1. The short version
We think you should be able to understand this in a minute, so here is the honest summary. The detail follows, and the detail is what governs.
- To play Call to Rule you need an account. That means we hold your email address, a username, a display name, your date of birth, and a hashed password — or, if you sign in with an external provider, the identifier that provider gives us.
- While you play we record the things the game needs to work: matches, ranks, ratings, heroes and loadouts, purchases, friends, guilds, chat messages, and reports.
- We record technical and security data — IP address, device platform, and an audit trail of sensitive actions — to keep accounts and matches safe.
- We do not run advertising in Call to Rule. There is no ad SDK, no advertising identifier, no ad network, and no cross-app tracking. We do not sell or rent your personal data, and we do not share it for behavioural advertising.
- We use no third-party analytics service. Gameplay telemetry goes to our own servers and is deleted after 2 years.
- You can delete your account yourself from inside the game, and request a copy of everything we hold about you by email — we answer within 30 days, free. See Account & Data Deletion.
2. Who is responsible for your data
The controller of your personal data — the party that decides why and how it is used — is:
Papertoad FZE LLC Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates Trade licence 4431780, issued by the Sharjah Publishing City Free Zone Authority (SPC Free Zone)
For privacy questions, data requests, or anything in this policy: privacy@papertoad.com.
This policy covers the Call to Rule game on every platform we publish it on, the calltorule.com website, and the online services behind them.
Representatives in the EEA and the UK
Because we offer Call to Rule to players in the European Economic Area and the United Kingdom from outside those territories, Article 27 of the GDPR and Article 27 of the UK GDPR require us to designate a representative in each. We are in the process of appointing them, and their names and contact details will be published here as soon as they are in place.
In the meantime — and afterwards — you can raise anything about your personal data with us directly at privacy@papertoad.com. We answer every request ourselves within 30 days. Using that address takes nothing away from your rights, and in particular you can complain to your national supervisory authority at any time without going through us; those authorities are listed in section 14.
We have not appointed a Data Protection Officer, because our processing does not meet the thresholds in Article 37 GDPR or Article 10 of the UAE Personal Data Protection Law. If that changes, we will name one here.
3. What we collect, and where it comes from
3.1 Data you give us
| Data | When |
|---|---|
| Email address | When you register a password account, or from a sign-in provider if you use one |
| Username and display name | At registration; display name may be changed later |
| Password | At registration — stored only as a salted cryptographic hash, never in readable form |
| Date of birth | At registration, to apply the age rules in section 6 |
| Chat messages, guild names, status messages, party invites | When you send them |
| Reports you file about other players | When you report someone |
| Support correspondence | When you email us |
| Email address for launch news | If you submit it on calltorule.com — optional, and separate from your game account |
3.2 Data created by playing
| Data | What it is |
|---|---|
| Player profile | Account level, experience, honour standing, behaviour tier, settings and preferences |
| Match data | Match history and results, heroes played, loadouts, emblems, items, in-match statistics, replays |
| Competitive data | Matchmaking rating, skill uncertainty, rank, placements, mastery, leaderboard position |
| Matchmaking data | Queue and role preferences, party membership, region latency measurements, cross-region opt-in |
| Social data | Friends, blocks, guild membership and guild role, presence |
| Economy data | Purchases and orders, receipts, virtual currency balances and ledger entries, item ownership, draw history including pity counters, refunds |
| Progression data | Missions, achievements, events, mailbox, rewards claimed |
| Gameplay telemetry | Timestamped events about what happened in a match or session, tied to your player identifier and the match identifier |
| Experiment data | Which A/B experiment groups you are in, and when a feature was shown to you |
3.3 Data collected automatically
| Data | Why we have it |
|---|---|
| IP address | Delivered by the network on every connection. Recorded against sensitive and administrative actions in our audit log, and used transiently for routing, region selection, rate limiting and abuse prevention |
| User agent / client version | Recorded in the audit log; used for compatibility and abuse prevention |
| Device platform and push token | Only if you turn on push notifications. The token is a device address, not a device identifier we use for tracking |
| Session and refresh tokens | To keep you signed in, and to let you sign out everywhere |
| Anti-cheat signals | Signals from the game client that indicate manipulation of the game, and server-side detections of impossible or anomalous play |
3.4 What we deliberately do not collect
- No advertising identifiers. We do not read the Android Advertising ID, the Apple IDFA, or any equivalent.
- No third-party advertising or analytics SDKs. Call to Rule does not embed an ad network or a commercial analytics product.
- No contacts, photos, calendar, microphone or precise location. We do not request these permissions. Region is derived from network latency and the store region, not from GPS.
- No card numbers. Payments are processed by the app store or the payment provider — we receive a confirmation and a transaction reference, never your card or bank details.
- No biometric data, and no special-category data as defined in Article 9 GDPR. Please do not put health, religious, political or similar information into chat or a display name.
4. Why we use it, and our legal basis
Under the GDPR and UK GDPR, every use of personal data needs a legal basis. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) the equivalent concept is a lawful ground for processing. This table covers both.
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account; sign you in | Account, identity, session data | Contract — Art. 6(1)(b) GDPR. We cannot give you the game without it |
| Run matches, matchmaking, ranking and progression | Gameplay, competitive, matchmaking data | Contract — Art. 6(1)(b) |
| Social features: friends, parties, guilds, chat | Social data, chat | Contract — Art. 6(1)(b) |
| Process purchases and keep the required financial records | Economy data, transaction references | Contract — Art. 6(1)(b), and legal obligation — Art. 6(1)(c), for tax and accounting records |
| Detect and act on cheating, boosting, fraud and account takeover | Anti-cheat signals, technical data, audit log | Legitimate interests — Art. 6(1)(f): keeping the game fair and accounts secure. We balanced this against your interests and consider it proportionate because the data is limited to what the detection needs and you can appeal any outcome |
| Moderate chat and names; act on player reports | Chat, reports, moderation records | Legitimate interests — Art. 6(1)(f): protecting players from abuse; and legal obligation where content must be removed under UAE law |
| Keep the service stable, fix bugs, size servers | Telemetry, technical data | Legitimate interests — Art. 6(1)(f): running a service that works |
| Balance heroes and design content | Aggregated and pseudonymised gameplay data | Legitimate interests — Art. 6(1)(f) |
| Send service messages you cannot opt out of — security alerts, account changes, terms updates | Account data | Contract — Art. 6(1)(b), and legal obligation — Art. 6(1)(c) |
| Send marketing and launch news by email | Email address, locale | Consent — Art. 6(1)(a). You may withdraw it at any time, and every message carries an unsubscribe link |
| Apply the age gate and protect minors | Date of birth | Legal obligation — Art. 6(1)(c), and legitimate interests — Art. 6(1)(f) |
| Defend or bring legal claims, respond to lawful requests | Whatever is relevant | Legal obligation — Art. 6(1)(c), and legitimate interests — Art. 6(1)(f) |
If you would like more detail on any legitimate-interests assessment we carried out, ask at privacy@papertoad.com and we will explain it.
5. Automated decisions
Some decisions in Call to Rule are made automatically:
- Matchmaking places you in matches using your rating, uncertainty, role preference, party and latency. This has no legal or similarly significant effect on you.
- Automated chat moderation can mute or filter a message that matches our prohibited-terms rules.
- Anti-cheat detection can automatically restrict or suspend an account when the evidence of manipulation is strong.
Where an automated decision restricts or suspends your account, you have the right to obtain human intervention, to express your point of view, and to contest the decision. Write to support@calltorule.com with your player ID and we will have a person review it. We tell you the outcome and the reason.
We do not use your personal data for profiling that produces legal effects, and we do not use it to set individual prices.
6. Children and young players
Call to Rule is not directed at children under 13, and we do not knowingly collect personal data from them. In EEA countries where the age of digital consent is higher than 13 — up to 16 — a holder of parental responsibility must consent on the child's behalf.
If you believe a child has given us personal data without the required consent, write to privacy@papertoad.com and we will delete the account and its data promptly.
Full detail, including the parental controls available to you, is on the Children's Privacy & Parental Information page.
7. Who we share it with
We do not sell your personal data. We do not share it for anyone else's advertising. We share it only in these situations:
Service providers acting on our instructions (processors). Each is bound by a written contract meeting Article 28 GDPR, may use the data only for what we ask, and may not use it for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Ultahost | Hosts our servers, database and storage | United Arab Emirates |
| Apple Inc. / Google LLC | Process in-app purchases, deliver push notifications, distribute the app | United States and globally |
| Email delivery provider | Sends account and service email on our behalf | See the current list at privacy@papertoad.com on request |
Other players. Your display name, avatar, rank, honour standing, guild, presence, match history and anything you type in chat are visible to other players. Please treat your display name as public.
App stores. Apple and Google receive purchase and subscription data as the sellers of record, under their own privacy policies.
Authorities and legal process. We disclose data where we are legally required to — a valid order from a UAE court or competent authority, or a lawful request from another jurisdiction that we are obliged to honour. We check that a request is valid and limit what we hand over to what is asked for.
A business transfer. If PaperToad is acquired or merged, personal data may transfer as part of the business. You will be told before your data becomes subject to a different privacy policy.
We keep an up-to-date list of our processors. Ask at privacy@papertoad.com and we will send it to you.
8. International transfers
We are established in the United Arab Emirates, and our servers, database and file storage are located in the United Arab Emirates as well. Your account and gameplay data lives in the UAE rather than being spread across regions.
If you are in the UAE: your data is processed here, in your own country. The main things that leave it are purchase and push-notification data handled by Apple and Google, and we transfer those in accordance with Articles 22 and 23 of Federal Decree-Law No. 45 of 2021.
If you are in the EEA or the UK: sending your data to the UAE is still a restricted international transfer, because the United Arab Emirates has not been the subject of an adequacy decision by the European Commission or the UK Government. We therefore rely on Standard Contractual Clauses — the clauses in Commission Implementing Decision (EU) 2021/914 for EEA transfers, and the UK International Data Transfer Addendum for UK transfers. We have carried out a transfer impact assessment covering the laws of the United Arab Emirates and the safeguards applied, and we apply supplementary measures including encryption in transit, encryption of backups, strict access control, and a policy of challenging over-broad government requests.
You may request a copy of the safeguards we rely on by writing to privacy@papertoad.com. We will send you the relevant clauses with commercial terms redacted.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | For as long as your account is open |
| Closed account | Deleted within 30 days of the deletion request completing; residual copies in encrypted backups are overwritten within 90 days |
| Gameplay telemetry | Automatically deleted 2 years after the event |
| Match history and replays | Kept while the account is open, so you and your opponents keep an accurate record |
| Chat messages | Kept for a limited operational window for moderation and appeals, then deleted. Messages preserved as evidence in an open moderation case are kept until that case is closed |
| Moderation and enforcement records | Kept while the account is open and for a limited period afterwards, so a banned account cannot be recreated |
| Security audit log | Kept for a limited period proportionate to investigating account compromise and abuse |
| Purchase and financial records | Kept for the period required by UAE tax and commercial law — currently 5 years from the end of the relevant tax period — regardless of account closure |
| Launch-news subscription | Until you unsubscribe, or 24 months after the last engagement, whichever comes first |
| Support correspondence | 24 months after the case is closed |
Where the law requires us to keep something after you delete your account — for example a financial record, or a record needed to keep a banned player out — we keep the minimum necessary and nothing else.
10. How we protect it
We apply technical and organisational measures appropriate to the risk, including: TLS 1.2/1.3 for all traffic; passwords stored only as salted hashes; access to production data restricted to named administrators; sensitive administrative actions requiring dual control and recorded in an append-only audit log; encrypted backups; separation of the game, database and storage services; and automatic security updates on our servers.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours as required by Article 33 GDPR and notify the UAE Data Office in accordance with Article 9 of the UAE PDPL, and we will notify you directly without undue delay where the risk to you is high.
To report a vulnerability, write to security@papertoad.com. We will not take legal action against a researcher who acts in good faith, gives us reasonable time to fix the issue, and does not access other players' data.
11. Your rights
Depending on where you live, you have some or all of the following rights. All of them are free, and we answer within 30 days (extendable by two further months for complex requests, in which case we tell you why).
- Access — get a copy of the personal data we hold about you, as a structured JSON export. Ask at privacy@papertoad.com.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted. You can do this yourself; see Account & Data Deletion.
- Restriction — have us pause processing while a dispute about accuracy or legitimate interests is resolved.
- Portability — receive the data you gave us in a structured, machine-readable format. Our export is JSON.
- Objection — object to processing based on legitimate interests, including profiling. We stop unless we can show compelling legitimate grounds. If you object to direct marketing we always stop, no questions asked.
- Withdraw consent — at any time, without affecting what we did before you withdrew it.
- Not be subject to a purely automated decision with legal or similarly significant effect — see section 5.
- Complain to a supervisory authority — see section 14.
If you are in the UAE, the PDPL gives you materially the same set: access, correction, erasure, restriction, portability, objection, and the right to object to automated processing. Exercise them the same way.
If you are in California, you also have the rights to know, delete, correct, and opt out of "sale" or "sharing" under the CCPA as amended by the CPRA, and the right not to be discriminated against for using them. We do not sell or share personal information as those terms are defined, and we do not process it for cross-context behavioural advertising. We do not knowingly sell the personal information of anyone under 16.
Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah and Texas) give similar rights, and we apply the same process to those requests.
How to use them
- Delete your account in the game — the fastest route, and it needs no involvement from us at all: Settings → Account → Delete Account. You are asked for your password first, because it cannot be undone.
- Everything else by email — write to privacy@papertoad.com, including to receive a copy of your data. Include your player ID or the email address on the account. We may ask you to verify your identity from the account itself; we do this to stop someone else obtaining your data, and we do not use verification material for anything else.
12. Cookies, local storage and tracking
calltorule.com sets no cookies and runs no analytics or advertising trackers. It stores one item in your browser's local storage — your chosen language — so the site opens in the right language next time.
The game client stores your session tokens and settings on your device.
Full detail is on the Cookies & Local Storage Notice.
13. Marketing
We only send marketing email if you asked for it. Every marketing email carries a one-click unsubscribe link, and you can also unsubscribe by writing to privacy@papertoad.com. Withdrawing consent does not stop service messages — security alerts, purchase receipts, changes to these terms — because those are part of running your account.
We do not send marketing by SMS or push notification unless you have separately opted in to it, and you can turn push notifications off in your device settings and in the game at any time.
14. Complaints
If something about how we handle your data is wrong, tell us first at privacy@papertoad.com — it is usually the fastest fix. You do not have to, and you keep the right to complain to a regulator:
- United Arab Emirates — the UAE Data Office, established under Federal Decree-Law No. 44 of 2021.
- European Economic Area — the data protection authority of the country where you live, work, or where the issue arose. The list is published by the European Data Protection Board.
- United Kingdom — the Information Commissioner's Office, ico.org.uk.
15. Changes to this policy
We update this policy when the service changes or the law does. The "Last updated" date at the top always reflects the current version.
For material changes — a new purpose, a new category of data, a new class of recipient, or a change to your rights — we give at least 30 days' notice in the game, by email where we have one for you, and on calltorule.com before the change takes effect. Where a change requires your consent, we ask for it rather than assume it.
16. Contact
| Privacy and data rights | privacy@papertoad.com |
| Player support | support@calltorule.com |
| Security reports | security@papertoad.com |
| Controller | Papertoad FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates |
| EU / UK representatives | Being appointed — see section 2 |
This policy is published in English and Arabic. If the versions differ, the English version governs.