Your data and choices

Privacy in 18 Days

This page lists everything 18 Days: Kurukshetra collects, why, who else sees it, how long it is kept, and how to have it deleted. It covers the website play18days.com and the 18 Days apps.

Last updated: 19 October 2026.

In short

• You can play without signing in. The game still gives your device a random account number so your progress can be saved online.
• If you sign in with Google, we keep your email address. We do not keep your Google name or profile picture.
• Your player name and Score are shown on the public leaderboard. Your player name and warrior face are shown to the players you meet online. No one sees your real name or your Google picture.
• We do not sell your data, show ads, or build advertising profiles.
• Google Analytics stays off unless you accept it. Notifications stay off unless you turn them on.
• Sign-in is for players aged 13 and over.
• You can delete your account and its data at any time.

Who we are

18 Days: Kurukshetra is built and run by Udipta Basumatari ("we", "us"). We decide how your data is used. Our data protection officer is Udipta Basumatari. For anything about your data, email play18days@gmail.com, or open Settings in the game and choose Reach out to us. Never send your recovery seal in a message.

What we collect and why

Your account, signed in or not

The first time you play, your device makes a random account number and a secret key. Our server keeps the account number and a scrambled form of the key (a one-way hash), never the key itself. With them the server keeps:

• your player name, which the game makes from three words and a number (you can ask for a new one, but you cannot type one);
• the warrior face you picked from the game's warrior cards, if any;
• your progress: Score, levels and standing in each house, campaigns started and won, Astras and rewards won, Story chapters cleared with their stars, the answers you chose and when you cleared each one.

We use these to save your game online, let you carry it to another device, rank you on the leaderboard and run multiplayer. Unfinished Long Campaign sprints are saved to your account too, so you can resume them on another device. Each time your saved progress is replaced, except when a daily check-in adds its Merit, the server keeps the earlier copy, up to the ten most recent, so we can restore lost progress. Battles still being played and your settings stay on your device and are not sent.

Signing in with Google

When you sign in, Google tells us your email address (only if Google has verified it), your name and the address of your Google profile picture. We keep only the email, and discard the name and picture straight away. The email links your progress to you, so you can recover it on any device and so we can answer you about your account. Only you see it, in your account. Every player, you included, shows a made player name and a warrior card as their face. Google's sign-in button is loaded from Google only on the screens that show it.

Signing in with Apple

Apple sign-in is not switched on yet. When it is, Apple tells us your email address, which may be a private Apple relay address, and an Apple account number if you add Apple sign-in to an existing account. We keep those for the same reasons as with Google. Apple does not share a name or picture with us.

The age question

Before the sign-in buttons appear, the game asks your birth month and year. Your device keeps only whether you are 13 or over. The date is never kept and never sent to us.

Multiplayer

Multiplayer needs a signed-in account. When you play online we keep:

• the army you bring, every move, and the state of each match, so the server can run it fairly;
• your multiplayer rating, your multiplayer Score, and the stakes of ranked matches;
• your friends: after a match between two real people, each of you is added to the other's friends list (5 at most, and you can remove them);
• challenges and rematch requests you send or answer, and invite codes you create;
• when you last had the game open and when you last touched the screen, so friends see whether you are here, here recently or away, and so the game knows when to let your stand-in play;
• your stand-in settings and the army it uses when you are away.

Buying the Asura Pass

On the website the pass is sold by Stripe, which acts as the seller (merchant of record): Stripe takes your card or other payment details on its own page and handles tax, and we never see your payment details. We send Stripe only your account number, so it can tell us which account paid. In the Android app the pass is sold by Google Play, and in the iPhone app by Apple, under their own terms. From each we keep only what proves the purchase: the payment or transaction reference, which account it belongs to, when it was granted, and whether it was refunded. Your device also keeps a signed note that you hold the pass, so it works offline.

App reviews on Android

The game keeps a local record of completed Quickplay matches, Campaign sprints and distinct Story chapters to decide when to ask for a Google Play review. It also keeps the date of the last request, so it can wait at least 90 days before asking again. These records are not uploaded to our servers. Google Play handles the review panel and any review you choose to submit under its own terms. The review API does not tell the game whether the panel appeared or whether you submitted a review.

Notifications

Notifications are off until you turn them on in Settings or the Multiplayer Hall. When you do, your browser or phone gives us an address for this device at its push service (Google, Mozilla, Apple or Microsoft) and two keys, so only your device can read what we send. We keep those, the kinds of notification you chose, and when each kind last reached the device. Some notifications name other players, for example "Steadfast River Archer 42 challenges you" or "Steadfast River Archer 42 passed you on the Leaderboard", so your player name can appear on other players' phones in the same way.

Feedback and error reports

When you send feedback, we keep your message, your account number and the game version. When the game hits an error, it sends us the error message and where in the code it happened (at most 3 a session), with your account number and the game version. We use these only to fix problems.

The iPhone app waiting list

If you tap Notify me under "iPhone app coming soon", we note your signed-in account and the date, so we can email you once when the iPhone app is out. We keep nothing else for this.

Fair play

The server checks each upload of progress against what honest play can reach in the time since the last one. If an upload is impossible, the server keeps its own copy of that part and marks the account with the reason and the time. A marked account is left off the leaderboard. You are told your account was marked and can ask for a review from your Profile.

Your connection

Every request carries your internet address. To protect the game from scripts, the server counts requests per address in memory for one minute and never stores the address. For new accounts and feedback it keeps a shortened one-way code of the address with a count, and clears those as later requests come in. To show the right payment choices, the server reads which country you are connecting from; it is not stored. Cloudflare, which hosts the game, handles every request on our behalf.

Google Analytics, only if you accept

Google Analytics is off until you choose Accept analytics. You can browse and play without accepting. If you accept, Google Analytics uses cookies to measure visits, where they came from, pages viewed and clicks from our public pages into the game. Google processes technical information such as browser and device details. We send no player name, email, account number, recovery seal, army, match or feedback, and only the address of our public pages, never of a game screen. Advertising features and Google signals are off. Turn off analytics anytime with the button at the bottom of this page or in the game's Settings. That stops collection and clears its cookies, without erasing what was already measured.

What other people can see

• Anyone, on the public leaderboard: your player name, Score, rank and the warrior face you picked (or the one picked for you). Never your Google name or picture. A marked account is not shown.
• Players you meet online: your player name, warrior face, house and level. Never your Google name or picture.
• Your friends: the same, plus whether you are here, here recently or away, and when you last played together. Friends lists hold your account number, which is how a challenge reaches you.
• Through notifications: your player name, when you challenge someone or pass them on the leaderboard.

Your email address is never shown to other players.

On your device

The game keeps these in your browser's storage, or the app's: your account number and secret key; your signed-in email; your progress, saved battles, armies and lessons; your settings and choices (sound, motion, notifications, analytics, the age answer); a signed note if you hold the pass; and, after you sign out, a copy of that account's progress without its key, so signing back in loses nothing. To work offline it also keeps a copy of the game's files and of the card pictures you have seen. Anyone who has your secret key can use your account, so keep your recovery seal private.

Cookies: the game sets none for players. Google Analytics sets its cookies only after you accept. Clearing your browser's site data removes everything above from that device; progress saved online stays with your account.

Who else handles your data

• Cloudflare hosts the game, its server and its database, and protects them. It handles every request.
• Google: sign-in, Google Analytics if you accept it, Google Play purchases in the Android app, and push delivery to Chrome and Android.
• Apple: App Store purchases, Apple sign-in once it is on, and push delivery to Safari and iPhone.
• Stripe: website purchases, as the seller.
• Mozilla and Microsoft: push delivery to Firefox and Edge.

Each handles data under its own privacy policy. We do not sell or rent your data, and we share it with nobody else, unless the law requires it.

How long we keep it

• Your account, progress, Google sign-in details, rating, friends and multiplayer Score: until you delete your account. If you played as a guest and then sign in to an account you already had, the guest's progress moves into that account and the guest's own records are deleted.
• Unfinished Long Campaign sprints and the ten most recent earlier saves of your progress: until you delete your account.
• Your daily check-in record, which holds the day, time, army and Merit of each claim: until you delete your account.
• Finished multiplayer matches and their moves: about 14 days after the match ends.
• Your place in the matchmaking queue: until you are paired or leave.
• Devices for notifications: until you turn notifications off, the push service tells us the device is gone, or you delete your account.
• Feedback and error reports: 12 months, or until you delete your account if that is sooner. We read them only to fix problems.
• After you delete your account, two records stay with no time limit, and neither holds your name or email: the reference of a pass purchase, marked as belonging to a deleted account, so the same purchase cannot be claimed twice; and a scrambled form of the deleted account number, so a device that still holds it cannot bring the account back. Stripe, Google and Apple keep their own records of a purchase under their policies.

We do not delete accounts for being inactive.

Why we are allowed to use it

We follow India's Digital Personal Data Protection Act 2023. The game is built and run from Singapore, so we also follow Singapore's Personal Data Protection Act 2012 (PDPA). Under both, we collect and use your data only for the purposes on this page, which you agree to by playing or by turning on the choices that need your consent, and we tell you before using it for anything new.

If you are in the European Union, the United Kingdom or a place with similar law, these are our legal grounds:

• To provide the game you asked for (your account, saves, multiplayer, the pass): performing our agreement with you.
• To keep the game safe and fair, fix errors and stop abuse: our legitimate interest in a working, fair game, which these uses do not outweigh your rights in.
• Google Analytics and notifications: your consent, which you can take back at any time.
• Purchase records: the law on payment and tax records.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to receive it in a form you can take elsewhere, or to stop using it for a purpose, and you can object to our legitimate-interest uses. Get a new player name and pick a different face in Profile. Delete your account in the game under Settings, Delete account, or follow How to delete your account. For anything else, email play18days@gmail.com from the address you signed in with. We answer within one month. You can also complain to the data protection authority where you live, in India to the Data Protection Board of India, or in Singapore to the Personal Data Protection Commission.

Children

Sign-in, multiplayer and purchases are for players aged 13 and over, and the game asks your birth month and year before you can sign in. Anyone can play without signing in, and then we hold no email, real name or picture. If you believe a child under 13 has signed in, email play18days@gmail.com and we will delete the account.

Data across borders

Cloudflare and the other services above run in many countries, including the United States. Where data about people in the European Union or the United Kingdom leaves them, those services protect it with the safeguards the law requires, such as the European Commission's standard contractual clauses.

Security

All traffic is encrypted. The server keeps only scrambled forms of account keys, holds no payment details, and checks your key on every request that touches your account. No system is perfectly safe: if a breach puts your data at risk, we will tell you and the authorities, including the Data Protection Board of India and Singapore's Personal Data Protection Commission, as the law requires.

Complaints

Grievance officer (India). Udipta Basumatari, Founder. Email play18days@gmail.com with "Grievance" in the subject. We acknowledge a complaint within 48 hours and resolve it within one month of receiving it.

Changes to this page

When we change what we collect or how we use it, we update this page and the date at the top. For important changes we also tell you in the game.

Read the Terms of Play for the rules of the game and the pass.