How R.A.M handles information

Effective and last updated: October 20, 2026

This Privacy Policy applies to the R.A.M apps for Android and iPhone and to these R.A.M legal pages. R.A.M Works, based in Israel, is responsible for the processing described here. The game is distributed through Google Play and, from its App Store release, through Apple's App Store, in the countries and regions where each store offers it. Where this policy describes the iPhone app, it applies from that app's first App Store release.

Scope by platform. The Android app uses Google AdMob, Google's User Messaging Platform (UMP), Google Play Billing, Firebase Authentication, Google Sign-In, Cloud Firestore, Firebase Cloud Functions, Firebase App Check, Google Play Integrity, and, only for adult players who opt in, Google Analytics for Firebase for performance diagnostics. The iPhone app uses Google AdMob, UMP, Apple's App Tracking Transparency (ATT) prompt and SKAdNetwork, Apple's App Store in-app purchases, Sign in with Apple, Google Sign-In, Firebase Authentication, Cloud Firestore, Firebase Cloud Functions, and Firebase App Check with Apple App Attest; it does not offer or collect performance diagnostics. Browser builds do not display ads, offer store purchases, or collect performance diagnostics. R.A.M does not use Crashlytics.

1. Information we process

Firebase accounts and sign-in

If you continue as a guest, Firebase Authentication creates an anonymous account with a stable Firebase user identifier (UID), authentication credentials, and account metadata such as creation and last-sign-in times. A guest account does not require your name or email address.

If you choose Google Sign-In, Google and Firebase may provide and process your Firebase UID, Google provider identifier, email address, display name, profile-photo URL, email-verification status, and sign-in/account timestamps when those fields are available from your Google account. R.A.M does not receive your Google password. Authentication ID and refresh tokens are processed to keep you signed in and authorize Firebase requests.

On iPhone you can also choose Sign in with Apple. Apple and Firebase then process your Firebase UID, a stable Apple user identifier issued for R.A.M, the email address you choose to share (which may be a private relay address created by Apple that forwards to your real address), your name if you choose to share it at your first sign-in, and sign-in/account timestamps. R.A.M does not receive your Apple Account password. When you delete an Apple-linked R.A.M account in the app, R.A.M revokes its Sign in with Apple authorization. You can also stop using Sign in with Apple with R.A.M at any time in your iPhone's Apple Account settings.

A guest account can later be linked to Google, or on iPhone to Apple, without changing its Firebase UID.

Backend-request and technical information

When the game contacts Firebase, Google service infrastructure may process your IP address, user agent, Firebase Android or iOS app identifier, Firebase Installation ID, app-instance identifiers or tokens, request timestamps, the Cloud Function name, and your Firebase UID when you are signed in. The Firebase callable-functions SDK may automatically attach an FCM registration token or similar app-instance token even though the current R.A.M release does not provide push-notification messaging.

Authenticated callable Cloud Functions in europe-west1 load your player profile (progression, Gem wallet, and account entitlements), apply progression actions such as research choices, Credit purchases and lineup changes, settle battle rewards against server-issued battle receipts, verify rewarded ads and Google Play or App Store purchases, grant premium daily Gems, delete account data, and provide the optional ping connection test. Firebase attaches authentication and technical tokens. These functions derive your records from the authenticated Firebase UID and reject unauthenticated requests. Google Cloud may process operational request logs and diagnostics needed to run and protect the service.

Cloud game progression

R.A.M stores a private Cloud Firestore progression document under your Firebase UID. It contains per-vehicle research progress, selected national research targets, Credits, researched and purchased vehicles, pending research overflow and completion state, ability research and the ability equipped for each nation, nation lineups, active lineup slots, and identifiers of verified rewards already applied. It also contains a schema version, save revision, and server timestamps. It does not contain your Google or Apple email, display name, profile photo, or password.

Battle rewards are calculated on the server from a battle receipt that the server opens when a match starts. A receipt records the selected nation, battle mode, the highest vehicle tier in your lineup, start and completion times, and a bounded match summary: kills, assists, captures, the tiers of the vehicles involved, victory or defeat, and match duration. These records let the server award research points, Credits and Gems once per match and prevent replayed or inflated results.

The server also counts how many rewarded battles your account starts each UTC day, and past a daily limit set well beyond normal play it stops awarding rewards for the rest of that day. When a match report looks automated or impossible (for example, kills arriving faster than a person can play, a report the server refuses, or reaching the daily limit), the server keeps an integrity review record containing your Firebase UID, the battle receipt, the day, the reason and the counters involved. These records are used only to detect cheating and reward farming. They are never shown to other players and do not change your rewards by themselves.

Account entitlements

R.A.M stores an entitlement record under your Firebase UID that says whether the account owns the Remove Ads or Premium products and whether it is a closed-beta tester account. Closed-beta status is derived from the Firebase account's creation time. If your account was included in a one-time compensation grant, R.A.M also keeps a record of that grant under a one-way hash of your UID, so it is applied only once.

Advertising, age band, and privacy choices

The Android and iPhone apps ask you to select either age 13–17 or age 18+. That age band is stored on the device and is used to configure advertising protections and, on Android, to decide whether performance diagnostics may be offered. For ages 13–17, R.A.M requests non-personalized ads with Google's teen treatment and a maximum PG content rating, and never offers or collects performance diagnostics. For ages 18+, UMP may display regional consent or privacy messages and record the resulting personalized, non-personalized, or limited-ad choice. You can change the age band and reopen available advertising privacy choices in Settings.

On iPhone, R.A.M asks players who selected age 18+ for permission through Apple's App Tracking Transparency prompt before Apple's advertising identifier (IDFA) can be used for ads; UMP may first show a short message explaining the prompt. If you decline, or later turn tracking off in your iPhone's settings, the IDFA is not available to R.A.M or AdMob. Players who selected age 13–17 are never shown the prompt and always receive non-personalized ads. AdMob may use Apple's SKAdNetwork, which reports ad-driven installs to advertisers in aggregated form without identifying you or your device.

AdMob and its advertising infrastructure may process the advertising ID (Android advertising ID, or IDFA on iPhone when you allow tracking) where available, IP address, device and app identifiers, approximate location derived from network information, interactions with ads, consent signals, diagnostic information, ad-unit and reward information, and fraud-prevention signals. R.A.M uses optional rewarded placements chosen by the player and may show an interstitial after every two or three completed matches when the player returns to the hangar. Interstitials are not shown during a match, merely because the game was opened, or to accounts that own Remove Ads or Premium.

Performance diagnostics (Google Analytics for Firebase)

Performance diagnostics are offered only in the Android app; the iPhone app does not offer or collect them. They are off unless you turn them on. R.A.M asks players who selected age 18+ once, and you can change the choice at any time in Settings → Ads and privacy → Performance diagnostics. Players aged 13–17 are never asked, and nothing is collected for them.

When diagnostics are on, R.A.M sends Google Analytics for Firebase one event per battle saying which graphics renderer drew it (WebGL2 or the Canvas fallback) and, for the fallback, the technical reason, plus an event if a battle has to switch renderers mid-match. These events include your device's graphics-processor (GPU) name. We use them to measure how often battles fall back to the slower renderer and on which devices, so we can fix those devices.

While diagnostics are on, the Google Analytics SDK also automatically collects an app-instance identifier generated for this installation; app lifecycle events such as first open, sessions, engagement time and app updates; device model and brand, operating-system version, app version, and language; approximate location at country, region and city level, which Google derives from a masked IP address; and in-app purchase events for Google Play purchases, including product ID, name and price.

R.A.M does not send your Firebase UID, name, or email address to Google Analytics, and the diagnostics are not linked to your R.A.M account. Advertising ID and Android ID collection are turned off, advertising-related consent is always denied, and Google signals are not enabled. The diagnostics are not used for advertising or ad personalization. Turning diagnostics off stops collection and deletes the app-instance identifier from your device, so data collected later is not linked to earlier data.

Gems, rewarded claims, and store purchases

Gem balances are held in a server-owned wallet. R.A.M stores wallet balance, refund debt, UTC daily rewarded-ad usage, premium daily-Gem claims, battle receipts, opaque reward-claim identifiers, AdMob transaction identifiers, purchase-token and transaction-identifier hashes, the store a purchase came from, product IDs, grant and consumption status, refund state, and related timestamps. Gems can be spent on premium vehicles, which are recorded in your progression. These records prevent replay, apply verified rewards once, reconcile delayed rewards, and handle refunds without showing a negative balance.

For a paid Gem pack or the Remove Ads or Premium products bought in the Android app, Google Play processes the payment method and purchase. R.A.M receives the product ID, purchase token, purchase state, and an obfuscated account identifier derived from your Firebase UID; it does not receive full card or bank details. The backend verifies purchases through the Google Play Developer API, consumes verified consumable products, and uses Google Play's real-time developer notifications and voided-purchase reports to process refunds and cancellations. Google Play may retain transaction and payment records under its own terms and legal obligations.

For the same products bought in the iPhone app, Apple processes the payment method and purchase through the App Store. R.A.M receives Apple-signed transaction information: the product ID, transaction and original-transaction identifiers, purchase and revocation dates, the App Store environment, and an app account token derived from your Firebase UID; it does not receive card or bank details or your Apple Account password. The backend checks Apple's signature before granting anything, and receives App Store Server Notifications from Apple to process refunds and revocations. Apple handles App Store refund requests and may retain transaction and payment records under its own terms and legal obligations.

App Check, Google Play Integrity, and Apple App Attest

Production builds use Firebase App Check to help distinguish genuine, untampered installations from abusive requests. On Android it uses Google Play Integrity, which may process the app package name, app version, signing-certificate information, request details, integrity and attestation tokens, device-integrity signals, and Play licensing/account signals available to Google Play Integrity. On iPhone it uses Apple's App Attest, which may process a cryptographic key created on your device, Apple-signed attestation and assertion data, the app identifier and version, and request details. Monetization callable functions and battle-reward settlement enforce App Check. These checks are used for app and backend security, fraud prevention, and abuse protection.

Information stored on your device

R.A.M continues to store device-specific choices locally, including the advertising age band, your performance-diagnostics choice, per-account interstitial match cadence, ammunition selections and loadouts, selected vehicle skins, selected nation and game modes, and preferences such as graphics quality, frame-rate limit, sound and crew-voice volumes, interface mode, aim assist, and controls. R.A.M also keeps a small graphics-compatibility record of recent WebGL2 renderer failures on the device, which is kept to help diagnose rendering problems; it is not sent anywhere. Research, Credits, Gems, researched or purchased vehicles, and lineups use the Firebase cloud save instead of local storage. A pre-cloud local progression save may be read once for migration when the selected account has no cloud save, then removed after a successful upload.

Android backup remains enabled. Eligible local preferences may therefore be processed by Android or Google through system-managed backup or device-transfer features, depending on your device and Google settings. Those backups are controlled through Android and your Google account. On iPhone, the same local preferences may be included in iCloud or computer backups of your device, depending on your iOS and iCloud settings, which you control.

Visits to these legal pages

These pages are served by Firebase Hosting. Firebase Hosting may process limited request data such as your IP address, browser or user-agent information, requested URL, and request time to deliver and protect the site. These pages contain no advertising, analytics script, account form, or tracking cookie set by R.A.M Works.

2. Why we process information

We process the information above to:

create and maintain guest, Google-linked, or Apple-linked Firebase accounts;
provide a stable Firebase UID and authenticate protected backend calls;
load and save private game progression and calculate battle rewards for the authenticated account;
display age-appropriate interstitial and optional rewarded ads and record privacy and tracking choices;
verify Google Play and App Store purchases, maintain the Gem wallet and account entitlements, prevent replay and fraud, and process refunds;
detect cheating, automated play and reward farming, and enforce the Terms of Service;
with your consent, measure graphics performance and renderer compatibility across Android devices;
let players verify connectivity to the deployed backend;
operate, secure, troubleshoot, and prevent abuse of the app and services;
remember local ammunition choices, graphics compatibility, and device preferences; and
respond to privacy, support, and account-deletion requests.

Depending on your location, these activities are carried out to provide the service you request, based on our legitimate interests in operating and securing R.A.M, with consent where applicable (performance diagnostics are always based on your consent), and to comply with legal obligations.

3. Service providers and disclosures

R.A.M uses Google as a service provider, including AdMob, UMP, Google Play Billing and the Android Publisher API, Google Sign-In, Firebase Authentication, Cloud Firestore, Firebase Cloud Functions, Firebase App Check, Firebase Installations, Firebase Hosting, Google Analytics for Firebase, Google Cloud infrastructure, Google Play Integrity, and Android system backup where enabled by you or your device. Google processes information under its own terms and privacy documentation. See the Google Privacy Policy, Firebase Privacy and Security documentation, how Google uses information from apps that use its services, and Google advertising information.

In the iPhone app, R.A.M also relies on Apple for Sign in with Apple, App Store payments and refunds, StoreKit transaction signing and App Store Server Notifications, App Attest, the App Tracking Transparency prompt, SKAdNetwork attribution, and iCloud or device backup where enabled by you. Apple processes information under its own terms; see the Apple Privacy Policy.

Information may also be disclosed if reasonably necessary to comply with law, protect users or the service, investigate abuse, or establish and defend legal rights. R.A.M Works does not sell or rent personal information.

4. International processing

R.A.M Works is based in Israel and uses Google services that operate internationally. Information may be processed in Israel, the United States, Europe, and other locations where Google or its subprocessors operate, subject to applicable safeguards. Firebase Authentication and Google Analytics data are handled according to Google's documented data-location practices, which may differ from the Cloud Function's europe-west1 processing region.

5. Retention

Firebase account information is generally retained while the Firebase account exists. After deletion, Google states that relevant Firebase Authentication data is removed from live systems and later from backups according to its documented deletion cycle, which may take up to 180 days. Firebase Authentication IP logs may be retained for a limited period, and Firebase Hosting request IP data may be retained for a period of months under provider practices.

Cloud progression, the Gem wallet, account entitlements, battle receipts, reward claims, AdMob transaction deduplication records, compensation-grant records, integrity review records, and R.A.M purchase ledgers are generally retained while the Firebase account exists and are deleted by the in-app account-deletion flow. Cloud Functions and Google Cloud may temporarily process request metadata and operational logs. Google may separately retain advertising, Play transaction, fraud, tax, or legal records, and Apple may separately retain App Store transaction, fraud, tax, or legal records, under their policies and obligations. R.A.M Works has not configured custom Cloud Logging retention or log sinks and therefore does not claim an exact project-specific log-retention period in this policy. App Check and Play Integrity tokens and attestation data follow Google's service-specific retention practices.

Google Analytics is configured to keep event-level performance diagnostics for 2 months. Aggregated reports that no longer identify an installation, such as how many battles used each renderer, may be kept longer.

Local preferences remain on the device until they are overwritten, cleared by the user or operating system, or the app's data is removed. Copies in system-managed Android backups may remain until removed or expired under Google's backup practices, and copies in iCloud or computer backups of an iPhone remain until you delete those backups.

6. Account and data deletion

You can use Settings → Firebase account → Delete account, or the Delete account action in the Firebase account panel. After a strong confirmation, R.A.M deletes the current Cloud Firestore progression, wallet, entitlement, battle-receipt, reward-claim, ad-transaction, purchase-ledger, compensation-grant and integrity-review data, then deletes the Firebase Authentication account. If a recent login is required for a Google-linked user, R.A.M asks for Google reauthentication and verifies that the selected Google identity resolves to the same Firebase UID before deletion. For an Apple-linked account on iPhone, R.A.M always asks you to sign in with Apple again, verifies that it resolves to the same Firebase UID, revokes R.A.M's Sign in with Apple authorization, and then deletes the account.

After successful in-app deletion, R.A.M also resets locally stored ammunition selections/loadouts on that installation. Harmless device preferences such as graphics, audio, interface, and control settings may remain. No replacement anonymous account is created automatically. Deleting an R.A.M account does not delete your Google account or your Apple Account.

Performance diagnostics are not linked to your R.A.M account, so account deletion does not reach them, and we generally cannot find a particular player's diagnostics. Turning diagnostics off in Settings deletes the app-instance identifier from your device and stops collection; the remaining event-level data expires under the retention period above.

You may also request deletion without opening or reinstalling the app by following the Account Deletion instructions or emailing okninmatan@gmail.com. We will verify requests where reasonably possible. Provider security logs, legally required records, and backup copies may remain for limited periods and are not promised to disappear instantly.

7. Your choices and rights

You may play using a guest Firebase account instead of Google Sign-In or Sign in with Apple, choose whether to watch rewarded ads, turn performance diagnostics on or off (Android), change the stored age band, reopen available UMP privacy choices, sign out, delete your account, reset the Android advertising ID through device settings, allow or refuse tracking on iPhone through the App Tracking Transparency prompt and later in your iPhone's privacy settings, clear app data through Android settings or by deleting the app on iPhone, and manage backups in your Android, Google account, or iCloud settings. Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or a copy of personal information, withdraw consent, and complain to a data-protection authority. Withdrawing consent does not affect processing that took place before you withdrew it. Contact us to exercise a right. We may request reasonable verification before acting.

8. Security

We use platform and provider safeguards appropriate to the current service, including Firebase Authentication tokens, App Check-protected monetization functions, HTTPS transport, default-deny direct Firestore rules, server-side wallet, progression and battle-reward transactions, daily reward limits and integrity review records, AdMob ECDSA callback verification, Google Play Developer API purchase verification, App Store signed-transaction verification, replay-resistant transaction and purchase ledgers, Android and iOS application signing, Google Play Integrity, Apple App Attest, conservative Cloud Function scaling, and UID verification for account deletion. No system can guarantee absolute security.

9. Children's privacy and intended audience

R.A.M is intended for players in the 13–15, 16–17, and 18+ age groups selected in its Google Play target-audience settings, and is offered on the App Store for the same ages. It is not intended for children under 13. Players who select age 13–17 receive Google's teen treatment, non-personalized advertising, and a PG maximum ad-content rating, are never shown Apple's tracking prompt, and are never offered performance diagnostics. Google Sign-In and Sign in with Apple are optional because a guest-account option is available. R.A.M Works does not knowingly seek more personal information from a minor than is needed for the account, security, and age-appropriate advertising functions described in this policy.

If a player is below the age at which they can consent to data processing in their country, a parent or legal guardian should authorize use where required by law. A parent or guardian who believes a child's information was processed without the required authorization may contact us to request review and deletion.

10. Changes to this policy

We may update this policy when the app, service providers, or legal requirements change. The effective date at the top will be updated, and material changes will be communicated in the app, store listing, or this page as appropriate. Planned features are not treated as active until they are actually included in a release.

11. Contact

R.A.M Works
Israel
okninmatan@gmail.com