Privacy policy
Who is responsible
Merloto (Halit Kus)
Schmiedestr. 125, 47809 Krefeld, Germany
Contact: merloto@outlook.de
What stays on your phone
Your nickname, progress, settings, Curse Coins and Curse Shards, cosmetics, run statistics, cached challenges and controls are kept in the app's private storage. The operating system's app sandbox protects them; the game adds no extra encryption.
Local analytics is off unless you turn it on. Its counters stay on this phone for the current session and are never sent anywhere.
Online play
Online features use a pseudonymous guest account: a random account ID and the display name you chose. Our online service (Supabase) processes this ID, your name, the challenges you play and share, attempts and their results (completion, duration, distance, where you died and what killed you), timestamps, and your friends list, the messages you write to friends, party invites and trades. Our hosting and sign-in providers also process technical data such as your IP address and security logs.
People who hold a challenge code or link you shared can see that challenge, your name as its creator and its death markers.
Once you have cleared level 100, your name, your highest level and the hero card your game publishes (your gear and banner) appear on the global leaderboard, visible to all players.
Messages and gifts from the CurseLink team arrive in your inbox; we keep which of them you read, claimed or deleted, and what a claim gave you.
Save with google (optional)
If you choose SAVE WITH GOOGLE, Google confirms your Google account to our service. We then keep that account's email address and Google user ID with your game account, plus the newest copy of your progress (with a short summary and your phone model) so you can restore it on another phone. We never receive your Google password. Without this, your progress lives only on this phone.
Purchases
Curse Shards and bundles are bought through Google Play. Google handles the payment; we never see your card or bank details. For every purchase we receive and keep the order number, the purchase token, the product, the time and your account ID, so we can deliver it exactly once and handle refunds. Google's own terms and privacy policy apply to the payment.
Advertising
The Android app shows optional reward videos through Google Mobile Ads. Where required, Google's consent message (UMP) is shown first; you can change your choice any time in Privacy & Legal → Manage Ad Consent. Google and its partners may process an IP-based approximate location, advertising and device IDs, ad interactions and diagnostics for ads, measurement and fraud prevention - even non-personalised ads are not data-free. Watching a video is always optional.
Google: policies.google.com/privacy · policies.google.com/technologies/ads
Sharing
When you share an invite, your phone hands the text to the app you pick; that app's own policy applies. Copies already shared cannot be taken back.
Deletion
Privacy & Legal → Delete Account & Data deletes your online account first (identity, attempts, hero card, Google link and cloud save) and only then resets this phone. If the service cannot confirm the deletion, the app says so instead of pretending. Challenges you created stay for other players' chains, shown as created by "Deleted player". Uninstalling the app alone does not delete server data.
Without the app: get a deletion code (valid 7 days) under Data Request and send it to the contact above.
Web deletion page: https://curselink.pages.dev/delete
Your rights
Depending on where you live you can ask for access to or a copy of your data, its correction or deletion, restrict or object to processing, withdraw a consent (this does not affect what happened before), and complain to a data-protection authority. Use Privacy & Legal → Data Request.
Changes
This page changes when the game's data practices change.