Privacy Policy of the Game “CarmineArena”

Edition of 30 October 2026 · English translation · website carminearena.ru

1. Who processes the data

The personal data operator is individual entrepreneur Anton Sergeyevich Komarov (OGRNIP 326774600715141, INN 572004996000; entered in the Unified State Register of Individual Entrepreneurs on 30 September 2026 by the Interdistrict Inspectorate of the Federal Tax Service No. 46 for Moscow).

The Operator determines the purposes and means of processing personal data on its own. The server part of the Game and the database are located in the Russian Federation.

2. Principles we follow

• Lawfulness. Data is processed only on a legal ground and only for the purposes listed in Section 5. It is not used for other purposes.
• Minimisation. Only what a stated purpose cannot do without is collected. The Game works fully even if you tell us nothing about yourself.
• Transparency. The list of data in Section 3 matches what the program actually collects, not what is “customary to write”. When the set of data changes, this document changes too.
• Storage limitation. Data is not kept longer than the periods in Section 8.
• Security. The technical and organisational measures described in Section 15 are applied.

3. What data is collected

3.1. Data you provide yourself

Everything in this section is optional. The Game works fully without it; only the named capability is lost.

3.2. Data the Game creates itself

3.3. Usage statistics (only with your consent)

If you have agreed to statistics collection, the Game records events: app launch, start and end of a run, signing in to the account and linking it to an email, opening and purchasing store items, entering or skipping the receipt email (without the address itself), showing and closing offers, watching rewarded ads, tutorial steps, clan actions, viewing leaderboards, saving and applying builds, expeditions, events and the season pass, finds, receiving and spending in-game currency (how much, where from and on what).

When purchasing on the website with your consent, three events are recorded: opening the store, starting payment and its confirmation. Opening the store before signing in to an account is recorded without linking to anyone.

Each event consists of: the event name, the time and a small set of game attributes — for example, the wave number, the store item identifier, the slot number, the reason for a refusal, the build version.

Until you have passed the consent screen, the Game does not record a single event. If statistics collection is not allowed, events about you are neither recorded nor accumulated. Without linking to anyone, the server records only two kinds of events — opening the website store before signing in and a refusal to link an email of a non-Russian service: they contain neither the address, nor the email domain, nor the account identifier — only the event name and time.

Everything in this subsection concerns the events our server receives. The AppMetrica install counter, which is turned on by the same consent, is described in Subsection 3.4.

3.4. AppMetrica install counter (only with your consent)

With the same consent to statistics (Section 6), the Game turns on AppMetrica — a mobile app statistics service of YANDEX LLC. Without consent, AppMetrica is not turned on in the Game and receives nothing.

AppMetrica receives: device information (model, system version, language and the like) and the device identifier it assigns; the device's advertising identifier, unless it has been deleted in the phone settings; the install source — which ad or which store page the Game was installed from; the device's network address (IP), including for matching an install with an ad; Game launches and session length; information about Game crashes; the event of the first run played; purchases — the item name and the amount in roubles.

Why: to understand which ads for the Game bring players and whether they pay off, and to see Game crashes on players' devices.

4. What we do not collect

• Bank card data. It is entered on the payment service side and is not passed to the Operator in any form.
• Precise location. The Game does not request location permission and does not use it.
• Contacts, photos, files, microphone, camera. The Game does not access them.
• Content of messages between players. The Game has no in-game chat.
• Special categories of data (health, beliefs, ethnicity and the like).
• Biometric data. Not collected or processed. The YooKassa payment form in the Game may offer to confirm a payment with a fingerprint or face — using the phone's system tools (that is why the Game's permissions include “biometrics” and “fingerprint”): the comparison is done by the system itself, and the fingerprint or face image is passed neither to the Game nor to the Operator.

The IP address is used by the server to protect against an excessive number of requests and password guessing: the count of failed sign-in attempts for an email address from that IP lasts 15 minutes and is kept only in the server's memory, without being written to disk; an expired count is erased at the next memory clean-up and when the server restarts. The player's IP address is not stored in usage statistics or in the server logs; it may appear only in a rare message about a crash of the web server itself. The AppMetrica install counter receives the device's IP address on its own — Subsection 3.4.

A modified Game (clause 11 of the offer) reports to the server only the reason for disconnection, the build version and the fingerprint of the certificate it is signed with — without the account or device identifier. The server keeps these reports as a daily count for 180 days.

5. Purposes and legal grounds

6. Consent to statistics and its withdrawal

1. On the first launch, the Game shows a screen where statistics collection is allowed with a separate switch. It is off by default: collection takes place only if you yourself turned the switch on and pressed “Continue”. The “Continue” button itself means accepting the public offer and is not consent to statistics. Until the screen is passed, nothing is collected.
2. Refusing affects nothing: the Game, progress, purchases and technical support work fully.
3. You can change your answer at any time — allow collection or withdraw consent: with the “Game statistics” switch in the Game's “Settings” or by email to the address in Section 16 stating the account identifier. After withdrawal, collection stops, and the events of our statistics collected earlier (Subsection 3.3) are deleted within no more than 30 calendar days.
4. Consent to statistics also covers the AppMetrica install counter (Subsection 3.4). After withdrawal, the Game stops passing information to AppMetrica. Information already passed is kept in AppMetrica without a link to the Game account, email or nickname, so the information of one player cannot be singled out: AppMetrica deletes it only together with all of the Game's statistics.
5. Withdrawing consent to statistics does not stop the processing of data needed for the Game to work and for the performance of the agreement (Sections 3.1 and 3.2): to stop it, the account must be deleted — see Section 11.
6. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Advertising

The Game has optional rewarded ads: a video is shown only when you press the button and gives an in-game reward. There are no forced ads in the Game.

Ads are shown by Yandex Advertising (Yandex Mobile Ads). Its library in the Game starts only when you yourself press the button to watch a video; until then it does not run and collects nothing. To show a video, the platform itself obtains technical information about the device, and to select ads matching your interests — the device's advertising identifier. Interest-based selection happens only with your consent, given on the consent screen at the first launch or later in the Game's “Settings” (“Ads by interests”); without consent, the video is shown without selection. The Operator neither receives nor stores this data.

Yandex privacy policy: yandex.ru/legal/confidential

8. Retention periods

9. Who receives the data

The Operator does not sell personal data, does not transfer it for other parties' advertising and does not provide it to third parties for their own purposes. Data is transferred only to the extent necessary for the services listed below to work.

In addition, the Operator may disclose data when necessary to protect its rights and legitimate interests: when a dispute is considered, when fraudulent actions are investigated, and when the security of the Game or its users is threatened. Disclosure is made to the minimum extent necessary.

Game data and purchase data are stored in the Russian Federation.

10. Your rights

Under Law 152-FZ you have the right to:

• obtain confirmation of processing, information about its purposes, grounds, methods and periods, and about the persons who have access to the data;
• obtain a copy of the data being processed;
• demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
• demand that the processing of your data be stopped — except where the law allows it without consent, for example keeping purchase records under tax law (Section 11);
• withdraw consent to statistics (Section 6);
• appeal against the Operator's actions to Roskomnadzor (rkn.gov.ru) or to a court, including claiming compensation for losses and moral damage.

Requests are sent to the address in Section 16. The periods follow Articles 20 and 21 of Law 152-FZ:

• information about your data and the opportunity to review it, or a reasoned reply in case of refusal: no more than 10 working days from receipt of the request;
• stopping processing at your demand: no more than 10 working days from receipt of the demand;
• these two periods may be extended by no more than 5 working days — in that case we will tell you the reason for the extension before they expire;
• correcting incomplete, inaccurate or outdated data, and destroying data obtained unlawfully or not needed for the purpose of processing: no more than 7 working days from receipt of supporting information;
• withdrawal of consent to statistics: collection stops immediately, collected events of our statistics are deleted within no more than 30 days, and passing to AppMetrica stops (Section 6).

To find your data, give the account identifier (for a guest account it is shown in the Game in “Settings”) or the email address the account is registered to. If it cannot be established from the request that it comes from you, the Operator may ask for additional information: this protects your own data from being handed to a stranger.

11. Deleting the account

1. You can delete the account using the Game — in “Settings” — or by email to the address in Section 16.
2. After deletion, the following are irreversibly lost: game progress, in-game units and all purchased additional features. No money is refunded.
3. The account is marked as deleted immediately, the email address and the password hash are erased at once, and signing in becomes impossible. The other related data is deleted within no more than 30 calendar days.
4. Exception: purchase and payment records are kept for the period established by the laws on taxes and accounting — they cannot be deleted on request. These records are used for nothing except compliance with the law.

12. Children and legal representatives

The Game is not intended for children under 13 and does not knowingly collect data about them.

A person who has not reached the age of full legal capacity uses the Game and makes purchases with the consent of a parent or another legal representative. Consent to the processing of such a person's personal data is given by their legal representative; by starting to use the Game, the minor confirms that such consent has been obtained.

If you are a parent or legal representative and believe that your child has provided us with data, write to the address in Section 16 — we will delete it and stop further collection.

13. Users outside Russia

The Game is intended for users from the Russian Federation, and this Policy is drawn up under Russian law. If you use the Game from another country, you understand and agree that your data is processed and stored in the Russian Federation in the manner described in this Policy.

14. Transfer of rights to the Game

The Operator may transfer the rights to the Game to another person — including when its legal status changes, when a legal entity is created or when the Game is sold. In that case, personal data is transferred to the new operator to the extent necessary to keep the Game running and to preserve your accounts, progress and paid features.

The new operator assumes the obligations under this Policy. A change of operator is announced on carminearena.ru at least 15 calendar days in advance; before this period expires you may delete your account.

15. Security and changes

1. Data between the Game and the server is exchanged over a secure connection. Passwords are stored only as an irreversible cryptographic hash — the original password cannot be recovered either by us or by anyone who gains access to the database.
2. Access to the database is restricted, and backups are encrypted. The number of failed sign-in attempts is limited — this protects your account from password guessing.
3. No method of transmitting and storing data gives absolute protection. We apply reasonable technical and organisational measures but cannot guarantee complete security.
4. The Policy may change. The new edition is published on the official website https://carminearena.ru and takes effect 15 calendar days after publication. Changes are announced only by publishing the new edition on the website. Using the Game after the changes take effect means agreement with the new edition.

16. Contacts

Write to this address on any matter: access to data, a copy, correction, stopping processing, withdrawing consent, deleting the account, a complaint. Reply periods are in Section 10.