Privacy Policy

1. Scope

This policy covers the Mulkora website, apps, accounts, worlds, player communications, support, security and notifications. A third-party store, checkout or sign-in provider may give its own privacy notice for information it handles independently. https://mulkora.com is not responsible for the privacy policies of websites to which it links. If you provide any information to such third parties different rules regarding the collection and use of your personal information may apply. You should contact these entities directly if you have any questions about their use of the information that they collect.

2. Information we collect

Depending on your use, we collect email, display name, authentication records and settings; guest and player identifiers, worlds, profiles, villages, alliances and progress; gameplay state, queues, resources, movements, battles, reports and rewards; chat, mentions, reports, blocks, moderation and investigation records. We process transaction and entitlement records such as product, amount, currency, status and provider reference; device, browser, operating system, app build, IP, session and local-storage information; push tokens, delivery results and preferences; support messages, attachments, correspondence and information you choose to provide. We store a creator code or player invitation you use with your account for attribution and applicable rewards. Creator-link counts are aggregated by creator, Cairo day and platform; we do not match those counts to installs or accounts by IP or device. Infrastructure access logs still record IP, requested paths (including creator-code links), times and user agents for operations and security; these records are not inherently unlinkable.

3. Card and payment information

We do not store full card numbers or CVV security codes in Mulkora’s database, and do not sell or lease card information. You enter payment details into the payment provider’s approved interface; Telr, banks, card networks or the app store process them, not a Mulkora form that stores your card. We may retain transaction references, amount, currency, status, card type and last digits, and billing information needed for support, accounting and fraud prevention. Never send full card numbers or security codes to support. All credit/debit cards’ details and personally identifiable information will NOT be stored, sold, shared, rented or leased to any third parties. https://mulkora.com will not pass any debit/credit card details to third parties.

4. How we use information

We use information to create accounts and operate worlds, authenticate users, save progress, process purchases and entitlements, and reconcile billing; deliver service, account, security and push notifications according to your preferences; prevent and investigate fraud, cheating, bots, abuse, account compromise and security incidents; provide support, handle reports, moderate communications and enforce rules; measure reliability, diagnose errors, monitor performance, balance systems and improve the product; and keep business records and comply with legal, tax, accounting, regulatory and lawful-request duties. With your separate optional analytics consent, we measure usage, successful registration, store purchases and campaign results, including Firebase Apple Ads attribution when available. Without it, ordinary website pages still send cookieless measurement, and the iOS app still sends Google its first open, app opens, sessions and one sign-up per new account with only the sign-up method. In the Android app, a separate Meta choice measures registration and verified purchase occurrences for advertising. On production iOS, Meta and TikTok measure install and launch before you choose, and registration, including starting as a guest, unless you decline; purchase occurrences still need that provider’s choice; you can withdraw this consent in Privacy settings. Legal grounds depend on context and applicable law and may include performing our agreement, legitimate interests in operating and protecting the service, legal obligations, and consent where required.

5. Sharing and service providers

We do not sell or rent personal information. We share necessary information with infrastructure and security providers such as Hetzner and Cloudflare, email delivery such as Resend, Google Firebase authentication and notification services, and Google Firebase/Analytics. Ordinary website pages can send cookieless measurement, including one sign-up per new account, when storage is denied. Fuller measurement, including the pseudonymous account identifier and store purchase details, starts when you grant separate analytics consent. The iOS app records first open without that grant. That optional measurement shares usage, registration and purchase-occurrence events; in the installed app, the SDK also measures purchase amount, currency and product data. It shares app or browser instance identifiers and, for registered direct account owners, a project-scoped pseudonymous account identifier with Google. We also share necessary information with Apple and Google when you use their services, and Telr, banks and payment networks for transactions. Services may also include error and performance monitoring according to the actual configuration. Providers are subject to their agreements and applicable law, and we require appropriate protection for information processed on our behalf. Limited disclosure to advisers, authorities or corporate-transaction counterparties may be necessary for law, rights and safety, or abuse investigations, with appropriate safeguards. In the installed app, we share completed registration and verified store purchase events, without amount, currency, quantity, product or order details, and app/OS version with Meta through its native SDK for advertising measurement, with the advertising identifier only under device tracking permission. On production iOS, Meta receives install and launch events before you choose, and registration unless you decline; on Android these need the separate Meta consent. Purchase events need the Meta choice and, on iOS, device tracking permission. The SDK also processes app/device information according to its settings. We do not add names, emails, raw account IDs or login tokens to Meta events. Meta measurement is independent from usage analytics. On production iOS, TikTok receives install and launch events before you choose, and registration unless you decline. Purchase-occurrence events still need the TikTok choice and iOS tracking permission. TikTok receives app and device identifiers and basic device/network data for advertising measurement. We do not add amount, currency, Gold quantity, product/order details, names, email, raw account IDs, login tokens or purchase proofs to TikTok app events. Withdrawal blocks new conversions and requests SDK suspension, but device/session configuration traffic may continue until the app closes and cached diagnostics may be delivered on regrant; transmitted events cannot be recalled. In the installed app, Google Analytics records first open, app opens, sessions and one sign-up per new account without usage-analytics consent; the pseudonymous account identifier and store purchase measurement, which includes amount, currency and product data, still need it. Google website measurement remains optional and uses count-only purchase events. Turning Meta measurement off stops our new app-open and conversion calls and applies the SDK’s automatic-logging, advertising-ID and SKAdNetwork controls. The SDK may retain or finish previously queued requests; transmitted events cannot be recalled and Apple tracking permission remains an OS setting. Contact us for a request to delete earlier data. When an account is created we record how it reached us: platform, country, the referring website’s name, and any campaign tags and ad click identifier in the link. We report every website registration to TikTok and to Meta with the IP address and browser type, and with that platform’s click identifier when the link had one, and a website registration that came from a Google ad to Google with its click identifier, so they can count ad results; these reports carry no names, emails or raw account IDs. On the website, the TikTok pixel loads only after you accept measurement and then receives the full address of each page you open, which can include invite, profile or payment-reference identifiers, and basic click information. The Meta pixel also loads only after you accept measurement, and then receives the address of the page where it loads, of a page you return to with the browser’s Back or Forward button, and of the page where you complete registration, each with the address of the page you came from, and basic browser information.

6. International processing

OAH is established in the UAE; providers and users may be in other countries, so information may be processed outside your country. Where required, we use contractual, organizational or other lawful international-transfer safeguards, recognizing that privacy laws vary by location.

7. Cookie Policy

This Cookie Policy covers cookies and similar browser/app storage. Necessary security, sign-in and functional storage keep Mulkora working. Google Firebase/Analytics loads on ordinary website pages with storage denied until you allow Performance cookies, so cookieless pings can count visits and one sign-up per new account when you decline. Accepting terms, signing in or allowing notifications does not grant storage. Declining does not prevent play. The cookie notice is a bar at the bottom of the screen that never blocks play. Strictly necessary storage is always active. It offers two optional categories, each saved separately on this device: Performance cookies grant Google analytics storage; Targeting cookies grant Google advertising storage and advertising user data for this site and load the TikTok and Meta pixels. Reject All refuses both, Accept All Cookies allows the ones you have not refused, Cookie Settings shows a switch for each category, on unless you refused that category before, and Save preferences stores what the switches show; closing the notice changes nothing. You can change or withdraw these device-specific choices in game Settings, account settings or Privacy settings before signing in. Advertising personalization and Google signals stay off. This is not permission for cross-company tracking or access to an advertising identifier. A password-reset, account-deletion or sign-in-code page does not load the tag. The iOS app records first open without waiting for this choice. The types and purposes are:

• Optional Meta app storage: the mulkora.metaConsent.v1 device preference stores your independent Meta choice, policy version and decision time. Local hashed attempt records prevent repeated registration and purchase submissions; they are not purchase backups. Once the Meta SDK runs (on production iOS unless you decline Meta, on Android after you allow it), it can store configuration and queued events on your device. Withdrawal blocks new app-initiated Meta events and disables the documented automatic-logging, advertising-identifier and SKAdNetwork controls; it does not erase SDK queues or recall events already received by Meta. On the website, the Meta pixel loads only after you allow Targeting cookies, with its automatic events and its page views on in-site navigation off; it then receives the address of the page where it loads, of a page you return to with the browser’s Back or Forward button, and of the page where you complete registration, each with the address of the page you came from, and basic browser information, and can store Meta’s own browser cookies. Turning Targeting cookies off revokes its consent. Our server also reports every website registration to Meta with the IP address, browser type and the Meta click id when the link had one, without email; that call cannot fail account creation.
• Optional TikTok ad measurement in the installed app has its own off-by-default device choice (mulkora.tiktokConsent.v1), independent of Google usage analytics. It shares app-open events on iOS, completed registration and fulfilled purchase conversions, app/device identifiers and basic device/network data with TikTok for advertising measurement. Install, launch and registration on production iOS do not wait for Apple tracking permission. Purchase-occurrence events still require this choice and Apple tracking permission. We do not add identity matching, names, email, raw account IDs, authentication or store purchase proofs. On production iOS, install and launch are reported to TikTok unless you decline; the app sends them itself and the SDK’s automatic tracking stays off. Retention, payment, enhanced-data reporting and TikTok SKAdNetwork updates stay off. Creating an account updates Apple SKAdNetwork conversion value. Meta may also update that value on production iOS unless you decline Meta. On the website, the TikTok pixel loads only after you allow Targeting cookies, independently of Google usage analytics; TikTok’s script then receives the full address of each page you open, which can include invite, profile or payment-reference identifiers, basic click information and a completed registration. The mulkora.webAdsConsent.v1 preference stores that website choice, its policy version and decision time; turning it off revokes the TikTok and Meta pixels’ consent, denies Google advertising storage and removes Mulkora’s Google advertising cookies. Our server also reports every website registration to TikTok with the IP address, browser type and the ad click id when the link had one, without email; that call cannot fail account creation. Android disable flags depend on remote configuration; its integration remains inactive until automatic purchase/history reporting has been verified to stay off. Purchase events record only that a verified purchase occurred; no amount, currency, Gold quantity, product or order details are added. Withdrawal fences new conversions and requests SDK suspension; it cannot recall requests already in progress or erase previously received data. Current SDK lifecycle/configuration can continue sharing device/session identifiers after withdrawal until the app is fully closed, and can cache diagnostics while off for later delivery on regrant. Activation requires owner approval and device verification of these disclosed limits; measurement is inactive until the native release is approved. Local hashed attempt records suppress replay and are not purchase backups. Contact us for a privacy or deletion request. Beta, debug and sandbox purchases are excluded from production TikTok measurement.
• Optional measurement: Google receives iOS first open, app opens, sessions and one sign-up event per new account (method only) even if you decline in the cookie notice. On the website, ordinary pages send cookieless pings, including one sign-up event per new account, when storage stays denied. After you opt in, Google also receives sessions, website route views, store purchase events, app/browser identifiers and basic device/network information. Registered direct-owner sessions use a project-scoped pseudonymous account identifier; guests, sitters and administrators do not. We do not add names, emails, raw account IDs, login tokens, URL queries other than ad click identifiers and campaign tags, IDFA or Android advertising IDs. Firebase can obtain Apple Ads attribution through AdServices; no custom attribution payload is sent to the game backend. Our custom purchase marker contains only verified purchase occurrence. In the installed app, the Google SDK measures store purchases, including amount, currency and product data; SDK store events alone do not prove game fulfillment. iOS first open does not wait for usage-analytics consent. The pseudonymous user id, store purchase measurement and Apple Ads attribution still require that consent. Website purchase measurement remains count-only. Host-only mulkora_analytics_ga cookies and Analytics store measurement state. The mulkora.analyticsConsent.v2 preference stores your choice and decision time. Local hashed attempt records prevent repeated measurement on recovery and are not purchase backups. Withdrawal clears the Analytics user identifier and removes website measurement cookies while preserving sign-in, notifications and operational purchase records; website pages keep sending cookieless pings with storage denied. On iOS it leaves collection on so an already recorded first open is not erased, and advertising storage stays denied. On Android it resets native Analytics state. It does not delete information already received by Google; contact us for a privacy request. Event-data retention is two months when activated; user-data retention is configured separately, and aggregate reports may remain longer.
• Strictly necessary security cookies: our server sets playerIp, which keeps the network address last recorded for your account so it is not recorded again while it stays the same, and playerBlocked, which marks a browser that our abuse protection has blocked. Both are HttpOnly and last up to 1 year.
• Preference cookie: locale remembers the language you choose, Arabic or English, for up to 1 year. It is set only when you switch language.
• Sign-in and session storage: your browser’s local storage keeps your sign-in tokens so you stay signed in and your session renews. If you sign in with Google or Apple, Firebase Authentication keeps its sign-in state in your browser storage. In the installed app, the device also keeps the guest identity that lets you continue an unsaved guest account.
• Functional storage: local storage and session storage remember game settings and interface state on your device, such as sound, panels, the map and village view, tutorial progress, unsent chat drafts, the last world you played and a referral code from an invitation link.
• Notifications: if you allow notifications, Firebase Cloud Messaging registers a service worker and keeps a device token in your browser storage to deliver the notifications you choose. No token is stored without your permission.
• Third-party services: Google Fonts delivers the website’s fonts; Google or Apple sign-in through Firebase opens the provider’s sign-in window; Telr provides the secure payment page, and Apple provides the Apple Pay script at checkout. Our infrastructure provider Cloudflare may set strictly necessary security cookies to protect the site from abuse. These providers may set their own cookies under their own policies, which we do not control.
• Your choices: you can block or delete cookies and site data in your browser settings. Blocking strictly necessary cookies or storage may sign you out, reset your preferences or stop parts of the site such as sign-in or checkout from working, and clearing storage may lose access to an unsaved guest account, so save your account first. You can change device permissions such as notifications in your browser or system settings, and you can play without notification permission.

8. Security

We use reasonable technical and organizational controls appropriate to the risks, including access restrictions, protected credentials, encryption in transit, monitoring, backups and incident-response practices. No internet service guarantees absolute security. Use a unique password, protect your devices and promptly report suspected account misuse.

9. Retention and deletion

We keep data only as long as reasonably needed for the stated purposes. Account and gameplay data may remain while an account or world operates; security, moderation, transaction, tax and legal records may remain longer to protect users, resolve disputes, prevent repeat abuse or meet legal duties. Backups rotate and may take additional time to expire. When no longer needed, data is deleted, anonymized or securely isolated. Account deletion removes or anonymizes identity, progress and associated information; Gold ledger, purchase and administrative/financial audit records may be retained as necessary for security, accounting and legal obligations, not restored to ordinary account use.

10. Requesting account deletion

Start “Delete Mulkora Account” in profile settings inside the game or app; this is different from deleting one player from one world. You may also use the public page at mulkora.com/account-deletion, even after uninstalling, to request an email verification link for an account linked to your address. Provider-only and guest accounts can use the in-app deletion flow or contact support to verify ownership. Processing starts after a 72-hour grace period; the screen shows status and whether cancellation is still available before cleanup starts. Deletion covers all worlds, progress and remaining Gold, subject to the retention exceptions above. No purchase or paid reactivation is required to request deletion.

11. Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent for consent-based processing. You can update available account and notification settings. Email [email protected] with “Privacy Request” in the subject. We may verify your identity and retain information where law or overriding security, fraud-prevention, transaction or legal needs require it. You may have a right to complain to an applicable data-protection authority.

12. Minimum age

Mulkora is intended for people aged 18 or older, or the higher local minimum, and is not directed to children. Minors may not register or purchase. If you believe a minor provided information contrary to these rules, contact us so we can investigate and take appropriate action, including deletion where required.

13. Policy changes

We may update this policy as the service, law or our practices change, publish the revised version and update the effective date. We provide additional notice of material changes when reasonably required.

14. Privacy contact

OAH Technology FZE. Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Email: [email protected]. Phone: +971 58 282 8052. Please use “Privacy Request” in the subject when exercising a data right.