Privacy Policy
DinoWar · Last updated: October 22, 2026
In short. DinoWar stores your email, your player name, your progress in the game, and the IP address of your open sessions, and nothing else. There are no ads and no third-party analytics services, no data is ever sold or handed over, and no other player can see your email.
You can delete your account and all your data yourself, from within the game, under Account → Delete account. It takes effect immediately and can't be undone.
Who is responsible
The party responsible for your data is DinoWar, the project that publishes this game.
For anything about your data, write to [email protected]. You don't need to write to anyone to delete your account: you can do it from the game itself. If you can't sign in, Delete your account explains how to request it by email.
What data is stored and what for
| Data | What for |
|---|---|
| Your email address | To identify your account, so you can find your collection in any browser, and to send you a link to confirm it when you create your account or if you forget your password, in the language you play in (which is saved with your account for that). It isn't used for anything else: no newsletters, no notifications. |
| Your password | Stored in irreversibly encrypted form by the authentication service. Nobody can read it, not even us. |
| Your player name | It's how others see you: in duels, in your tribe, and on the leaderboard of the top league. |
| Your progress | Cards, decks, dinocoins and shards, cosmetics, missions and the weekly chests you open, achievements, expeditions, league, tournament runs, and what you contribute to your tribe. |
| Your games | The state of each game while it's in progress and, when it ends, the result and what it paid out. This lets a game pick up where you left off and helps prevent cheating. |
| Emotes | The phrases and stickers you send your opponent in a duel, and when. They always come from a fixed list: there is no free text. This is used to deliver them and to limit how many can be sent. |
| Error reports | When something breaks —for example, a game whose reward can't be collected— the game logs it so it can be fixed: what failed, the numbers from that game, and which version of the game you had. Apart from your account, it contains nothing that could identify you, and it isn't used for anything else or shared with anyone. |
| Game usage | Which screens of the game you open, the tutorial steps you see, and the days you play, with the date and the game version. It's used to learn which parts get used and which don't, and to improve them. The game itself logs it, alongside your account: no third-party analytics service is involved, it isn't used for advertising, and it isn't shared with anyone. |
| Invites | Your invite code, who invited you —if you signed up with someone's code— and who you've invited. This is used to pay out invite rewards when the invited person wins their first games. Whoever invited you sees your player name and how many games you've won until the invite counts; never your email. |
| Friends | Who you sent a friend request to, who sent you one and who your friends are, and the duel challenges you leave for a friend. It is used to show you the list and so a friend can join your challenge without typing the code. What your friends —the ones you accepted— see on top of that is whether you have the game open right now (“online”) and, if not, how many days ago you played; never the time, nor your email. |
| Notifications on your device | Only if you turn them on in Account → Friends: the address that the notification service of your browser or phone (Google, Apple, Mozilla or Microsoft, depending on which you use) provides so you can be notified, its two keys, and the game language. It's used to notify you, with the game closed, of things that need an action from you: a friend challenges you, someone sends you a friend request or asks to join your tribe, someone in your tribe asks for a card you can donate or donated one to you, you were accepted into a tribe, or your tribe's boss has fallen. The notification travels encrypted through that service and carries only what kind it is and the player name of whoever caused it. You turn them off in the same place, and they stop being used as soon as you do. |
| Dates | When you created your account and when you last signed in. Your last sign-in decides, for example, when a tribe can replace a chief who no longer comes back, and your friends see it rounded: “online” if you have the game open, and otherwise in days (“today”, “3 days ago”). To know whether it is open, the game notes it every minute while it is on screen. |
| The IP address of your sessions | The sign-in service records it for each open session, and it is deleted when the session ends. It is checked only to detect one person playing duels against themselves with several accounts. It is not used for anything else, no other player sees it, and it is not shared. |
Your real name, phone number, location, contacts, and photos are never requested or stored. Real-money purchases, when there are any, are made only in the Android app and charged by Google Play: DinoWar never sees or stores your card or payment details. For each purchase it keeps the receipt Google provides —the purchase and order identifiers—, the product and the date, so your dinocoins are delivered exactly once.
What is stored on your device
The game doesn't use tracking cookies. In your browser's storage it keeps only what it needs to work: your session (so it doesn't ask for your password every time), a copy of your profile, your preferences (the language, whether your sound is off or your rival's emotes are muted), whether you've already seen the tutorial, whether you've already played the trial game, and which news you've read, and the graphics and music already downloaded so the game loads quickly. All of this goes away when you clear the site's data in your browser or uninstall the app.
The trial game, the one you can play once without an account, is played entirely on your device: nothing about it is stored or sent, not even the result.
What other players see
Your player name, your league, the cosmetics you have equipped in a duel, what you contribute within your tribe, what shows up on your tribe wall —your raids, your contributions, when you join or leave, the quick phrases you send, which are fixed: there is no free text, and the cards you request and donate—, which only your tribe sees and is deleted after 14 days, the emotes you send in a duel and, to whoever invited you, how many games you have while the invite doesn't count yet. In a ghost duel, another player plays against the last deck you saved, driven by the AI, with your name on it: they see the cards as they are played, like in any duel, and you are told how many times your deck was played against. In a tournament, your run’s deck can likewise be played against other participants of the same tournament, without your name. The leaderboard shows your name, your equipped portrait, your rank and division in your league with your duel wins for the season, and in the tournament your wins and losses for the week. And your public profile, which any player opens by tapping your name: your equipped title, portrait and banner, your league, your tribe, the month you started, how many games, wins, duels and seasons you have, and your achievements; Account → “How others see you” shows it as is. And your friends, the ones you accepted, also see whether you are online and, if not, how many days ago you played, never the time. Never your email, your collection, or your deck lists.
Who else is involved
DinoWar doesn't share your data with anyone for advertising or for any other purpose. To work, it uses these services, which process data on the game's behalf:
- Supabase — the database and sign-in. Your account and your progress are stored there, on servers in the United States.
- Cloudflare Pages — serves the game's files at play.dinowar.app and the landing page at dinowar.app. Like any web server, it receives your IP address when the page loads.
- Cloudflare Turnstile — the “I'm not a robot” check on the sign-in screen. Cloudflare receives your IP address and technical data about your browser to decide whether you're a person.
- Google — if you choose “Continue with Google” to sign in. Google checks that it's you and passes DinoWar your email address, your name and your profile picture. The game only uses the email address, just as if you had typed it; the name and the picture stay in the sign-in record and are never used or shown to anyone. Your Google password never reaches DinoWar.
- Google Play — charges for purchases made in the Android app and confirms to DinoWar that a purchase has been paid. What Google processes when charging is governed by its own privacy policy.
- The email provider that sends the link to confirm your email when you create your account and the password reset link, and which receives your email address at the moment it sends them.
The game's Instagram account, @dinowartcg, is linked from “Account” and from dinowar.app. It's only a link: the game loads nothing from Instagram, and whatever Instagram processes if you open it is governed by its own privacy policy.
How long it's kept
For as long as you have your account. When you delete it, your data is removed from the database right away. It may remain for up to seven days in the service's automatic backups, which overwrite themselves and aren't used for anything other than restoring the whole database after a failure.
Three exceptions: if you founded a tribe, a fingerprint of your email is kept —a code derived from it that can't be turned back into the email— so the starter storehouse of a first tribe can't be claimed again by deleting the account and creating it anew. The same goes for gift codes: that fingerprint is kept next to each code you redeemed, so it can't be redeemed twice. It carries no name, collection or anything else. And the receipt of each purchase made through Google Play —the purchase and order identifiers, the product and the date— is kept without your account, so a purchase already delivered can't be credited again from another account.
Your rights
- Delete your account and all your data: in the game, Account → Delete account, or by email if you can't sign in. The steps are in Delete your account.
- Correct your player name: on the same screen (once).
- Find out what's stored about you, or request a copy: write to us at the contact above.
Children
DinoWar is a dinosaur card game with no chat and no ads, and real-money purchases, if any, go through Google Play. Even so, creating an account requires an email: if you're under 14, ask an adult to create it with you.
Changes to this policy
If what is stored or who it's shared with changes, this page changes before the game does, and the date at the top is updated.