Privacy notice

Last updated: 29 October 2026

This notice says what Squad to Glory keeps about you, why, for how long and who else sees it. We do not sell your data.

Who we are

Squad to Glory is made and run by Firmwork Consultoria e Serviços Informáticos, Lda. ("Firmwork" or "we"), a Portuguese private limited company with its registered office in Arrifana, Santa Maria da Feira, registered in the commercial registry under the single registration and tax number 518102947, with a share capital of €1,000.

Firmwork decides how your data is used: it is the data controller. Write to [email protected] about anything in this notice. We have no data protection officer, because the law does not require one for a service like ours.

Your account

Your email address, your birth year, your language, the name and tag of your player, your club and progress, your coins and Gems with every change to them, the version of the terms you accepted, and when you last played.

You must give an email and a birth year to play: without them we cannot make an account.

Why: To run the game for you: save your progress, keep the economy fair and show your player to other players.
Legal basis: Our contract with you (the terms of use).
How long: Until you delete your account.
Who else gets it: Other players see your player's name, tag, club and results. Nobody else, beyond the companies under "Who helps us run the game".
Under 16: The same for every age, apart from the rules under "Age and players under 16".

Signing in

To sign in with your email, we send you a code by email through Microsoft (Exchange Online). The code works once, for 15 minutes. A sign-in on a device lasts up to 30 days.

If you sign in with Google, Microsoft or Facebook, we keep the id that service gives your account and the email it shares, to know it is you next time. We ask for nothing else: no contacts, no posts, no friends list. The service learns that you signed in to Squad to Glory. If you turn on two-step verification, we keep its secret encrypted.

Why: To know it is you and keep others out of your account.
Legal basis: Our contract with you.
How long: Your sign-in: until you delete your account, or until you unlink the service in Settings, Ways to sign in. Each request for a code, with the email it went to: 2 days, whether or not you made an account. A sign-in that ended: 1 day after it ran out.
Who else gets it: Microsoft sends the sign-in email. Google, Microsoft or Facebook only if you sign in with them.
Under 16: The same for every age.

Age and players under 16

Squad to Glory is for players aged 13 and over. We ask for your birth year only, never your date of birth. We count ages on the safe side: if you could still be 12 this year, you cannot sign up yet, and if you could still be 15, we treat you as under 16.

Under 16: only ads that are not personalised, the same offers as everyone in the same situation, and your name never shows in player search. Under 18: no paid scouting draws.

Why: To keep younger players safe and follow the law on ads and paid draws.
Legal basis: Our legal obligations, and our legitimate interest in keeping young players safe.
How long: Your birth year: until you delete your account.
Who else gets it: Ad partners are told only that you are under 16, never your birth year.

Club chat and messages

What you write in club chat and in messages to other players, who it went to and when, and any report about a message.

Why: So you can talk to your club and your friends, and so we can act on reports of abuse.
Legal basis: Our contract with you. Reports: our legitimate interest in keeping players safe.
How long: Messages between players: 90 days. A request nobody answers: 30 days. Club chat: until you delete your account. A reported message stays until we deal with the report. Reports and what we did about them stay after that, so we can deal with repeat abuse.
Who else gets it: The people in the chat or the conversation. Our team reads a message when someone reports it. With notifications on, the start of a message goes through a push service (see "Notifications").
Under 16: Under 16: your name never shows in player search. A message from someone who is not your friend comes with a warning.

Purchases

What you bought, the price, when, the order and payment numbers, and that you asked for delivery at once (which ends the 14-day right to cancel).

In the Android app, Google Play takes the payment. On the web, Stripe does. They collect your card and billing details themselves: we never see your card number.

Why: To give you what you paid for, handle refunds, stop fraud and keep the records the law asks for.
Legal basis: Our contract with you, and our legal obligation to keep tax and accounting records.
How long: Your monthly card and other running purchases end when you delete your account. The purchase records stay as long as tax and accounting law requires (in Portugal, up to 10 years), without your email or player.
Who else gets it: Google Play or Stripe. We send Stripe your game account id and the item. We send Google Play a scrambled account id.
Under 16: Under 18: no paid scouting draws. Paid draws are also off in Belgium.

You see an ad only when you choose to watch one for a reward. In the Android app the ads come from Google AdMob. On the web they come from Google (AdSense and H5 Games Ads). These partners use cookies and device identifiers, such as the Android advertising ID, to show ads, count them and stop fraud.

With your consent, ads can be personalised to your interests, and which reward offer shows can depend on the offers you turned down before. Without it, you get ads that are not personalised, which still use cookies to count and limit ads and stop fraud. You can change your choice at any time in Settings, Ad privacy choices. For Google ads you can also use My Ad Center (myadcenter.google.com).

We keep a record of each reward ad you start (the reward, the ad network, the time and the network's check that the ad finished), so the reward is paid once. For adults we keep the country with it.

Why: To pay for the free game and give you your rewards.
Legal basis: The cookies and device identifiers the ad partners use, and personalised ads: your choices in the consent form. Reward records: our legitimate interest in paying for the free game and stopping fraud.
How long: Reward records: until you delete your account. Counts of ads offered and watched stay after that, without your account. The ad partners keep their own data under their own privacy notices.
Who else gets it: Google (AdMob, AdSense, H5 Games Ads). Google decides for itself how it uses what it collects.
Under 16: Always ads that are not personalised, and the ad partner is told you are under 16. No country is kept with your reward records.

Notifications

If you turn notifications on, we keep the address your device gives us for them (a push token). Each notification goes through Google (Firebase Cloud Messaging) in the Android app, or through your browser's push service on the web. A message notification shows the sender's name and the start of the message.

Why: To tell you when something happens in the game, such as a new message or a finished match.
Legal basis: Our contract with you: notifications are a part of the game you turn on, and you can turn them off at any time.
How long: The push token: until you turn notifications off, the device stops taking them, or you delete your account. The list under the bell, and our copy of each notification sent: 30 days.
Who else gets it: Google, or your browser maker's push service (for example Google, Mozilla or Apple).
Under 16: The same for every age.

The trial match before you have an account

Before you make an account you can play one trial 1v1. For it we keep a scrambled code (a keyed hash) made from your device id, and one made from your IP address.

Why: To stop one device from playing endless trials, and to move the trial into your new account.
Legal basis: Our legitimate interest in stopping abuse.
How long: 24 hours.
Who else gets it: Nobody.
Under 16: The same for every age.

Fair play and security

Each time you sign in, we keep a scrambled code (a keyed hash) of your device id and of your IP address. When your account is deleted, we keep a scrambled code of your email address.

Why: To find extra accounts and cheating, such as one person lending players to their own second account or claiming a Bring a friend reward twice.
Legal basis: Our legitimate interest in a fair game.
How long: The sign-in codes: until you delete your account. The email code: after your account is deleted, so the same email cannot claim a new player reward again. Reports about you and our moderation notes also stay after you delete your account, so we can deal with repeat abuse.
Who else gets it: Nobody.
Under 16: The same for every age.

Your country

Our network provider, Cloudflare, tells our server the country of each request, worked out from your IP address. We do not save it on your account.

Why: Paid draws are off where the law treats them as gambling (Belgium today). For adults, the country is saved with reward ad records, for ad statistics.
Legal basis: Our legal obligations (paid draws), and our legitimate interest (ad statistics).
How long: Not kept, except with reward ad records (until you delete your account) and in the server log (up to 7 days).
Who else gets it: Cloudflare.
Under 16: Not saved with reward ad records.

The server log

Our web server notes each request: the page or game action asked for, the time, your browser, the country of the request and your network (your IP address cut short, never in full). It never holds your sign-in links, codes or session.

To slow down abuse, the server also counts requests from each IP address for up to an hour. That count is held in memory only and never saved.

Why: To find errors and stop abuse.
Legal basis: Our legitimate interest in a working, secure service.
How long: Up to 7 days.
Who else gets it: Nobody.
Under 16: The same for every age.

Game statistics

We note simple game events, such as "training finished" or "trial played", and when each visit starts. We use no outside analytics service.

Why: To see which parts of the game work and where players get stuck.
Legal basis: Our legitimate interest in improving the game.
How long: 13 months, or less if you delete your account first. Events from the trial match carry no account.
Who else gets it: Nobody.
Under 16: The same for every age. Statistics never change the offers a player under 16 sees.

Who helps us run the game

Our server and its backups are in Portugal, with a hosting company we rent it from.

These companies handle data only for us, for the jobs above: the hosting company, Cloudflare (the network in front of the site), Microsoft (sign-in emails) and Google (Android notifications).

These companies also decide for themselves how they use what they get, under their own privacy notices: Google (Google sign-in, Google Play payments and ads), Microsoft (Microsoft sign-in), Meta (Facebook sign-in) and Stripe (payments on the web).

Some of them handle data outside the European Union, mostly in the United States. Those transfers rely on the EU's own safeguards: the EU-US Data Privacy Framework or the EU's standard contract clauses.

Your choices

In Settings you can download your data or delete your account at any time. The download has everything we keep about you: your account, your player and game history, the messages you wrote, your purchases, your sign-ins, your notifications, the reward ads you watched, and any report or moderation about you. What other players wrote stays theirs: the download shows when a message or a report came, not its words.

Deleting your account removes your email, your player, your sign-ins (linked Google, Microsoft or Facebook, two-step verification), your messages, your notifications and your game statistics. What stays, with nothing that names you: coin and Gems records, purchase records (as the law requires), counts of ads, reports and moderation notes, and the scrambled email code (see "Fair play and security"). Deleted data leaves our nightly backups, which are encrypted, within 14 days.

We make no automated decisions about you with legal or similarly serious effects.

You also have the right to see, correct or take a copy of your data, to object to or limit how we use it, and to withdraw a consent at any time. Write to us for any of these. If you think we got something wrong, you can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

Contact

Questions about your data go to Firmwork, the company behind the game. Write to [email protected].