Privacy Policy

Effective date: October 25, 2026 · Last updated: October 25, 2026

This policy explains what Kawa Royale collects, why we collect it, who we share it with, how long we keep it, and the choices you have. It covers the Kawa Royale iPhone app, the game at kawaroyale.com, and our website at kawaroyale.app (together, "Kawa Royale" or "the Service"). Kawa Royale is run by Embergrove Software LLC, a California limited liability company ("we", "our", "us").

Kawa Royale is a free-to-play social casino game for adults 21 and over in the United States, except Washington and Idaho. It uses virtual coins only. No real money is wagered or won, and coins can't be cashed out or exchanged for anything of value.

The short version

You can play as a guest. Your guest progress is saved on our servers under a random guest ID.
If you sign in with Apple, Google or email, we receive the sign-in details that provider gives us, such as your email address.
Other players can see your profile: display name, username, avatar, level, some stats and your big wins.
After you confirm your age, we use Google Analytics, which sets cookies on the website, to understand how the game is used. We use Google reCAPTCHA to keep bots out.
Some features are optional and ask first: Passport (uses your location to find your city), Find Friends (uses your contacts), adding your phone number, and push notifications.
We don't sell your personal information, we don't show ads, and we don't share your information for advertising.
You can delete your account, including a guest account, from your profile.

1. Who we are

Embergrove Software LLC, 6061 E Kings Canyon Rd Ste 103, Fresno, CA 93727. Email: support@kawaroyale.com

2. What we collect and why

2.1 When you visit or open the game

Connection and device data. Like any website or app, our servers and our hosting provider receive your IP address, your browser or device type, and the pages you request. Cloudflare, which hosts our websites, uses your IP address to work out your country and U.S. state so we can block places where Kawa Royale isn't offered (see section 6).
Analytics. After you confirm that you're 21 or older, we use Google Analytics for Firebase in the game. On the website it sets cookies. It records the pages you view, the page that sent you to us, and in-game events: opening the game, starting a slot session, spins (including the bet and win in coins), big wins, level-ups, daily bonus claims, starting, completing or failing a purchase, collecting charms, and whether you allowed notifications. We don't send Google Analytics your account ID, name or email address. We don't use Google signals, and we've turned off ad personalisation signals for it. Google uses your IP address to estimate your general location.
Bot and abuse protection. The website and the app use Firebase App Check with Google reCAPTCHA Enterprise. reCAPTCHA collects hardware and software information, such as device and app data, and sends it to Google for analysis. This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.
Which link brought you here. If you arrive through one of our links, we note the channel as one short label (for example "yt" for YouTube, "fb" for Facebook, or "direct" if there was no label). Your browser keeps it until you have an account ID, and then we store it with that ID. We don't store the full link.
Age confirmation. We ask you to confirm that you're 21 or older. Your answer is stored on your device; the time you passed the age screen is one of the first-run milestones in 2.2. We create your guest account and start Google Analytics only after you confirm.

2.2 Your guest account and game data

When you confirm your age, we create a guest account with a random ID (Firebase Anonymous Authentication). No name or email is attached to it. Your game data is saved on our servers under that ID, so your progress survives a reload and features like leaderboards and gifts work. This includes:

your coin balance, level, XP and lifetime coin totals
game progress that syncs: daily bonus and streaks, missions, setup and tutorial progress, album and charms, boosts, cosmetics you own and have equipped, battle pass and VIP progress, Game Pass and Kawa Plus status, piggy bank, offers you've seen, cashback, per-game stats and your best wins
your profile and settings, including your privacy and notification choices in Settings
first-run milestones: when you first reached each early step of the game (for example, seeing the age screen, finishing setup, opening a game, and placing your first bet). We use these to see where new players get stuck.
the names you give to Passport venues (see 2.6)

Your guest ID is kept in your browser or app storage. If you clear that storage, uninstall the app, or switch devices without signing in, you lose access to the guest account and we can't reconnect you to it. The data stays on our servers until it is deleted (see sections 7 and 8).

Some things stay only on your device and are never sent to us: your sound settings, your answer to the age question, your hometown choice, and the exact locations of your Passport venues.

2.3 Signing in

You can link your account to:

Sign in with Apple. We receive a stable Apple user ID and an email address, which may be an Apple "Hide My Email" relay address. Apple may also share your name if you choose to share it.
Google (website). We receive your Google account ID, email address, name and profile photo, as Google provides them. We may suggest your Google name, or the part of your email address before the @, as your display name. You can change it before you save.
Email and password (website). We receive your email address. Firebase Authentication stores your password in hashed form; we never see it. Password-reset emails are sent by Firebase.

2.4 Your profile and what other players can see

You choose a display name, a username and an avatar. Other signed-in players can see:

your display name, username and avatar
your level, XP, and VIP tier and points
your album and charm collection, your per-game progress (spins, XP and biggest win), and your top wins
when you joined, your founding-player number if you have one, and when you were last active or online
your leaderboard ranks and the big wins shown in the Big Win feed
unless you turn it off, your big wins in the Live Feed for 24 hours, including your display name, avatar frame, the game, your bet, your win and the final reels
your Sports results on the Sports leaderboard
your activity (such as jackpots, completed sets and wishlist additions), your wishlist, and your club membership and club contributions. The app shows these mainly to your friends and club members.

Other players can find you by your username. We never show other players your coin balance, email address, phone number, payment details or sign-in IDs. Some profile items can show that you own something that is sold in the store, such as a charm.

2.5 Friends, gifts, clubs and reports

When you use social features, we store what those features need: friend requests and friendships, gifts you send and receive, club membership and club pool contributions, wishlist items, cheers, messages from Kawa in your mailbox, and players you block. If you report a player, we store the report: who you reported, the reason and any context you add.

We suggest friends to players with similar play patterns. You can turn this off with "Let other players discover me" in Settings.

When your account is created, it is made friends with our founder's account and receives a welcome gift from it. Like any friend, the founder can then see what the app shows to your friends. You can unfriend the founder at any time, and the "Auto-friend the founder on signup" setting is in Settings.

2.6 Passport (your location, optional)

Passport lets you collect a stamp when you're in one of the cities on our list. When you tap to claim a stamp or add a venue, the app asks your browser or phone for your location once. Your device works out the nearest city on our list. Only that city (its code and name) and the time are sent to us and stored with your Passport. Your exact coordinates are not sent to us. We use the city and time to grant stamps and to block claims that would mean impossible travel.

If you name a venue, the name you type is saved with your game data; the venue's coordinates stay on your device. We never track your location in the background. You can turn off location access at any time in your browser or phone settings.

2.7 Your phone number and contacts (optional, iPhone app)

Your phone number. If you add your number, the app converts it to a standard format on your device and stores a SHA-256 hash of it (not the number itself) with your account, along with the date you added it and whether other players can find you by it. Adding a number turns on discovery by default. Phone numbers are short, so someone who tried every possible number could match a hash back to a number. We therefore treat the hash as personal information.
Your contacts. If you use Find Friends and allow contact access, the app reads the phone numbers in your contacts, hashes them on your device, and sends only the hashes (up to 500 at a time) to our server to look for players who have chosen to be discoverable. We don't store your contacts or those hashes. We keep only a count, to limit how often you can search.
You can turn off discovery or remove your number in Settings, under "Phone & contact discovery". You can turn off contact access in iPhone Settings.

2.8 Sports

When you use Sports, we store your picks: the event, your selection, the price, your coin stake, and the result. Your results feed the Sports leaderboard, which other players can see. Sports uses virtual coins only.

2.9 Purchases

iPhone app. Purchases (coins, packs, passes and the Kawa Plus subscription) are processed by Apple. We never receive your payment card details. After a purchase, the app sends Apple's signed receipt to our server so we can verify it before delivering your items. We keep a record of the product, the transaction IDs, the purchase date and whether it was a test purchase.
Website. Real-money purchases are not available on the website yet. If we add them, a payment processor will handle your payment details, and we will update this policy before they launch.

2.10 Push notifications (iPhone app)

If you allow notifications, we store your device's push token with your account and use it to send alerts: offers and limited-time events, streak reminders, gifts, jackpots, wishlist updates and Sports results. When you allow notifications, we also sign your device up for offer and streak-reminder alerts. You can turn notifications off at any time in iPhone Settings → Notifications → Kawa Royale. The website does not send push notifications.

2.11 Error and crash reports

When something goes wrong on the website or in the app, the app sends us an error report: the error message and technical details, the page address, your browser or device type, the platform, a session ID and your account ID. We use these reports to find and fix bugs.
The iPhone app also uses Firebase Crashlytics, which sends crash reports to Google: your device model, iOS version, app version, technical details of the crash, and a Crashlytics installation ID. We don't attach your account ID to Crashlytics reports.

2.12 Fair play, security and fraud prevention

We keep a ledger of coin transactions and records of suspicious activity (such as impossible balances), linked to your account ID, and we count how often certain features are used, to prevent cheating and abuse. Our systems may automatically limit or suspend an account that shows strong signs of cheating. If that happens to you, email us and a person will review it.
If you enter a referral code, we store who referred you, your account ID, your level when you entered the code, a one-way hash of a random device ID created by the app, and a short scrambled value made from your IP address. We use these to pay the person who referred you and to stop self-referrals and repeat referrals from the same device.

2.13 When you contact us

If you email us, we keep your email address and what you send so we can help you.

3. Cookies and similar technologies

Browser storage (local storage and IndexedDB) keeps your game, your sign-in session and your settings working.
Google Analytics cookies (such as _ga) on the website, for analytics.
Google reCAPTCHA may set or read cookies to tell people from bots.

We don't use advertising cookies, we don't track you across other websites, and we don't include third-party advertising SDKs. You can clear cookies and site data in your browser at any time. Clearing site data also removes your guest ID (see 2.2).

4. How we use information

to run the game and your account, sync your progress, and run social features and Sports
to verify purchases and deliver what you bought
to apply our age and location rules
to prevent cheating, fraud, bots and abuse, and keep the Service secure
to understand how the game is used and improve it
to find and fix bugs
to send notifications you've allowed, and to reply when you contact us
to comply with the law and enforce our Terms of Service

5. Who we share it with

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only in these ways:

Google, which runs most of our backend as our service provider: Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Cloud Messaging, Crashlytics, Google Analytics for Firebase, App Check, reCAPTCHA Enterprise, and Google Cloud logging. Firebase privacy information
Apple, for Sign in with Apple, App Store purchases and push notifications. Apple Privacy Policy
Cloudflare, which hosts our websites and provides content delivery, DNS, security, and IP-based location. Cloudflare Privacy Policy
Google Fonts, which serves the fonts on kawaroyale.app. Your browser requests the fonts from Google, which receives your IP address.
Other players, as described in sections 2.4 and 2.5.
For legal reasons: to comply with the law or a valid legal request, or to protect the rights, safety and property of our players, us or others.
In a business transfer: if Embergrove Software LLC is part of a merger, acquisition or sale of assets, your information may be transferred, and this policy will continue to apply to it.

Sports scores and schedules come from third-party data sources. We don't send them any information about you.

6. Where Kawa Royale is available, and how we check

Kawa Royale is for people in the 50 U.S. states and Washington, D.C., except Washington and Idaho. On our websites, Cloudflare reads your country and state from your IP address. If you're outside the area we serve (including outside the U.S., in a U.S. territory, or somewhere we can't tell which state you're in), you'll see a "not available in your area" page instead of the game. When we block a visit, we write a log line with the country and state code, the website, the page address and the reason. We don't include your IP address in that line.

7. How long we keep information

This is what our systems do today:

Account and game data (guest or signed in): until you delete your account. We don't currently delete inactive accounts automatically.
Activity shown to friends: deleted automatically after 30 days.
Live Feed posts: deleted automatically after 24 hours.
Gift-return reminders: deleted automatically after 7 days.
Error reports (section 2.11): deleted automatically after 90 days.
Crashlytics crash reports: kept by Google for 90 days.
Google Analytics data: kept for 14 months.
Server logs: our Google Cloud logs, which include the IP addresses of requests to our servers, are kept for 30 days. Cloudflare keeps our website logs, including the location-block lines in section 6, for no more than 7 days.
Purchase records (including records we use to fix purchases that failed to deliver): kept after you delete your account, with your account ID removed, for as long as we need them for tax, accounting and fraud prevention.
Coin ledger and fair-play records: kept after you delete your account, for as long as we need them to prevent fraud and for accounting.
Jackpot payout history: kept after you delete your account, with your account ID removed.
Referral records: if you entered a referral code, the record is kept after you delete your account, but without your account ID or the IP value. Only the one-way device hash stays, so the same device can't be referred twice.
Your username: stays reserved after you delete your account, so nobody else can take it.
Reports made by you or about you: kept as long as we need them to keep the community safe.
Other players' own records, such as a note that they blocked you or marked you as a favorite, can still contain your old account ID, but no profile information.

8. Deleting your account, and your choices

Delete your account on the website or in the app: open your Profile and tap Delete Account. This works for guest accounts and signed-in accounts. It deletes your account and the information linked to it, including your profile and game data, public profile, friends, gifts and friend requests, club memberships, activity, Live Feed posts, big wins and leaderboard entries, Sports picks, Passport, referral codes, online status, error reports, link-source label, friend suggestions and your sign-in record. We keep only what section 7 says is kept after deletion.
Email us at support@kawaroyale.com to ask for a copy of your information, to correct it, or to delete it. We may ask you to confirm that the request comes from the account holder.
Privacy settings (in Settings): Show my activity to friends; Share my big wins to feed; Let other players discover me; Auto-friend the founder on signup; Wishlist notifications; Phone & contact discovery. "Show my activity to friends" hides your activity and online status in the app.
Device permissions: you can turn off location, contacts and notifications in your browser or phone settings at any time.
Analytics: you can block Google Analytics with your browser's privacy settings or an extension. The game still works.

9. Your privacy rights

9.1 Everyone

Wherever you live in the U.S., you can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it. Email support@kawaroyale.com. We'll respond within 45 days. If we turn down a request, we'll tell you why, and you can reply to ask us to reconsider.

9.2 California residents

Under California law (the CCPA, as amended by the CPRA), here is what we collected in the last 12 months:

Identifiers: account ID, guest ID, email address, username, device and push IDs, and IP address (processed by our providers and kept in our server logs for about 30 days; in our database we store only a scrambled value made from it, and only if you redeem a referral code).
Customer records: email address, and your name if Apple or Google provides it.
Commercial information: purchase records and virtual coin transactions.
Internet or other electronic network activity: gameplay and analytics events, error reports, first-run milestones and the link-source label.
Geolocation: country and state from your IP address on our websites, and your city if you use Passport. We don't collect precise geolocation.
Sensitive personal information: your email and password, if you sign in that way, used only to let you sign in.

We collect this from you, from your device, from Apple and Google when you sign in, and from Apple when you buy something. We use it for the purposes in section 4 and disclose it for business purposes to the service providers in section 5, and to other players as described in sections 2.4 and 2.5. We keep it as described in section 7.

We have not sold or shared personal information (as the CCPA defines those words) in the last 12 months, and we don't use sensitive personal information for any purpose that would give you a right to limit it. You have the right to know what we collect, to access it, to correct it, to delete it, and not to be treated differently for using these rights. You can use an authorized agent; we may ask the agent for proof of your permission. We don't share personal information with third parties for their own direct marketing.

9.3 Outside the United States

Kawa Royale isn't offered outside the United States. If you contact us from elsewhere, we'll still handle your request.

10. Children

Kawa Royale is only for adults 21 and over, and our Terms require you to be 21 to use it. The App Store age rating describes the app's content; our minimum age of 21 is what applies. We don't knowingly collect personal information from anyone under 21. Before a visitor confirms their age, the website loads reCAPTCHA and remembers on the device which link they came from. Google Analytics and the guest account start only after the age answer. If we learn that someone under 21 has an account, we'll delete it. If you're a parent and think your child has used Kawa Royale, email support@kawaroyale.com and we'll delete their information.

11. Security

Information is encrypted in transit between your device and our servers, and Google encrypts the data it stores for us. Our database rules let only you, our servers and the people who run Kawa Royale read your private game data. Your public profile, leaderboard entries and big wins can be read by other signed-in players, as described in section 2.4. No system is perfectly secure. If a data breach affects you, we'll notify you as the law requires.

12. Where we process information

Kawa Royale is run from the United States. Our server code and real-time database run in Google Cloud's United States (us-central1) region. Our service providers, including Google and Cloudflare, may also process information in other countries where they operate.

13. Changes to this policy

We'll post any change here and update the date at the top. If a change is significant, we'll tell you in the Service before it takes effect.

14. Contact

Embergrove Software LLC · 6061 E Kings Canyon Rd Ste 103, Fresno, CA 93727

support@kawaroyale.com

← Back to Kawa Royale · Terms of Service