Privacy policy

Using the game is also subject to our Terms of Service.

Last updated: 4 November 2026

This policy explains what data the Bastion Idle game (Android and iOS) and this website collect, why, and your rights. Bastion Idle is published by Nugent Project Support Ltd (company number 12010673), the data controller under UK GDPR, registered office 6 Trotman Walk, Cirencester, GL7 1RJ, United Kingdom. Contact: support@bastionidle.co.uk.

1. Data we collect

• Account identifier. When you first play online the game signs you in anonymously with Google Firebase Authentication. This creates a random user ID. We do not ask for your name, email or password.
• Google Play account link (optional). If you choose Settings › Account › “Link Google Play account”, Firebase Authentication stores your Google Play Games player ID and display name with your account so you can restore your game on another device. We do not receive your email address or password. You can unlink it at any time in the same place, and it is removed when your account is deleted.
• Public Player ID. Your account is also given a short random Player ID (for example BX7K-29QM). It is different from your account ID and is shown in Settings › Account so you can share it.
• Game progress. Your save (upgrade levels, currencies, settings, run history, tournament results) is stored in Google Cloud Firestore so it can be restored on another device. Game logic runs on Firebase Cloud Functions.
• Tournament entries. Your wave score and in-game display name are shown on tournament leaderboards to other players.
• Purchases. In-app purchases are processed by Google Play or the Apple App Store. We receive a purchase receipt (product, order/transaction ID, time) to grant and restore your items. We never receive your card or bank details.
• Advertising data. Optional rewarded ads are provided by Google AdMob. AdMob may collect your device's advertising ID, IP address, approximate location and ad interaction data to show and measure ads and prevent fraud. In the UK, EEA and Switzerland we ask for your consent through Google's consent form (User Messaging Platform) before personalised ads are shown. See how Google uses data.
• Technical data. Firebase services process IP addresses and device/app version information to run the service, keep it secure and enforce tournament version requirements.
• Support emails and tickets. If you email us or send an in-game ticket, we keep your message, any email address you give and, if you choose to attach it, a diagnostics snapshot (game version, platform, Player ID, tier, best waves, gems, coins, recent errors, device model), to answer you.
• Pre-purchase save copies. When you buy something, we keep a copy of your game save from just before the purchase for 1 year, so it can be restored if the purchase is refunded.

Referral codes. If you invite friends, we store your referral code, which accounts redeemed it and the rewards granted, to give both players their rewards and prevent abuse. When you enter a friend's code, we also store a one-way hash of your device identifier (Android ID) and, if your game is linked, your Google Play Games player ID, so the welcome reward can't be claimed again after reinstalling. The hash can't be turned back into the identifier. If you use a creator code, we store the code and the gems credited to that creator. We do not collect your contacts.

The game does not include any separate analytics or tracking SDK.

2. The Bastion wiki and your Player ID

The player wiki on this website can show your progress if you enter your Player ID (or paste a progress code you exported from the game). The lookup returns only: Workshop, lab, card, mastery, Armoury, Mk II, augment and drone levels; your selected tier and best wave per tier; claimed wave milestones; offline-hours level; card slots; and game version. It never returns your account ID, currency balances, purchases, email or device information. Anyone who knows your Player ID can see this information.

To turn it off: in the game go to Settings › Account and switch off “Show my progress on the Bastion wiki”. Lookups for your ID then return nothing. Sharing is on by default. Progress entered on the wiki is stored only in your own browser (local storage) and can be cleared with the Clear button.

3. Why we use it (legal bases)

• To provide the game, cloud save, purchases and tournaments: performance of a contract.
• Security, fraud and cheat prevention, the public wiki lookup and service improvement: legitimate interests.
• Personalised advertising: consent, which you can withdraw at any time in Settings › Privacy options.
• Keeping purchase records: legal obligation.

4. Who we share it with

Google (Firebase, Cloud Firestore, Cloud Functions, AdMob) and Apple/Google as app stores, acting as processors or independent controllers under their own terms. We do not sell your personal data.

5. International transfers

Google may process data outside the UK/EEA. Transfers are covered by the UK International Data Transfer Addendum / EU Standard Contractual Clauses in Google's data processing terms.

6. How long we keep it

Game and account data are kept while your account is active and deleted within 30 days of a deletion request. Purchase records may be kept for up to 6 years for tax and accounting. Inactive accounts may be deleted after 24 months without play.

7. Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. See how to delete your account. Email support@bastionidle.co.uk; we reply within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local authority.

8. Children

Bastion Idle is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has used the game, contact us and we will delete the data.

9. This website

This site sets no cookies and uses no analytics. The hosting provider processes IP addresses in server logs for security. The home page embeds our trailer in YouTube’s privacy-enhanced mode (youtube-nocookie.com). The player loads only when that section comes into view; YouTube (Google) then receives your IP address and may store data on your device, particularly if you play the video. See Google’s privacy policy.

10. Changes

We will update this page and the date above if this policy changes.