Privacy Policy

Who is responsible

JAMRA STUDIOS LTD (company number 17290422, 172 Stafford Street, Wolverhampton, England, WV1 1NA) is responsible for your personal data as its controller. Write to [email protected] with any question or request about it.

This website

This website sets no cookies unless you accept analytics. Its fonts and images are served from this site, and nothing loads from Google unless you accept.

Like every website, our hosting provider receives your IP address, the page you ask for, the time and your browser’s name, and keeps them in server logs for security and troubleshooting.

Playing without an account

The game keeps your game in progress, deck, campaign records, featured-heist best scores, card mastery, three-heist run, learning progress, recent learning events, language, sound setting and chosen rival in your browser’s local storage. Guest data stays on your device unless you explicitly save a guest backup to an account or opt into the learning study. The Cookie Policy lists each item.

Your game account

We store your selected deck, encounter attempts and wins, featured-heist best scores, card deployment counts (mastery), and your current three-heist run. Signed-in match start and end dates help us assess whether players return. These records stay in the game’s own database until account deletion and are included in account data exports. Signing in alone does not upload guest progress. If you choose Save this device’s guest backup, we keep that deck, records, mastery, run, replay commands and learning milestones as a separate guest copy. Up to five device backups are included in account export and deletion. Guest copies do not award account XP or Signs.

If you create an account, our server stores your email address, a salted scrypt hash of your password (never the password itself), when the account was created, your sign-in sessions as hashed tokens that expire after 30 days, and your online match records: the moves played, the result and when the match took place. Your browser keeps a sign-in token in local storage until you sign out.

We also keep whether you have confirmed your email address and when you confirmed you are 18 or older, which you do when you create the account. Links we email you to confirm your address or reset your password are stored only as a scrambled fingerprint and stop working after 24 hours and 1 hour. A reset link works once and signs you out everywhere else.

When you play signed in, we also keep your level and experience points, your Signs, your duel stats (in total and per rival and level), your last 100 duels and every duel of the current UTC day (the date, rival, level, result, score and what you earned), your settings (language, sound and chosen rival) the cosmetic items and cards you own, and the cosmetics you choose to show, so they follow you to any device. Guest duels remain local unless you request a guest backup.

To stop password guessing, the server remembers the IP address of recent sign-in attempts for a minute, and the email address of recent wrong-password attempts for 15 minutes. Both are kept in memory only and never written to disk.

The daily heist

If you play the daily heist, the run is played on our server, signed in or not: we keep its moves, its result and score, the day it was played and the language of the page you started it from.

As a guest, a run is tied to a random key kept in your browser, not to you. On the day it was played you can add a finished guest run to an account, with that key or with the claim code shown on its result. A guest run nobody adds to an account is deleted 30 days after it finished or its challenge link was last opened, whichever is later, and never kept more than 60 days after it finished.

Signed in, we also keep your crew: a random tag such as Crew #4821, and a name if you choose one, with when you set it. Your ranked run’s result, score and place are shown on that day’s public board under your crew name or tag. We keep your daily streak too: the days in a row you played, your best streak, and whether a guest streak was carried into your account. All of it is in your data export and is deleted with your account; a finished run then stays on its day’s board as “A crew”.

When you share a run, its challenge link shows your crew name or tag, result, score and rival to anyone who opens it. The preview picture a chat app shows for the link carries no name. We count the daily heist’s visits, starts, finishes and challenge opens each day, by page language and by whether a player came from a challenge. Those counts carry no identifier: no account, address or device.

Prices for your region

When you open the store, our server looks up the country of your IP address in a copy of DB-IP’s country database kept on the server, to show the prices for your region in its currency: KWD in Kuwait, AED in the United Arab Emirates, EUR in Europe, GBP in the United Kingdom and USD everywhere else. The address isn’t stored for this or sent to anyone. When you pay, the payment processor’s billing country decides the region.

When you buy something

For each order we keep the item, the price and currency, any discount code, the order status and your billing country as the payment processor reports it. If our support team gives you a discount code of your own, we record which account it is for. The processor handles your card or payment details; we never see or store your full card number.

We also keep your 18 or older confirmation, the spending limit you set, and the result of any identity check (passed or not, the date and a reference). The identity documents themselves stay with the verification provider.

Optional learning study

Learn & practise offers an optional study on our own server. It sends learning steps, hint use, exercise outcomes, play dates and durations under a random study identifier. It sends no account identifier, email, card choices or replay commands. We may randomly assign consenting newcomers to guided practice or a normal duel with light coaching. You can keep playing without joining. Study records are removed after 90 days by routine cleanup; encrypted backups expire within a further 30 days. Stop sharing & delete study data removes the server record using the study token held on this device. The study is separate from your account; account deletion alone does not identify or delete an anonymous study record. You can download the learning record locally. If you clear site data, you lose the token, and any remaining study record expires through routine cleanup.

Analytics, only if you agree

We use Google Analytics to learn which pages and features people use. It runs only after you accept in the cookie banner, and nothing from Google loads before that. Advertising storage, ad user data and ad personalisation stay switched off. You can change your choice at any time with Cookie settings in the footer. Details are in the Cookie Policy.

Why we use your data

To provide your account, the game and anything you buy (our contract with you). To protect the service, prevent fraud and fix problems (our legitimate interests). To keep tax, accounting and anti-money-laundering records (legal obligations). To run analytics (your consent, which you can withdraw).

Who receives it

Our hosting provider, Hostinger, runs the servers the website and game run on. When buying with money is switched on, our payment processor and its identity partner receive what they need to take payments and run checks, and are named here first. Account emails, such as confirming your address or resetting your password, are sent from our own mailbox on that same hosting; no other company sends them. Google receives analytics data only if you agree.

We don’t sell your personal data or share it for advertising.

Transfers abroad

Some providers process data outside the country where you live. When they do, we rely on the safeguards the law requires, such as standard contractual clauses.

How long we keep it

Account data and match records: until you delete your account. Sign-in sessions: 30 days. Orders and payment records: as long as tax and accounting law requires, which can be up to 10 years. Identity check records: as long as anti-money-laundering law requires, usually 5 years after your account closes.

When you delete your account, we remove straight away your email address, password hash, sign-in sessions and emailed links, your age and email confirmations, your owned items, your spending limit, your game profile, and your level, stats, duel history and settings. We cancel unpaid orders and release their reservations. If a payment arrives afterward, we record it as money owed back rather than grant items to the deleted account. Records of payments, refunds, Founder seats, discount codes and payment disputes stay, because tax and accounting law requires them, and so do the ledger entries for Crowns and Signs, which are never rewritten. They stay only under an account number that no longer leads to your email address. Duels you played against another person stay too, because they belong to that person as well.

Your rights

You can ask to see the data we hold about you, correct it, delete it, receive a copy to take elsewhere, object to how we use it, or withdraw consent. Write to [email protected], and we reply within one month. You can also complain to the data protection authority where you live.

Children

VEYLTAK is for people aged 18 or older, and we don’t knowingly hold data about anyone younger. If you believe someone under 18 has created an account, tell us and we will delete it.

Changes to this policy

We post changes on this page with a new date, and email account holders about important ones.