AEONFALL(“the Game”, “we”, “us”) is a single-player mobile arcade game published by Xylenzer, an individual developer. This Privacy Policy explains what data the Game handles and why. We do not profile you and we do not sell your data. The Game contains no analytics SDK. There is one ad in it — a video you can choose to watch on the game-over screen to revive a run — and nothing is shown unless you tap for it; section 8 covers exactly what that involves. We do keep an account for you: the Game creates one automatically on first launch so that a leaderboard, a friend list and gift deliveries can work, and it lives on a server we own and operate. Section 1 lists exactly what it holds, and tells you how to erase it.
1. What We Collect
The Game stores the following data locally on your device only:
- Game progress - coins, best score, level reached, owned items, and daily-reward streak.
- Settings - music, sound effects, vibration, and language preferences.
- Your install credential - a randomly generated 32-character value (e.g.,
0b0d6880a5924e21963f97c0e7a02e9e), created on first launch. It is how the Game signs in to your account without ever asking you for an email address or a password. Treat it as a password: it is never displayed to anyone, and the handle you share with friends is your player code instead. - A session token - a temporary key proving the Game is signed in. It is deliberately kept out of the save file that cloud backup copies, so restoring a backup onto another device cannot carry your credentials with it.
This data is stored in the Game’s local storage on your device and is removed if you uninstall the Game. Your coins, items, settings and save file stay on your device - we keep no copy of them, and the Game contains no analytics SDK and no tracking. What does leave your device is described next.
Your AEONFALL account
The Game creates an account for you automatically on first launch, with no email address and no password. It exists so that a leaderboard, a friend list and gift deliveries can work at all, and it lives on a server Xylenzer owns and operates. It holds:
- A player code - your public handle, shaped like
AEONP-K7M3-QP9X. It is meant to be shared: friends add you with it, and the redeem page asks for it. - A display name - generated for you at signup and changeable in the Game. It is shown publicly next to your score on the leaderboard, so please do not put your real name or contact details into it.
- Your finished runs - score, coins collected, level reached, how long the run lasted, which items you used, your platform (for example Android) and the app version. These are what the leaderboard is built from, and what lets us recognise scores that are not physically possible.
- Your friends - the players you added, requests waiting for an answer, and anyone you blocked.
- Gifts and coupons - which codes you have redeemed and which gifts you have collected, so that one code cannot be used twice.
- Dates - when the account was created and when it was last used.
If you sign in with Google, we receive exactly one thing: the account identifier Google issues for you, which is a number rather than an address. We do not receive, request, or store your Google email address, your real name, or your profile picture. Signing in is optional and exists so you can reach the same account after changing phones.
Your install credential and your session token are stored on our server only as SHA-256 hashes, so a copy of the database cannot be replayed against your account. Your IP address is read for a moment on each request in order to rate-limit abuse, and is never written to the database and never logged. Your account never receives your location, your contacts, your device model, or your advertising ID — the last of those goes to Google AdMob and only when you tap to watch a revive video, which section 8 explains.
Deleting your account
You can erase your account and everything above from inside the Game, at Settings → Player Profile → Delete Account. It takes effect immediately and cannot be undone. If you can no longer open the Game, write to support@xylenzer.com and ask us to delete it — we will first ask you to prove the account is yours, because a player code is public by design and anyone who has seen yours must not be able to erase it. Full instructions are on the delete-account page.
Coupon codes and the gift inbox
Coupon codes are redeemed on this website, at /redeem-code, not inside the Game. When you submit that form your browser sends three things to a server operated by Xylenzer: the code, the player code you pasted in, and a Cloudflare Turnstile tokenproving the form was filled in by a person. The reward is then placed in that account’s inbox.
The Game collects it from there, asking the server whether anything is waiting - when you open the main menu, and again when you open the inbox - and claiming it when you press Claim. Those requests carry your session token and nothing else: no code, no save file, no device information.
We record which codes your account has redeemed and which gifts it has collected, so that the same code cannot be used twice. We do not share any of this with third parties, and the server is hardware we own and operate ourselves - your data is not handed to a cloud provider.
Your player code is public by design: it is what you hand to a friend so they can add you, and pasting it into the redeem page is how a reward finds you. Because it is public, it is never enough on its own to change or delete anything - those actions happen inside the Game, where you are signed in.
The human check on the redeem form is Cloudflare Turnstile, which receives your IP address and browser characteristics in order to tell people from scripts. It is used only on that one page. See Cloudflare’s privacy policy.
2. How It Is Used
Local data is used exclusively to run the Game: restoring your progress when you reopen the app, remembering your preferences, and enabling you to identify yourself when contacting support. We do not analyse, profile, or monetise this data.
3. Third-Party Services
The Game integrates with the following third-party platforms. Each is governed by its own privacy policy and terms; we have no control over their data practices.
- Apple App Store / StoreKit - processes in-app purchases on iOS. See Apple’s Privacy Policy.
- Google Play Billing - processes in-app purchases on Android. See Google’s Privacy Policy.
- Apple Game Center - powers optional leaderboard and achievements on iOS. Governed by Apple.
- Google Play Games - powers optional leaderboard, achievements, and cloud save on Android. Governed by Google.
Website analytics
This applies to this website only, not to the Game. Our website at aeonfall.xylenzer.com uses Google Tag Manager to load Google Analytics 4, which counts visits and shows us which pages people read. It sets cookies in your browser and sends Google your approximate location, device and browser type, referring page, and the pages you view. It does not tell us who you are, and it is not connected to your game save in any way. You can opt out with Google’s browser opt-out add-on or by blocking cookies for this site. See Google’s Privacy Policy. The Game itself still contains no analytics SDK of any kind.
4. In-App Purchases & Refunds
All payments are processed by Apple or Google. The Game never sees your payment card details, billing address, or any financial information. If you wish to request a refund, please contact the store where your purchase was made:
- iOS: reportaproblem.apple.com or via Settings → Apple ID → Subscriptions & Purchases.
- Android: Google Play app → My orders, or play.google.com/store/account/orderhistory.
5. Cloud Save
On Android, the Game can optionally synchronise your progress using Google Play Games’ “Saved Games” feature. On iOS, iCloud backup may include the Game’s local data as part of standard device backup. Both are optional and platform-controlled. If you use these features, your data is handled by Google or Apple respectively under their privacy policies. Our own server never receives your save file - your coins and items are not part of your account.
6. Leaderboards
AEONFALL runs its own leaderboard so that players on Android and iOS appear on one board. When you finish a run, the Game sends it to our server as described in section 1, and if it is good enough your display name and score become visible to other players — both on the global board and to anyone who has added you as a friend. Your player code, your credentials and your email address are never shown to anyone.
This is the one part of the Game that is public, so it is worth repeating: choose a display name you are happy for strangers to see. You can change it in the Game, and deleting your account removes your entries from every board.
Separately, if you are signed in to Apple Game Center or Google Play Games, the Game may also submit your best score to that platform’s own leaderboard, where it is associated with your platform account rather than with us. You can turn that off in your device’s Game Center or Play Games settings.
7. Support Contact
If you contact us at support@xylenzer.com, we receive the email you send. This typically includes your name or email address, your player code, and any device or gameplay information you choose to share. We use this information only to respond to your request and do not retain it longer than necessary.
8. Advertising
The Game never interrupts play with advertising. There are no banner ads, no interstitial ads, no ads on opening the app, and no ad that ever appears on its own.
There is exactly one place an ad can appear: the game-over screen, behind a button offering to revive your run instead of spending coins. Nothing is shown unless you tap it, and ignoring it costs you nothing but the revive.
Those videos are served by Google AdMob. When you tap to watch one, AdMob receives your device’s advertising IDalong with device and approximate-location signals it uses to choose and measure the ad. That identifier is resettable, and deletable, from your device’s own settings — on Android under Settings → Privacy → Ads. We never see it, and it is not connected to your AEONFALL account, your player code, or your save.
What AdMob does with that data is governed by Google’s Privacy Policy and AdMob’s own terms, not by this one; we have no control over their practices. If you never tap the revive button, no ad is requested and AdMob is never contacted.
If you are in the EEA, the UK or Switzerland, the Game asks you first, through Google’s consent form, and remembers your answer. Declining is a real choice, not a nag: the revive-by-video button simply stops being offered, and no advertising SDK is started at all. You can change your mind later from the same form.
9. Security and Retention
Your account is deliberately built to hold as little as possible: no email address, no password, no payment details, no location, no device identifiers. What it does hold is listed in section 1. Credentials and session tokens are stored only as SHA-256 hashes, all traffic between the Game and our server is encrypted in transit (HTTPS), and the server is hardware we own and operate rather than a third-party cloud account.
We keep your account for as long as it exists. Deleting it, as described in section 1, erases your profile, name history, runs and leaderboard entries, friends and requests, gifts and redemption records. Totals that cannot be traced back to any person — such as how many runs have been played overall — are unaffected. Data stored locally on your device is protected by your device’s own security mechanisms (passcode, biometric lock, encryption).
10. Children
The Game is rated for general audiences and is not directed at children under 13 years of age (or equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. In accordance with the Children’s Online Privacy Protection Act (COPPA) and equivalent local laws, if you believe a child under the applicable age has provided personal information in connection with the Game, please contact us immediately at support@xylenzer.com and we will take prompt steps to delete such information.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the Game after any changes constitutes your acknowledgement of the revised policy. We encourage you to review this page periodically.
12. Governing Law
This Privacy Policy is governed by the laws of Thailand.
13. Contact
For privacy-related questions or requests, contact Xylenzer at support@xylenzer.com.