← Back to Arbito
Windfall Town Privacy Policy
Effective Date: February 23, 2026 · Last Updated: February 23, 2026
Arbito LLC ("we," "us," or "our") operates the Windfall Town mobile application and associated services (collectively, the "Service"). Windfall Town is a semi-idle town management RPG within the Arbito ecosystem.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Windfall Town, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Account Information (via Arbito Market)
Windfall Town uses Arbito Market, our centralized authentication platform, for account management. When you create an account, the following information is shared from Arbito Market:
- Email address, username, and display name
- Avatar/profile photo URL
- Account role and verification status
For details on how your account data is handled, please also review the Arbito Market Privacy Policy.
1.2 Town and Game State Data
Windfall Town collects and stores data necessary to operate the game:
- Town Data: Your town name, town level, experience points, and gold balance.
- Champion Data: Your champion character's equipment, skills (Leadership, Combat, Resilience, Prospecting, Diplomacy, Tactics), and level progression.
- Villager Data: The names, titles, portraits, skills (Mining, Woodcutting, Fishing, Farming, Smithing, Cooking, Crafting, Fletching, Construction, Brewing, Tactics, Fortification), equipment, and task assignments of your in-game villager NPCs. Villagers are computer-generated characters, not real people.
- Inventory and Buildings: Resources, items, and crafted goods in your town inventory. Building levels, types, and construction progress.
- Area and Task Data: Active gathering tasks, resource collection progress, and area assignments.
- Army and Conquest Data: Army composition, conquest history, enemy settlement encounters, plunder gained, and battle outcomes.
- Market Data: NPC market transactions, buy/sell history, and dynamic pricing interactions.
- Orders: NPC supply order completions and associated rewards.
1.3 Social and Communication Data
- Chat Messages: Messages sent in global, trade, help, and clan chat channels via our real-time Socket.io connection.
- Direct Messages: Private messages sent between you and other players.
- Friends List: Your friend connections and pending friend requests.
- Clan Data: Clan membership (up to 50 members per clan), clan role, and clan-related activities.
1.4 In-App Economy Data
- Gold Balance: Your in-game gold currency earned through gameplay activities.
- Crown Purchases: Records of premium currency (Crown) purchases and spending within the Crown Shop. The Crown Shop offers cosmetic and convenience items only.
- Subscription Data: If you subscribe to Windfall Town Premium, we store your subscription status, billing platform (Apple/Google), product identifier, subscription period dates, and renewal status. Payment details are handled entirely by the Apple App Store or Google Play Store and are never stored by us.
- Subscription Currency Grants: Records of bonus Crowns granted as part of your subscription, including amounts, periods, and any clawback records associated with refunds.
Crown currency has no real-world monetary value and cannot be converted to real money. For details on cross-ecosystem currency management, see the Arbito Market Privacy Policy.
1.5 Offline Session Data
- Offline Progress: When you close the app, we calculate offline progress (up to 8 hours). We store session start time, end time, duration, experience gained, items gathered, and resources produced during offline periods.
1.6 Automatically Collected Information
- Device Information: Device type, operating system and version, app version, and unique device identifiers.
- Usage Data: Feature usage, screen views, session duration, and interaction patterns.
- Analytics: We use Firebase Analytics to collect aggregated usage statistics.
- Crash Reports: We use Firebase Crashlytics to collect crash logs and diagnostic data.
- Network Information: Connection type and quality for real-time gameplay optimization.
1.7 Biometric Data
If you enable biometric login (Face ID or Touch ID on iOS, Fingerprint on Android), your biometric data is processed entirely on your device using the operating system's secure enclave. We never receive, transmit, or store your actual biometric data. We only store a flag indicating whether you have enabled biometric authentication.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate the game: Maintain your town state, manage villager assignments, process resource gathering, run conquest simulations, handle market transactions, and calculate offline progress.
- Enable social features: Facilitate chat, direct messaging, friend connections, and clan activities.
- Power the in-game economy: Process Crown purchases, manage market pricing, and track order completions.
- Populate leaderboards: Display hiscores and rankings based on your town level, champion skills, and achievements.
- Improve the Service: Analyze gameplay patterns, identify bugs through crash reports, balance game mechanics, and develop new content.
- Ensure fair play: Detect and prevent cheating, exploitation, and other abusive behavior.
- Communicate with you: Send push notifications for game events and respond to support requests.
3. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
- Public Game Data: Your username, town name, town level, champion skills, and achievements are visible to other players via leaderboards and in-game interactions. Chat messages are visible to other players in the relevant channel.
- Within the Arbito Ecosystem: Your user identity syncs with Arbito for authentication. Your Crown currency balance is reflected in your Arbito Market wallet. Currency can be converted between ecosystem apps through Arbito Market.
- Service Providers: We share information with vendors who provide hosting (Railway), analytics (Firebase), crash reporting (Crashlytics), and push notifications (FCM).
- Legal Requirements: We may disclose information if required by law, regulation, or valid legal process.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.
- With Your Consent: We may share your information when you give explicit consent.
4. Data Retention
We retain your data as follows:
- Account and game data: Retained until you delete your account.
- Town, villager, and champion data: Retained for the lifetime of your account.
- Chat messages: Retained for the lifetime of your account or until the message is removed by moderation.
- Market and conquest history: Retained for the lifetime of your account.
- Crown purchase records: Retained for the lifetime of your account.
- Offline session records: Retained for the lifetime of your account.
- Analytics data: Retained per Firebase's default policies (up to 14 months).
When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law. Your town, champion, villagers, inventory, and all game progress will be permanently lost. Cached data on your device may remain until you uninstall the app.
5. Data Security
We implement technical and organizational measures to protect your data:
- All data is transmitted over HTTPS/TLS encryption.
- Real-time game communication uses encrypted Socket.io connections.
- Authentication is handled by Arbito Market using JWT tokens with short-lived access tokens.
- Biometric credentials are stored in the iOS Keychain or Android EncryptedSharedPreferences.
- Rate limiting on API endpoints to prevent abuse.
- Role-based access controls for data access.
While we strive to protect your data, no method of electronic transmission or storage is 100% secure.
6. Your Rights
6.1 All Users
- Access: View your game data and profile within the app at any time.
- Update: Edit your profile information through Arbito Market.
- Delete: Request full account deletion by contacting support@arbito.co. This will permanently delete all game progress.
- Opt-Out: Disable push notifications and manage preferences in app settings or your device settings.
6.2 European Economic Area (EEA) Residents — GDPR Rights
If you are located in the EEA, you have rights under the General Data Protection Regulation (GDPR):
- Right of Access: Request a copy of all personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten").
- Right to Restrict Processing: Request limitation of how we process your data.
- Right to Data Portability: Receive your data in structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests.
- Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing.
Legal Basis for Processing: We process your data based on: (a) your consent, (b) performance of our contract with you, (c) compliance with legal obligations, and (d) legitimate interests (security, fair play, service improvement).
Contact support@arbito.co to exercise your rights. We will respond within 30 days.
6.3 California Residents — CCPA Rights
If you are a California resident, you have rights under the CCPA:
- Right to Know: Request disclosure of personal information collected, used, and disclosed.
- Right to Delete: Request deletion of your personal information.
- Right to Opt-Out of Sale: We do not sell personal information.
- Right to Non-Discrimination: We will not discriminate for exercising your rights.
7. Children's Privacy
Windfall Town is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal data from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, contact us at support@arbito.co.
8. Third-Party Services
9. International Data Transfers
Your information may be transferred to and maintained on servers located outside your country of residence. For EEA, UK, or Swiss residents, we ensure appropriate safeguards such as Standard Contractual Clauses are in place.
10. Push Notifications
We may send push notifications for game events such as completed offline progress, conquest outcomes, order completions, and other gameplay alerts. You can manage notifications in the app settings or your device settings.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy within the app or sending you a notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions or concerns about this Privacy Policy:
For GDPR-related inquiries, you may also lodge a complaint with your local data protection authority.