Legal

Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Chemify OÜ ("Chemify", "we", "us", or "our") collects and processes personal data when you use Primalings, including the website, browser game, accounts, cloud saves, and Primalings Plus (the "Service"). Chemify OÜ, registered in Tallinn, Estonia, is the data controller for the processing described here.

1. Information we collect

Information you provide

• Account data: email address, account identifier, display information, and identity-provider information when you register or sign in.
• Support data: messages, contact details, and information you choose to include when contacting us.
• Billing data: transaction, customer, subscription, product, status, and entitlement identifiers received from Dodo Payments. We do not intentionally receive or store full payment-card details.

Game and usage information

• Game data: Expedition progress, team, run history, discovered Primalings, settings, limits, rewards, and save timestamps.
• Device and log data: IP address, browser and device type, operating system, timestamps, requested pages, error details, and security or diagnostic logs generated by our hosting and service providers.
• Analytics data: if analytics is enabled, product events such as page views, Expedition starts, battle outcomes, recruitment, pricing views, and checkout confirmation, together with coarse device and usage information.

Local guest data

You can play without an account. Guest saves and discovered-Primaling records are stored in your browser's local storage on your device. Chemify does not receive that local game state unless you sign in and use a cloud feature, submit it for support, or a separately described feature transmits it.

2. How we use information

We use personal data to:

• provide, maintain, secure, and troubleshoot the Service;
• create and authenticate accounts and synchronize cloud saves;
• operate gameplay limits, subscriptions, entitlements, and billing support;
• restore progress, prevent fraud or abuse, and enforce our Terms;
• respond to support, privacy, and legal requests;
• understand feature use and improve reliability, accessibility, and game balance; and
• comply with tax, accounting, consumer-protection, and other legal obligations.

We do not sell personal data or share it for third-party behavioral advertising.

3. Legal bases

Where the General Data Protection Regulation applies, we rely on:

• Contract: to provide accounts, cloud saves, gameplay, subscriptions, and support you request.
• Legitimate interests: to secure the Service, prevent abuse, diagnose faults, understand core product use, and improve Primalings, where those interests are not overridden by your rights.
• Legal obligation: for tax, accounting, regulatory, fraud prevention, and lawful disclosure requirements.
• Consent: where required for optional analytics, device storage, communications, or another specifically explained purpose. You may withdraw consent at any time without affecting earlier processing.

4. Service providers and disclosures

We disclose information only as needed to operate the Service, complete a transaction, comply with law, or protect rights. Providers may include:

• Google Firebase: authentication, database, cloud-save, and optional analytics infrastructure;
• Dodo Payments: hosted checkout, payment processing, subscription management, taxes, and billing records;
• hosting and infrastructure providers: website delivery, networking, logs, security, and deployment; and
• professional and public authorities: advisers, auditors, insurers, courts, regulators, or law enforcement where reasonably necessary or legally required.

If Chemify is involved in a merger, financing, reorganization, sale of assets, or similar transaction, information may be disclosed under appropriate safeguards and transferred as part of that transaction.

5. International transfers

Chemify is based in the European Economic Area. Some providers may process information in other countries. Where personal data is transferred outside the EEA or another jurisdiction that restricts transfers, we rely on an adequacy decision, approved contractual protections such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, as appropriate.

6. Retention

We keep personal data only for as long as needed for the purposes described above. Account and cloud-save data is generally retained while your account is active and for a reasonable period after deletion to complete backups, security review, or dispute handling. Billing, tax, and transaction records may be kept for the period required by applicable law. Security logs are kept only as long as reasonably necessary to protect and diagnose the Service.

Local guest data remains on your device until you clear browser storage, remove it through available controls, or the browser removes it. Deletion from active systems may not immediately remove data from encrypted backups; backup copies are isolated and expire on their normal schedule.

7. Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, authenticated requests, server-controlled billing records, and signed payment webhooks. No online service can guarantee absolute security. Keep your device and sign-in method secure and contact us if you suspect unauthorized account activity.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal data; object to processing based on legitimate interests; withdraw consent; and complain to a supervisory authority. These rights may be subject to legal exceptions.

You can play as a guest, clear local game data through your browser, manage your subscription from Account, and contact us to exercise a privacy right. We may need to verify your identity before completing a request. You may also lodge a complaint with the Estonian Data Protection Inspectorate or the data-protection authority where you live or work.

9. Children

The Service is not directed to children who are below the age at which they may consent to online data processing in their jurisdiction. If a child requires parental consent, their parent or legal guardian must provide it. If you believe a child provided personal data without valid consent, contact us and we will investigate and take appropriate action.

10. Automated decision-making

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects. Automated game outcomes, difficulty, encounters, and anti-abuse checks concern operation of the game and Service, not legal decisions about you.

11. External links and services

Primalings may link to websites, app stores, identity providers, or payment pages operated by others. Their processing is governed by their own privacy notices. Review those notices before providing information directly to them.

12. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will post the new version here and revise the date above. If a change materially affects how we use personal data, we will provide additional notice where reasonably possible or legally required.

13. Contact

Please include enough information to identify your account and the request, but do not email passwords, payment-card numbers, or other unnecessary sensitive information.