Privacy policy
Last updated: 14 October 2026
In short. You don't need an email or a password to play: the game creates a guest account with the name you choose. We only store what's needed to run the game, on our own server in the European Union. We don't sell data, we don't show targeted ads, we don't use third-party analytics tools and this website uses no cookies. The game collects anonymous usage statistics on our own server, tied only to your game account: you can turn them off in Settings.
This is an English translation. In case of discrepancies, the Italian version prevails.
- Data controller
- What data we process
- Why, and on what legal basis
- What other players can see
- Where data is stored and who processes it
- How long we keep it
- Children
- Your rights
- Security
- This website and cookies
- Changes
1. Data controller
The controller of the personal data collected through the XO Kings app (iOS and Android), its game server and this website is:
Giacomo Bibbiani
Piombino (LI), Italy
Email: supporto@xokings.com
No Data Protection Officer has been appointed, as it is not required for this kind of processing. For any privacy question, write to the address above.
2. What data we process
Guest account
- the name you choose in the game (3 to 16 characters: don't use your real full name if you'd rather not);
- a numeric account ID and your friend code (in the form XO-XXXXXX);
- the access token that keeps your phone signed in: on the server we only store a cryptographic hash of it, never the token itself;
- the date the account was created and last used.
Sign in with Apple or Google (optional)
If you link your account to Apple or Google so you don't lose it when changing phone, we receive a unique identifier of your Apple or Google account, which we store to recognise you next time. We don't store your email, your real name or any password.
Game data
Card collection, decks, coins, Ink, levels, missions, pass progress, cosmetics, statistics, matches and moves played, ranked points and leaderboard position, in-game mail, gift codes redeemed and preferences (for example sound and notifications).
Friends and challenges
Friend requests, your friends list, any blocks and the challenges you play with them. We show your friends whether you're online and which mode you're playing.
Friends chat
You can send private messages only to your friends (you must both have added each other). We store the text (up to 500 characters, after the filter that masks swear words), who sent it, who received it, when, and whether it was read. We only keep the latest 200 messages for each pair of friends: older ones are deleted automatically. If you report a message, that message is saved with the report so the developer can review it. You can block a player at any time. Team matches and emotes use ready-made phrases only, never free text.
Community ideas
If you suggest an idea in the app (News → Ideas) we store its title, text, language, status and date; if you vote for an idea, we store your vote. A new idea is visible only to you until the developer approves it. Approved ideas are visible to other players in the app, with your player name, and also appear on this website's Ideas board without any personal data: only title, text, status, number of votes and any reply from the developer, with no name, friend code or anything else that leads back to you.
Technical data
When the app talks to the server we process your IP address and the technical details of the request, to protect the service (for example by limiting requests per minute) and to fix bugs.
Push notifications
If you accept notifications, we store the device token provided by Apple or Google to let you know, for example, that a friend has made their move. You can turn them off at any time in the game or in your phone settings.
Purchases (in the future)
If in-app purchases become available, payments will be handled entirely by Apple (App Store) or Google (Google Play). We will only receive transaction and product identifiers to deliver what you bought. We never see or store your payment details.
Anonymous usage statistics (you can turn them off)
To understand where the game gets stuck, the app sends short usage events to our own server (no third-party service): app opened and closed with the session length, screens opened, start and end of matches with mode and result, the tutorial, packs opened and connection errors, together with the app version, the system (iOS or Android) and the language. They are linked only to the numeric ID of your game account: no name, email, location or advertising ID. You can turn them off at any time in Settings → Anonymous usage statistics.
Reports from the app
If you use Report a problem / Give feedback, we store the text you write with the app version, system, language, current screen and your latest actions in the game; if you choose so, also a summary of your profile and of the match in progress (never access tokens).
Support requests
If you write to us, we process your email address and the content of your message to reply.
What we don't collect
We don't collect your location, contacts, photos, microphone, your phone's advertising identifier or payment details.
3. Why we process data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating the account, saving progress and running the game | Account, game data | Performance of a contract (Art. 6(1)(b)) |
| Sign in with Apple or Google and account recovery | Apple/Google identifier | Performance of a contract (Art. 6(1)(b)), at your request |
| Online features: friends, challenges, Normal, Ranked, leaderboards, mail | Account, game data, friends | Performance of a contract (Art. 6(1)(b)) |
| Friends chat, reports and blocks | Messages, friends, blocks | Performance of a contract (Art. 6(1)(b)); for the filter and reports, legitimate interest in protecting players (Art. 6(1)(f)) |
| Community ideas and the Ideas board on this website | Ideas, votes (on the website with no author data) | Performance of a contract (Art. 6(1)(b)) |
| Security, preventing abuse and cheating, fixing bugs | Technical data, game data | Legitimate interest in protecting the service and players (Art. 6(1)(f)) |
| Push notifications | Device token | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Delivering purchases and legal obligations (in the future) | Transaction identifiers | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Anonymous usage statistics to improve the game | Usage events, account ID | Legitimate interest in improving the game (Art. 6(1)(f)); you can object by turning them off in Settings |
| Reports from the app | Text, technical context, match state if chosen | Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Answering support requests | Email, message | Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
We do not sell or share your data with anyone. We don't profile you for advertising and we use no third-party analytics tools, neither in the game nor on this website: the anonymous usage statistics described above stay on our own server and are not combined with other data. If we ever introduce third-party tools, or introduce advertising, we will update this policy first and ask for your consent where the law requires it.
4. What other players can see
Other players can see your name, friend code, level, cosmetics (banner, title, avatar, board), league and leaderboard position, and the cards you play in a match. Your friends can also see whether you're online and what you're playing, and read the messages you send them. In the app, your approved ideas show your player name; on the website they don't. That's why we recommend not using your real name as your player name.
5. Where data is stored and who processes it
Game data is stored in a database on a virtual private server (VPS) run by the controller and located in the European Union. The server provider acts as a processor (Art. 28 GDPR) and does not use the data for its own purposes.
Database backups are encrypted and kept by a storage provider that also acts as a processor. Should any provider process data outside the European Economic Area, the transfer will only take place with the safeguards required by the GDPR (adequacy decision or standard contractual clauses, Arts. 45–46).
Apple and Google act as independent controllers when you download the app, sign in with their account, receive notifications through their services and make purchases. Their own policies apply: Apple, Google.
6. How long we keep data
- Account and game data: for as long as the account exists. If you ask for deletion, we delete it within 30 days. A guest account never linked to Apple or Google and inactive for more than 24 months may be deleted.
- Challenges and matches: finished challenges stay visible in the game for 7 days; moves may remain linked to the account for checks and leaderboards for as long as the account exists.
- Technical data (IP and server logs): 30 days at most, unless needed to investigate abuse.
- Backups: copies rotate and are overwritten; deleted data also disappears from backups at the end of the rotation.
- Purchases: for as long as the law requires.
- Support: up to 24 months after the last message.
- Usage statistics and reports from the app: 24 months at most, and in any case only while the account exists.
- Messages between friends: the latest 200 per pair, as long as both accounts exist. Ideas and votes: as long as the account exists (or until the developer removes the idea). Deleting your account also deletes your messages, ideas and votes.
7. Children
XO Kings is a fantasy card game designed for a broad audience: it has no realistic violence and it doesn't sell random packs. Chat is only possible between friends who have added each other, goes through a swear-word filter and every message can be reported; a player can be blocked at any time. The official age rating will be the one shown on the App Store and Google Play (PEGI and equivalent systems).
In Italy, if you are under 14, you may use the game only with the permission of a parent or legal guardian (in other countries, the age set by local law applies). A parent can ask us at any time to see or delete their child's data by writing to supporto@xokings.com. Any future purchases will go through Apple's and Google's parental controls.
8. Your rights
Under Articles 15–22 GDPR you can ask us at any time to:
- access your data and get a copy;
- rectify it (you can also change your name directly in the game);
- erase it, together with your account (see the Support page);
- restrict processing or object to processing based on legitimate interest;
- receive it in a machine-readable format (portability);
- withdraw consent, for example to notifications, without affecting processing carried out before.
Write to supporto@xokings.com with your friend code (you'll find it in your in-game profile): we need it to find your account and check that it's yours. We reply within one month. You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali, or the authority of the EU country where you live.
9. Security
Communication between the app and the server is encrypted (HTTPS). Access tokens are stored only as a cryptographic hash, server access is restricted to the controller and the database uses a user with only the permissions it needs. No system is 100% secure: in case of a data breach affecting you, we will notify you and the supervisory authority as required by law.
10. This website and cookies
This website uses no cookies, neither technical nor profiling ones, and no analytics or tracking tools, social buttons, or fonts and scripts loaded from other sites: the fonts too (Lilita One and Nunito Sans, under the SIL Open Font License) are hosted here. That's why there's no cookie banner. The News, Roadmap and Ideas board pages read their data from the game server, on the same domain, without sending any data of yours. For security reasons, the server hosting this website logs the IP address and the requested page; these logs are kept for 30 days at most.
11. Changes
We may update this policy, for example when new features such as purchases arrive. The current version is always on this page, with the date of the last update; for important changes we'll also let you know in the game.