Privacy Policy

Summary

Who we are

Dracore is our game and service brand (“we”, “us”, “our”). The individual developer responsible for Dracore is identified in the Contact section below. We are responsible for the personal data described in this policy and act as the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

You can contact us about privacy at support@dracore.app. Beta testers can also send feedback through TestFlight.

Offline play & data on your device

You can raise dragons, train and play offline battles without an internet connection or an online account. Real-world map imagery, public destinations and online features need a connection. Your eggs, dragons, inventory, settings and other progress are stored locally on your iPhone. We receive a progress snapshot if you turn on Cloud Backup, search for a ranked or unranked online match, or choose to release or tame a shared wild dragon, as described below.

iCloud save

If your iPhone is signed in to iCloud, Dracore keeps a compressed copy of your save in your own iCloud account using Apple’s iCloud key-value storage. This is how your sanctuary comes back if you delete and reinstall the app or move to a new device. The copy is stored and protected by Apple under your Apple Account; it is never sent to Dracore’s server and we cannot access it. You can turn it off in Settings→iCloud save, or manage all iCloud data for your apps in the iOS Settings app under your name → iCloud.

If you delete the app, iOS removes the app’s local data, including your progress. See Delete account & data for one important detail about the iOS Keychain.

Optional online features & your anonymous account

Dracore offers optional online features that use the Dracore server:

• Online duels and seasonal rankings — ranked or unranked searches, legacy quick matches and private room-code battles. Starting a ranked or unranked search uploads your save to verify your selected dragon and level, even when optional Cloud Backup is off. A broad region you choose can filter searches; matchmaking does not request precise GPS. Seasonal and legacy leaderboards display warden names, ratings and records publicly.
• Private guilds — create a guild or join through a single-use invitation. Your warden name and member role are visible to other members. Guilds do not include public chat.
• Shared wild dragons — released dragons roam an approximate map region and can be encountered by other players. Releasing or taming one uploads a progress snapshot to verify ownership, eligibility and delivery. This feature needs a connection even when optional Cloud Backup is off.
• Cloud Backup — an opt-in backup of your game save. It is off by default and can be turned on or off in Settings→Online.

The first time you use one of these features, the app creates an anonymous account: a randomly generated ID and a secret token. The token is stored in the iOS Keychain on your device. Our server stores only a salted hash of the token, never the token itself. No email address, password, phone number or real name is requested or required. When you make an in-app purchase, an anonymous account may also be used to verify delivery and prevent a transaction being credited to multiple accounts.

What the server stores

Please choose a warden name that does not contain your real name or other personal information, because it is visible to other players.

Camera, location, Bluetooth & local network permissions

Camera

Dracore asks for camera access only for augmented-reality features: AR Explore mode (walking your space and following glowing footprints to hidden eggs, equipment and caches). Dragon placement and camera-based hand gestures are unavailable in this release. All camera processing happens on your device. Camera images and video are never uploaded, stored by us or shared. The game remains playable if you decline camera access; only AR features are unavailable.

Location, the World map and weather

Shared wild dragons. Nearby population requests contain a coarse map-area ID, not precise GPS coordinates. A recent position can remain in device memory for up to two minutes after leaving exploration to offer nearby arena encounters; this does not keep GPS running or save a travel history. Releasing a dragon stores its approximate region so it can roam nearby; other players see the dragon's roaming position and in-game identity, never its former owner's account or precise release point. The region is part of the shared game world rather than a record of your travel. Deleting your online account removes the account association; a dragon you released continues to exist in the wild. Capture records preserve world ownership and prevent the same dragon being claimed twice.

The World map. When you open the World tab, Dracore asks for location access while you use the app to place you on the map and show discoveries within walking distance. Mapbox receives requests for the map squares around you to supply imagery and building footprints under Mapbox’s Privacy Policy. The public-place service receives a coarse map-area ID to return named destinations; it does not receive your account token or precise GPS coordinates. Its access logs do not retain the requested area. This service is being introduced with limited pilot coverage.

AR exploration. Foreground location may trigger distant dragon flyovers, with a timed fallback when a reliable fix is unavailable. To choose a regional fantasy lineage, the app may send Apple’s geocoding service the centre of a coarse map cell (roughly 20–40 km), rather than your precise position. Only the returned country code is cached in memory. No background location permission is requested. Mystical sky preview is unavailable in this release.

Discovery records. The game saves identifiers for recently collected finds to prevent the same item reappearing. These identifiers contain map-area and time information and can reveal recent collection locations. They are part of your local save, your own iCloud save if enabled, and server progress snapshots when you enable Cloud Backup, search for a ranked or unranked online match, or release or tame a shared wild dragon. These records may remain in saves from older app versions. Updated builds remove expired records when the game resumes or saves; older local and cloud backup copies may retain them until replaced or deleted under the backup retention policy below. We do not show these locations to other players.

Map motion. While the World map is open, the app uses your phone’s compass heading and estimates travel speed from location updates to orient and animate your companion. These motion values are processed on your device and are not included in your save or sent to our server. Building and map tiles are cached locally within bounded storage limits. The map stops requesting GPS and compass updates when you leave it. Declining location leaves raising, training and offline battles available.

Local weather. AR exploration can request approximate location while the app is in use to obtain current conditions from Apple WeatherKit. Apple receives that weather request under Apple’s Privacy Policy; the weather feature does not send the location to Dracore’s server. The game keeps weather conditions and hemisphere for seasons. If you decline, discovery uses your device’s clock and neutral weather. Weather data is provided by Apple Weather (data sources).

Game Center

If you are signed in to Game Center, Dracore reports achievements and leaderboard scores (victories, dragons tamed, highest dragon level) to Apple Game Center, where they are shown to you and, depending on your Game Center settings, to your friends and other players. Game Center is operated by Apple under your Apple Account.

Bluetooth & local network

Bluetooth and local network access are used only for nearby duels: to let wardens around you see your warden name and your dragon’s name and level, send a challenge, and connect your two devices directly and encrypted. Nothing about nearby duels passes through our server, and this access is not used for any other purpose.

This website

dracore.app is hosted by Vercel. Delivering its pages, images, models and videos involves ordinary connection information such as your IP address, browser information and requested URL. Vercel processes this information to deliver and secure the site under Vercel’s Privacy Policy. We do not install advertising cookies, cross-site tracking scripts, advertising SDKs or visitor analytics on this website. The homepage loads its hero, companion and lineage previews as their sections enter view; choosing another lineage loads its model. On the Field Codex, a 3D model loads only after you open that specimen, and only one specimen is active at a time. The Book of Dragons has 35 available films across three seasons; Season 3 Episode 3 is marked unavailable. Episode videos load when you choose to play them; watching them sends ordinary media-delivery requests to our hosting service. The Codex model viewer does not request your camera or location.

Requesting a beta invitation opens your email app. If you send that email, we receive the address and information you include and use it to manage the invitation and respond. Watching the homepage reveal plays a video hosted on this site, without a third-party video player.

What we don’t do

• The production release configuration uses Google Mobile Ads 11.5.0 and UMP with live AdMob identifiers. Development and test builds may use Google test units. The website contains no advertising SDK.
• The app includes Google Mobile Ads and UMP; their data practices are described below. We do not use a separate third-party analytics SDK.
• We do not sell personal data or use location or gameplay progress to target ads. The app does not request ATT authorization. When age and UMP checks allow ads, Google receives non-personalized requests with Google Limited Ads mode enabled before SDK initialization and each ad load. This privacy mode does not mean zero SDK data collection. You can turn advertising off by choosing “Under 16 or prefer not to say” in Settings → Advertising; this stops ad requests and does not restrict core play. Where required, Privacy choices in the same section also opens Google’s regional consent and opt-out controls.
• Advertising is available only to people who select “I am 16 or older” in Settings. This is a self-selected age band; the app does not ask for or store a birth date. UMP updates consent information, presents any required regional consent form, and controls whether requests may be made. People who select “Under 16 or prefer not to say” have no ads or ad-removal offer. Raising dragons, training and battles do not depend on advertising choices.
• We do not share your location with other players or use it for advertising. Map-area requests and optional backup discovery records are described above. We do not collect contacts, photos, health data or payment details.

Advertising

The production release configuration uses Google Mobile Ads 11.5.0 and UMP with live AdMob identifiers; development and test builds may use Google’s test units. An App Store-channel build distributed through TestFlight uses live ad identifiers, while TestFlight purchases use Apple’s sandbox. People who select “I am 16 or older” in Settings and complete any required UMP choices may see a top gameplay banner and choose one optional reward video per rolling 24 hours. Before SDK initialization and each banner or reward load, Dracore enables Google Limited Ads mode; requests are also non-personalized, publisher personalization is disabled, and the publisher first-party ID is off. Dracore does not request ATT authorization and does not show interstitial ads. A completed video grants a choice of 50 ordinary coins, one Roast Haunch or one Healing Draught. Skipping a video does not block play. Remove Ads Forever is a one-time, non-consumable Apple purchase that disables banner and reward ads and substitutes a random daily reward from the same three choices, sharing the same rolling 24-hour allowance. Google Mobile Ads and UMP may still process device and interaction information as described below; these settings do not mean zero SDK collection. Restore Purchases is included. Public App Store ads and purchases are available only if Apple approves and releases that build.

Google’s iOS Mobile Ads SDK may process your IP address (which can estimate general location), device identifiers, advertising data such as ads viewed, product interactions such as app launches and video views, crash diagnostics and app performance data. Google may use this information for ad serving, measurement, analytics and SDK improvement, and may share some information with advertising providers. UMP may process coarse location, performance data and product interactions for consent and app functionality. Dracore enables Google Limited Ads mode before SDK initialization and each ad load, sends non-personalized requests, disables publisher personalization and Publisher First-Party ID, and limits ad content to PG. These settings do not mean zero SDK data collection. Dracore does not request ATT authorization. We do not use location or gameplay progress to select ads.

For people who select “I am 16 or older,” UMP updates consent information, presents any required regional consent form at a safe Sanctuary pause, and determines whether ads may be requested. The app stores only the selected age band on the device, not a birth date. Choosing “Under 16 or prefer not to say” leaves ads and the ad-removal offer unavailable. UMP privacy options are exposed when UMP marks them as required. Regional consent requirements depend on the app user’s location; website visitors are governed by the separate website practices above. TestFlight includes the ad SDK and may show UMP consent/privacy forms; the current app does not request ATT.

Advertising opt-out controls are described above. Non-personalized requests do not stop the ad SDK from processing the information described here.

References: Google’s Unity Limited Ads setting, Google’s Unity ad-serving modes, Google Mobile Ads SDK iOS data disclosure, Google UMP for iOS, and Apple privacy and data use.

Optional fixed-amount coin packs are included in the production release configuration. If that build is distributed through TestFlight, Apple processes purchases in its sandbox; public App Store availability depends on Apple’s review and release. Apple processes payment details for purchases. To verify delivery and prevent duplicate coin grants, Dracore’s server receives the signed transaction ID, product ID, purchase environment and a pseudonymous account identifier; it does not receive your card or payment credentials. Transaction identifiers are retained as described below.

Apple TestFlight. While Dracore is in beta, Apple’s TestFlight service may collect crash reports, usage information and any feedback or screenshots you choose to send. That data is collected and handled by Apple under Apple’s Privacy Policy and the TestFlight terms, and is shared with us as the developer only as TestFlight provides.

How and why we use data

We use the limited data above only to provide the features you ask for, keep the service secure and fair, and respond to you. Under the GDPR and UK GDPR our legal bases are:

• Performance of a contract — to provide online duels, rankings, private guilds, shared wild dragons and Cloud Backup when you choose to use them.
• Legitimate interests — to secure the server, apply rate limits and prevent cheating and abuse, using pseudonymised data (such as hashed IP tags) to minimise impact on you.
• Consent — for advertising processing that requires consent, managed through Google’s regional privacy choices. You can withdraw those choices using the controls described above.
• Legal obligation — where we must retain or disclose information to comply with law.

If you email us, we use your email address and message only to respond and keep a record of the request.

Sharing & service providers

• Other players: your warden name, and the moves and results of a duel, are visible to your opponent. Leaderboards publicly show warden names, ratings and win/loss/draw records. Your guild name, warden name, role and join time are visible within your private guild.
• Hosting provider: the Dracore server runs on a virtual private server operated by our hosting provider, who processes data on our behalf and under our instructions.
• Mapbox and Vercel: map imagery/building data and website hosting respectively, as described above.
• Support email: Cloudflare Email Routing forwards messages sent to support@dracore.app to our Google Gmail inbox. Cloudflare and Google process the sender address, message and attachments to deliver and store your support request. We use this information to respond.
• Apple: as described above for iCloud save, WeatherKit, Game Center and TestFlight. Apple processes payments, including TestFlight sandbox purchases; Dracore receives only transaction data needed to verify and deliver a purchase.
• Google and advertising providers: in production release builds, SDK ad-request and measurement data are processed as described under Advertising above; development and test builds may use Google test units. They do not receive your AR camera images, Dracore account token or game-save snapshot from us.
• Legal reasons: we may disclose information if required by law, or to protect the rights, safety and security of our players, our service or others.
• Business transfers: if Dracore is transferred to another owner, this data may transfer with it, subject to this policy.

Retention

• Anonymous account and warden name: kept until you delete your online data.
• Ratings and guilds: ratings are kept until online-account deletion. Guild membership remains until you leave or delete your account. Invitations expire after 24 hours and can be used once; their hashes and usage records remain while the guild exists. When a guild owner leaves or deletes their account, ownership passes to the oldest remaining member; an empty guild is closed.
• Server progress snapshots and cloud backups: only the last 5 revisions are kept; older revisions are replaced automatically. All backups are erased when you delete your online data.
• Purchase transaction records: when an in-app purchase is made, the transaction ID, product and environment are retained as a minimal anti-replay record. Deleting your online account removes its link to that record, but the transaction tombstone remains so the same Apple purchase cannot be credited to another account.
• Duel records: kept for as long as needed to operate matches and protect fair play. When you delete your online data, your account is removed from every duel record, leaving only an anonymous outcome, turn count and timestamps.
• Server logs: kept only as long as needed for rate limiting, security and abuse prevention.
• Support emails: kept as long as needed to resolve your request and for our records.

Deleting your account and data

In the app, go to Settings→Online→Delete online data. This immediately and permanently erases your online account, progress snapshots, ratings and guild membership from our server. Guild ownership transfers to a remaining member, or an empty guild is closed. Minimal transaction tombstones described above remain without an account link to prevent duplicate credit. Progress saved on your device, and its copy in your own iCloud, is not affected. To remove the iCloud copy too, turn off Settings→iCloud save in Dracore, or delete Dracore’s data in the iOS Settings app under your name → iCloud → Manage Storage.

If you no longer have the app installed, email support@dracore.app. Full instructions are on the Delete account & data page.

Your privacy rights

EU / EEA and UK (GDPR and UK GDPR)

You have the right to access your personal data, to rectify it, to erase it, to restrict or object to processing, and to data portability (receiving your data, such as your cloud save, in a portable format). You may also lodge a complaint with your local data protection authority — in the UK, the Information Commissioner’s Office (ICO).

California (CCPA / CPRA)

California residents have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; and to not be discriminated against for exercising these rights. We do not sell personal information. Google may process ad-request and measurement information as described above; Dracore sends non-personalized requests and does not use location or gameplay progress to select ads. You can stop Dracore ad requests by choosing “Under 16 or prefer not to say” in Settings → Advertising, without losing core play, and use Privacy choices when regional controls are required. Location processing and optional backup discovery records are described above.

How to exercise your rights

The fastest way to delete your data is in the app. For access, portability, correction or any other request, email support@dracore.app. Because accounts are anonymous, we will need to verify that the account is yours — typically by asking you to send the request details shown in the app, or to make the request from the app itself. We will respond within the time required by applicable law (usually within one month). You may use an authorised agent where the law allows.

Security

Connections to the Dracore server use HTTPS encryption. Account tokens are stored in the iOS Keychain on your device and only a salted hash is kept on the server; IP addresses are recorded only as pepper-hashed tags. No system is perfectly secure, but we design Dracore to hold as little data as possible.

Children

Dracore is for players of different ages, including children and teens. The game does not ask for or store a birth date. Ads and the Remove Ads offer are available only after a player selects “I am 16 or older”; choosing “Under 16 or prefer not to say” turns both off. Online features are optional and use an anonymous account as described above. Parents and guardians should supervise children’s use of online features and purchases and may use the device’s parental controls. To ask about or delete personal information, contact support@dracore.app.

International data transfers

Our server and service providers may be located in a country other than yours. Where personal data from the EEA or UK is transferred internationally, we rely on appropriate safeguards recognised by law, such as adequacy decisions or standard contractual clauses.

Changes to this policy

We may update this policy as Dracore evolves — for example, if new features are added. We will update the “Last updated” date above and, for significant changes, give notice in the app or on this website before they take effect.

Contact

Dracore
Developer: Matthew Terrance Holdsworth
ABN: 70 184 692 883
3/12 Macrina St
Oakleigh East, VIC 3166, Australia
Phone: +61 422 723 522
Email: support@dracore.app
Website: dracore.app