication data in its live and backup systems, described in section 9. A notice, its flagged evidence and the link between Player ID and internal user ID may remain through the review and evidence-retention period. Logs, internal email and separate support copies are not automatically erased by this action. Deleting a guild account does not delete your local single-player progress, private cloud saves or store purchase history. Sign Out only signs this phone out; it keeps the account.

17. Contact us

Paul Ryan Troxel, an individual developer publishing as Spellwright Studios
Email: paultroxel@spellwrightstudios.com
Support: celestialharvest.spellwrightstudios.com/support
Official Store Legal Mirror: spellwrightstudios.com/idle-celestial-harvest/privacy