Grotto MercsPrivacy Policy
Last updated November 12, 2026
This policy covers the Grotto Mercs mobile game and the accounts behind it. It is written to be read, not to be survived.
Grotto Mercs is published by LateNiteScripts LLC ("we", "us"), which is the data controller for the information described here. You can reach us at support@lns.dev for any question about this policy, including a request to see or delete your data.
What we collect
| Data | Why | When |
|---|---|---|
| Email address | To identify your account, verify it, and let you reset your password | When you create an account |
| Password | To sign you in. Stored only as a one-way hash — we cannot read it | When you create an account with email |
| Apple or Google account identifier | To sign you in if you use Sign in with Apple or Google instead of a password | Only if you choose that sign-in method |
| Game progress — characters, inventory, skills, world state | To save your game and let you play across devices | Continuously while you play |
| Crystal Frags balance and ledger | To track the in-game currency you earn and spend, and to resolve disputes | On every balance change |
| Blockchain wallet address | To deliver items you mint or purchase on-chain | Only if you link a wallet |
| Purchase records — product, order reference, amount, transaction reference | To grant what you bought, and for refunds, disputes and tax records | When you make a purchase |
| IP address | To rate-limit sign-in attempts and block abuse. Not kept as part of your profile | On requests to our servers |
| Device integrity signals | To tell real devices from automated account farming | At sign-up and sign-in |
| Advertising identifier and ad interaction data | To show ads, including rewarded ads you choose to watch | While ads are shown |
Cryptocurrency is optional
You can play Grotto Mercs from start to finish without ever touching cryptocurrency. The wallet, on-chain minting and crypto payments are features you opt into. Nothing in the game requires them, and declining costs you no content.
The wallet is non-custodial. Not your keys, Not your wallet.
If you use the in-game wallet, its keys and seed phrase are generated on your device and are held there. They are never transmitted to us and we have no way to obtain them. We never hold or control your funds at any point — the wallet is non-custodial, and you are responsible for your own keys and seed phrase.
Because the wallet lives on your device, your device's security is your wallet's security. Someone with access to your unlocked phone, or to a backup of it, may be able to reach your wallet. Use a screen lock, keep the operating system updated, and do not install the game on a device you do not control.
A wallet address you choose to link is different: that is public information, and we do store it so we can send you what you buy.
iCloud sync on Apple devices
On iPhone, iPad, Mac and Apple TV you can choose to sync your saved data through iCloud, so it survives reinstalling the game and reaches your other devices. It is off unless you turn it on, and it is the only circumstance in which your wallet data leaves your device.
With it on, your encrypted save data is copied to your own iCloud account and the key that decrypts it is placed in your iCloud Keychain. Both belong to you, not to us — we still never receive either. Apple holds the encrypted data, but the key sits in iCloud Keychain, which is end-to-end encrypted, so Apple cannot read what that data contains. Apple's handling of it is covered by their privacy policy.
Turning iCloud sync off deletes both the synced data and the synced key from your iCloud account. Your wallet stays usable on the device in your hand.
If you lose your seed phrase
On Android, and on Apple devices without iCloud sync, a lost device and a lost seed phrase mean a lost wallet. We cannot restore it, because we never had anything to restore from. Nobody can.
On an Apple device with iCloud sync switched on, reinstalling the game while signed in to the same Apple ID can bring your wallet back, because your own iCloud holds both the data and the key.
Either way, keep your seed phrase somewhere safe and never share it. We will never ask you for it, and anyone who does is attempting to steal from you.
Advertising
We show ads through Google AdMob. AdMob may use your device's advertising identifier to limit repeated ads, measure performance, and — depending on your choices — personalize what you see. Google's handling of that data is covered by Google's privacy policy.
Where the law requires it, you are asked for consent before any personalized advertising and can change that choice at any time from the game's settings. You can also reset or delete your advertising identifier in your device settings — on Android under Settings → Privacy → Ads, and on iOS under Settings → Privacy & Security → Tracking.
Rewarded ads are optional. Watching one credits Crystal Frags to your account; declining costs you nothing but the reward.
Who else sees your data
We do not sell your personal information, and we do not share it for advertising beyond what the section above describes.
Your data is processed by service providers acting on our instructions, in these categories:
- Advertising — Google AdMob, as described above.
- Cloud hosting and databases — to run the game servers and store your account.
- Email delivery — to send verification and password-reset messages.
- Payment and app store processing — Apple and Google handle purchases made through their stores; we receive a confirmation and a transaction reference, never your card details.
- Public blockchains — if you mint or receive an on-chain item, that transaction is recorded on a public ledger that we do not control and cannot erase.
On-chain data is permanent
Anything written to a public blockchain — a mint, a transfer, your wallet address — is public and cannot be deleted by us or by anyone else, including after you delete your account. Consider this before linking a wallet you would rather keep private.
How long we keep it
- Account and game data — while your account exists, then deleted within 30 days of a deletion request.
- Purchase and currency ledger records — retained after account deletion where we are legally required to keep financial records, or to resolve an open dispute or chargeback. These are kept separately from your game profile.
- Abuse-prevention data such as IP addresses — a short rolling window, measured in days, not tied to your profile.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, object to how we use it, or receive a copy in a portable format. You can exercise any of these by emailing support@lns.dev. Because the sender of an email can be faked, we never act on the request message itself: we send a confirmation to the email address on your account and act only once you reply to it, and a copy of your data is only ever sent to that address. We respond within 30 days.
If you are in the EU or UK and are not satisfied with our response, you may complain to your local data protection authority.
Deleting your account
Email support@lns.dev with the subject "Delete my account". We will send a confirmation to the email address on your account, and nothing is removed until you reply to that message, so a request made in your name by someone else goes nowhere. If you signed in with Apple or Google and did not share an email address with us, we have no address to confirm with, so contact us and we will explain how to confirm the request from inside the game. Deletion is permanent: progress, items and any unspent Crystal Frags are not recoverable, and items already minted to a blockchain remain in your wallet and on the public ledger.
Children
Grotto Mercs is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, email support@lns.dev with the account's username or email address. We will look into every report, and if the account belongs to a child under 13 we will delete it and its data. We confirm with the account holder before deleting anything, so a report cannot be used to remove someone else's account.
International transfers
We operate servers in more than one country so the game responds quickly wherever you play, which means your data may be processed outside the country you live in. Where that involves transferring personal data out of the EU or UK, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
Changes
If we change this policy in a way that materially affects you, we will say so in the game before the change takes effect. The date at the top always reflects the current version.