Privacy Policy
Last updated 10 October 2026 (draft)
This policy explains what personal data Narcotra collects, why, and your choices. The game is operated by Narcotra ("we", "us"), the controller of your data. Contact: [email protected].
What we collect
Account data: your email address, display name, and a salted password hash (we never store your password). If you sign in with Apple or Google we store the provider's stable user id for that sign-in and the email it shares with us.
Gameplay data: your character, cash, Gold, items, plots, family membership, chat messages, crimes, contests, casino results, achievements and leaderboard standing. The game is server-authoritative, so this is stored on our servers.
Purchase records: when you buy Gold or a membership, the store (Apple or Google) and our billing provider RevenueCat process the payment. We receive and keep the transaction id, product, amount, currency, date and status. We never see your card details.
Push notification tokens: if you allow notifications we store an Expo push token for your device so we can send game alerts. You can turn these off in Me, Settings or in your device settings.
Email delivery: password-reset emails are sent through Resend, which receives your email address and the reset link.
Technical data: your IP address and request metadata are used for rate limiting, abuse prevention and security logs. We do not use advertising trackers or sell your data.
The launch waitlist (narcotra.com)
If you join the waitlist on narcotra.com we store your email address and the time you agreed. We use it only to send you a confirmation email and, once, a message when Narcotra opens. We email you a confirmation link first; until you click it we do not treat you as subscribed, and an unconfirmed address is deleted after 30 days. The legal basis is your consent, which you can withdraw at any time.
Every email from the list has an unsubscribe link, and using it deletes your address straight away. You can also email [email protected] from that address to ask us to delete it. We do not share the list with anyone except our email provider (Resend), which sends the messages for us, and we never sell it.
Why we use it (legal bases)
To run your account and the game (performance of our contract with you); to process purchases and keep financial records (contract and legal obligation); to keep the game fair and secure, including rate limiting and detecting cheating or multiple accounts (legitimate interests); to send push notifications (your consent).
Who we share it with
Service providers that process data for us: RevenueCat (purchases), Apple and Google (sign-in, payments, app stores), Expo (push delivery), Resend (email) and our hosting provider. Other players see your display name, title, avatar, family, rank and public stats, and your chat messages in the channels you post in. We may disclose data where the law requires.
How long we keep it
Account and gameplay data are kept while your account is active. When you delete your account we remove your character and personal data straight away (see below). Purchase and Gold ledger records are kept for up to 7 years for accounting and tax, linked to an anonymous account number only. Rate-limit and security logs are kept for up to 90 days. Backups are overwritten within 30 days.
Deleting your account
In the app go to Me, Settings, Delete account and confirm with your password (or Apple sign-in). Your sessions are revoked, your email, password, sign-in ids, push tokens and character are deleted, and your name becomes "Former member". You can also email [email protected] from your account email to ask us to delete your account or data.
Your rights
Under UK and EU data protection law you can ask for access to, correction, deletion, restriction or a portable copy of your data, and object to processing based on legitimate interests. Email [email protected]. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Children
Narcotra is not for children. You must be at least 16 to play in the UK and EU (13 elsewhere where the law allows, and 17+ on the App Store rating). We do not knowingly collect data from younger children; if you think a child has signed up, email us and we will delete the account.
International transfers and security
Some providers are based outside the UK and EU. Where that happens we rely on approved safeguards such as standard contractual clauses. We use encryption in transit and access controls, but no system is perfectly secure.
Changes
We may update this policy and will change the date above; for material changes we will tell you in the app.