Last updated 9 October 2026
Save The Princess is a free co-op tower defense game for Android and the web, operated by Misaligned Games ("we", "us"). This policy covers the game, its Android app and its website. Questions and privacy requests: support@misaligned.games. We do not sell your data, the game shows no ads, and it has no purchases.
On first launch the game signs you in anonymously: our database provider, Supabase (hosted in Frankfurt, Germany), creates an anonymous account id for you and a sign-in token that is kept on your device. There is no sign-up, and we never ask for your real name, email address, phone number or a password. Under that account id our database stores your progress:
Only our game server writes this data; the game can read only your own.
Online matches run on our game server, hosted by Fly.io in Frankfurt, Germany. For each match it receives your sign-in token (to find your account and grant your rewards), your deck, the cards you play, and the player name and avatar you chose. Other players in the match see your name and avatar during the match and on the results screen, and the server’s logs record the names in each match. The server uses your IP address to carry the connection and to limit how many requests one address can make; it keeps the address only in memory and forgets it once you are idle. There is no chat: players interact only through the game itself.
Your player name (up to 10 characters, typed by you), your avatar choice, your decks, your settings and your match statistics are also saved on your device. Matches played offline, against bots, run on your device alone (only the analytics events described below are sent).
We use PostHog (EU-hosted) to understand how the game is played and how well it runs. It receives
these events: the app or page was opened or left, how long the game took to start, a match started (the mode and the
stage) or ended (whether you won and how long the castle held), a level-up, a hero pick and, in the Android app,
whether install attribution (below) reached the game and which first-week return visit (below) was reported. With them it receives the game
version, whether you play on the web or in the Android app, the device model, operating system and browser details
that PostHog’s library reports, approximate (city-level) location derived from your IP address and, in the
Android app, the install attribution described below (the ad network and campaign that led to the install, or none).
In the Android app these events are stored under your device’s Android device identifier
(ANDROID_ID), which the app reads from the device; in a web browser, under a random identifier kept in
the browser. PostHog does not record taps or typed text beyond the events above, and session replay is not used: the
game does not record your screen. PostHog never receives your player name or your account id.
The Android app uses AppsFlyer to measure which ad campaigns lead to installs. AppsFlyer receives
your device’s advertising ID (GAID; the app declares the com.google.android.gms.permission.AD_ID
permission), the analytics device identifier described above (your ANDROID_ID) as its customer user id,
an install id of its own, your IP address (from which it derives approximate, city-level location), your device model and
operating system, basic install and app-open events, and whether you came back to the game in your first week (one
event each for day 1–2, day 3–5 and day 6–7 after installing, with a fixed placeholder value; no
purchase is involved). AppsFlyer processes this on our behalf.
Sharing with advertising networks. To attribute installs, AppsFlyer shares your device’s advertising ID, which is a device identifier, together with the install event and those return-visit events, with the advertising networks we run campaigns with (Google Ads and AppLovin), through attribution postbacks, for advertising and marketing purposes: so those networks can report and optimise which ads lead to installs of players who keep playing. We do not show ads in the game and do not build an advertising profile of you. You can reset or delete your advertising ID at any time in Android Settings → Privacy → Ads.
All of the data above is encrypted in transit (HTTPS and secure WebSockets).
Save The Princess is intended for players aged 13 and over. It is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has used the game, contact us and we will delete the data.
The game has no delete button yet. To delete your data, email support@misaligned.games with the subject “Delete my data”. Our database holds no name or contact details for your account, so to help us find it, include your player name, your level and roughly when you last played online; for analytics and attribution data, also include your device’s advertising ID (Android Settings → Privacy → Ads). Never send us anything from your device’s storage, such as the sign-in token.
What is deleted: your anonymous account and everything stored under it: your level and XP, your cards, heroes, hero shards, avatars and deck slots, your career stats and the record of your match rewards. We also ask PostHog and AppsFlyer to delete the data stored under your device identifiers. What is not edited: our game server’s logs, which our hosting provider (Fly.io) keeps for its log retention period, and our database provider’s backups until they expire.
Uninstalling the game or clearing its data removes the sign-in token and the data saved on your device, not your account from our database: the account can no longer be used, and it stays until you ask us to delete it. Resetting your advertising ID severs attribution but does not change the Android device identifier used by analytics. The game has no in-game analytics opt-out.