Privacy Policy

Effective date: 9 July 2026  •  Last updated: 17 July 2026

This Privacy Policy explains how Cobalt Forge Games ("Cobalt Forge Games", "we", "us", or "our") collects, uses, shares, and protects information when you play our games — including Wormy's Descent — and when you visit cobaltforgegames.com (together, the "Services").

1. Information we collect

We collect the following categories of information, most of it tied to gameplay rather than your real-world identity.

a. Information you provide

• Player nickname. The name you choose for your in-game character ("Wormy name"). This can be anything you like and does not need to identify you.
• Communications. If you email us or contact support, we receive your email address and the contents of your message.

b. Account & authentication data

• Anonymous game account. When you start playing we create an account through Unity Player Authentication (part of Unity Gaming Services). By default this is an anonymous account identified by a random player ID stored on your device — it is not linked to your name or email.
• Optional linked sign-in. If you choose to link a Google Play Games account (Android) or Sign in with Apple (iOS), we receive a platform account identifier so your progress can be restored across devices. We do not receive your Google or Apple password.

c. Gameplay & cloud-save data

• Progress & settings. Game progress, in-game currency and item balances, unlocked content, and preferences. This is stored on your device and, if enabled, backed up to Unity Cloud Save under your game account so you can restore it.

d. Analytics & usage data

• Gameplay events. Through Unity Analytics we collect events about how the game is played (for example, starting or ending a run, or defeating a boss) together with a session identifier, approximate region, device and OS information, and app version. We use this in aggregate to understand and improve the game.

e. Advertising & device identifiers

• Ads. Our games may show advertising (including optional "rewarded" ads) mediated through Unity LevelPlay (formerly ironSource). Ad providers may collect a mobile advertising identifier (Apple IDFA — only if you grant App Tracking Transparency permission — or the Android Advertising ID), IP address, and ad-interaction data to deliver and measure ads.

f. Purchase data

• In-app purchases. If you buy items (such as premium currency), the transaction is processed by the Apple App Store or Google Play. We receive confirmation that a purchase was made and a purchase/receipt token so we can grant the item — we do not receive or store your payment card details.

g. Automatically collected technical data

• Device & log data. Device model, operating system, language, general location inferred from IP, crash and performance diagnostics, and IP address (used for security and delivery). Our website host, Firebase Hosting (Google), processes standard server logs when you visit the site.

2. How we use information

• Provide, operate, and maintain the Services and your game account.
• Save, sync, and restore your game progress across devices.
• Understand how the game is used and improve gameplay, balance, and stability.
• Display and measure advertising and process in-app purchases.
• Provide support and respond to your requests.
• Detect, prevent, and address fraud, abuse, cheating, and security issues.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal bases for processing (GDPR)

Where the EU/EEA General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract — to run the game, your account, and cloud save so we can provide the Services you request.
• Legitimate interests — to secure, analyse, and improve the Services and to serve non-personalized ads, balanced against your rights.
• Consent — for personalized advertising, tracking via advertising identifiers, and optional analytics where consent is required. You can withdraw consent at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

4. Advertising & your choices

We aim to keep advertising respectful. You control ad tracking in several ways:

• iOS: When first shown a tracking prompt (App Tracking Transparency), you may allow or deny tracking. If denied, you will still see ads, but they will be non-personalized. You can change this in Settings → Privacy & Security → Tracking.
• Android: You can reset or delete your Advertising ID, or opt out of ad personalization, in Settings → Google → Ads.
• EU/EEA/UK: Where required, we present a consent request (a Consent Management Platform) before personalized ads or non-essential tracking. Your choices are respected and can be changed in the game's settings.

5. Third-party services & data sharing

We do not sell your personal data. We share limited data with service providers that help us operate the Services, each under their own privacy terms:

We may also disclose information if required by law, to protect our rights and users' safety, or in connection with a business transfer (e.g., merger or acquisition).

6. International data transfers

Our service providers may process data in countries outside your own, including the United States. Where personal data is transferred out of the EU/EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Data retention

We keep your game account and cloud-save data for as long as your account exists so you can keep playing. Analytics data is retained in aggregated or pseudonymized form for as long as it is useful for improving the Services. If you delete your account (see below), associated cloud-save and authentication data is deleted. We may retain limited records where necessary to comply with legal obligations or resolve disputes.

8. Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR (EU/EEA/UK) these include the right to access, rectify, erase, restrict or object to processing, data portability, and the right to withdraw consent. California residents have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of "sharing" for cross-context behavioural advertising.

• Delete your account & data. The game includes a Delete Account option (in the User Profile screen) that removes your cloud-save data and authentication account and clears local data on the device. You can also request deletion at any time — see our Account & Data Deletion page.
• Contact us. You may also exercise any of these rights by emailing hello@cobaltforgegames.com. We will respond within the timeframe required by applicable law.
• Complaints. EU/EEA users may lodge a complaint with their local supervisory authority (in Romania, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP).

9. Children's privacy

Our Services are intended for a general audience and are not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children under that age. If you believe a child has provided us personal data, contact us at hello@cobaltforgegames.com and we will delete it.

10. Security

We use reasonable technical and organizational measures — including encryption in transit and access controls provided by our platform partners — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Cookies & the website

The cobaltforgegames.com website and its subdomains (such as wormy.cobaltforgegames.com) are simple informational sites. They do not set advertising cookies. With your consent — requested through a cookie banner, and never before you accept — they use Google Analytics 4 (Google Ireland Ltd., acting as our processor) to measure visits in aggregate: pages viewed, approximate location derived from your IP address, and device/browser type. The legal basis is your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time via the "Manage cookies" link in the website footer. Analytics data is retained by Google Analytics for up to 14 months; its cookies last up to 2 years. The sites also load fonts from Google Fonts, which involves a request to Google's servers, and are hosted on Firebase Hosting, which records standard server logs. Our games use on-device storage and, with your consent, advertising identifiers rather than browser cookies. For a full breakdown of cookies and similar technologies, see our Cookie Policy.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the game or on the website. Your continued use of the Services after an update means you accept the revised Policy.

13. Contact us

Questions or requests about this Policy or your personal data:

Cobalt Forge Games
Email: hello@cobaltforgegames.com
Web: www.cobaltforgegames.com