Privacy policy

1Who we are

Shield & Shred is made by MC Media, an independent game developer based in Israel. MC Media decides how your data is used, so under data protection law we are the “controller”. In this policy, “we” and “us” mean MC Media.

This policy covers:

• the game Shield & Shred, version 2.0 and later, on Android (Google Play: com.mc.shieldandshred) and on iPhone (App Store: com.mc.shieldandshred), and
• this website, sns.media-mc.com.

You can reach us at support@media-mc.com. The rules for playing are in our Terms of use and player rules.

2What we collect

You never type in an email address, a phone number or your real name to play. Here is everything the game handles, grouped by where it comes from.

The player id, install id, app version, your name and your game data are needed to play: without them the game cannot run. Linking Google, watching ads, buying, reporting names, blocking players and emailing us are all optional. Linking Google and buying are in the Android game only.

In your account and your game

Through Google and Apple services in the game

Logs, support and backups

What we never collect

Apart from what Google shares if you choose to link a Google account (above), we don't ask for or collect your real name, phone number, contacts, photos, precise location, camera or microphone. The only permission the game asks you for is notifications (on Android 13 and up, and on iPhone), and you can say no. On iPhone it never asks to track you, so it never gets your advertising identifier (IDFA). On Android, since version 2.0.3, the game does without the advertising ID permission, so neither it nor Google's ad SDK can read your advertising ID, and it does without Android's Privacy Sandbox ad ID and Topics (the interests Android guesses from the apps you use). Its usage analytics (above) never include your name, your player id or an advertising ID, and we send no marketing email. Our server only counts, in total, how many players are active and come back.

Reminders such as “Your Bank is full” and “New daily missions” are made and scheduled on your phone, on Android and on iPhone. We don't send push notifications.

3What other players see

• On RANK (the players in your league): your name, your picture (a titan), your stars and your league.
• On the DAMAGE board, when it is switched on: your name, your picture, your best Boss Rush damage and the boss you hit.
• On an event's board (TRUCK LOAD's road, while the event runs): your name, your picture and your wheels.
• In your clan: your name, your picture and the points you add to the clan's week. Anyone looking for a clan sees its name, its emblem and how many play in it.

Other players never see your player id, install id, Google account or email, and never learn who reported or blocked them. No two players share a name, and you can change yours in Profile (unless we have locked it for breaking the Terms).

4Ads

The game is free to play and shows only optional rewarded videos: no banners and no pop-up ads. You choose to watch one to get a reward:

• DOUBLE LOOT doubles the coins and crystals from a Classic fight.
• LEVEL UP covers part of the coins you are short when you level up a titan.
• Building timer takes 30 minutes off a building upgrade.

You can watch at most 40 ads a day. Ads are served by Google AdMob and limited to content rated for teens.

What Google's ad SDK collects

Google's ad SDK in the game may collect identifiers limited to one app or one developer (Android's app set ID, or Apple's identifier for vendors on iPhone) and, on Android before version 2.0.3, your advertising ID (below), your IP address (which can be used to estimate your general location), your interactions (such as app launches, taps and video views), and diagnostics about how the app and the SDK run. Google uses them for advertising (showing and measuring ads, limiting how often you see them and, on Android before version 2.0.3, personalising them), analytics and fraud prevention, and describes this in its own words:

• Google Mobile Ads SDK for Android: data disclosure
• How Google uses information from sites or apps that use its services

On Android

• No advertising ID, since version 2.0.3. The game does without Android's advertising ID permission, so Google Play services gives it only a blank ID (all zeros): neither the game nor Google's ad SDK can read your advertising ID. The SDK uses only identifiers limited to one app or one developer, such as Android's app set ID.
• No personalised ads, since version 2.0.3. Every ad the game asks for is non-personalised: Google chooses it from the game and your approximate location, not from what you do in other apps or websites. The game also does without Android's Privacy Sandbox ad ID and Topics, so no ad uses interests guessed from your apps.
• Ad attribution without identifying you. Ads can use Android's Privacy Sandbox Attribution Reporting, which lets an advertiser count an install or other result that came from an ad without learning who you are.
• Before version 2.0.3. Version 2.0.0 (on Google Play since 3 October 2026) and the old game before 2.0 used your advertising ID, and could show personalised ads where you agreed or the law allowed it. A phone keeps running such a version until the game is updated from Google Play.

On iPhone

• No tracking prompt, no advertising identifier. The game never shows Apple's App Tracking Transparency prompt, so neither it nor Google's ad SDK ever gets your advertising identifier (IDFA). The SDK uses only identifiers limited to one app or one developer, such as Apple's identifier for vendors.
• No personalised ads. Every ad the game asks for is non-personalised: Google chooses it from the game and your approximate location, not from what you do in other apps or websites.
• Ad attribution without identifying you. Ads can use Apple's SKAdNetwork, which lets an advertiser count an install that came from an ad without learning who you are.
• Google describes what its iOS SDK collects in Google Mobile Ads SDK for iOS: data disclosure.

Your choices

• In the EEA, the UK and Switzerland, Google's consent form asks for your choice before any ad is shown. Even non-personalised ads store or read information on your phone (for example, to limit how often you see an ad and to stop fraud), and the law there asks for your consent to that. On iPhone, and on Android since version 2.0.3, the game asks only for non-personalised ads; older Android versions showed personalised ads only if you agreed. To change your choice later, open Settings → Privacy options (the row appears where the law asks for it, and also on the PAUSED screen in a fight).
• Usage analytics. In the EEA and the UK, Google Analytics follows your answer to the same consent form: it is off until you agree, and off again if you say no (Settings → Privacy options, or the PAUSED sheet in a fight). Elsewhere it is on.
• In the US, where your state's law gives you the right to opt out of the “sale” or “sharing” of personal information for ads, Settings → Privacy options lets you do so (where shown). If you don't see the row, email us. On iPhone, and on Android since version 2.0.3, nothing is shared for personalised ads (section 14).
• Your advertising ID. On iPhone, and on Android since version 2.0.3, the game never gets it, so there is nothing to reset. On an older Android version, update the game, or reset or delete your advertising ID in your phone's settings (usually under Privacy → Ads, or Google → Ads).

How rewards are checked

When you finish an ad, Google tells our server, so we can give the reward exactly once. This is called server-side verification, and for it the game passes Google your anonymous player id. We keep each reward record for 400 days. If you delete your account, your player id is removed from them.

5Crash reports

When something breaks, the store version of the game sends a crash report automatically through Google's Firebase Crashlytics. A report holds:

• what went wrong (the error and where in the game it happened),
• your phone model, its Android or iOS version and memory state,
• a Firebase installation id, and your anonymous player id.

It never holds your name, your email or your advertising ID. We use crash reports only to find and fix bugs, which is our legitimate interest in a game that works. They are kept for 90 days. There is no switch for them in the game, but you can object at any time (section 14).

6Purchases

You can buy coins, crystals and card packs in the game. Google Play takes the payment on Android and the App Store on iPhone, so we never see your card or bank details.

For each purchase we receive and keep:

• the product and the order id,
• what it gave you (coins, crystals or packs) and its crystal value,
• when it was made, whether it was a test purchase, and its state (for example, credited or refunded),
• your player id, so we know which account to credit.

On Android, Google Play also gives us a purchase token so we can check the purchase. Our server keeps the token itself only while it still needs it to confirm and complete the purchase with Google Play, usually 15 to 75 minutes. Then it deletes the token and keeps only a hash of it (a fingerprint that cannot be turned back into the token). The token stays on our server and never appears in our logs. With each purchase the game gives Google Play a hash of your player id, so Google can tie the purchase to your account without learning the id itself.

On iPhone, the App Store gives the game a record of the purchase signed by Apple. Our server checks Apple's signature itself and keeps only what the list above names; the signed record never appears in our logs. With each purchase the game gives Apple an account tag made from a hash of your player id, so Apple can tie the purchase to your account without learning the id itself. When Apple refunds a purchase, it tells our server.

If a purchase is refunded or charged back, its value is taken back: the coins or crystals, or a pack's crystal value (you keep the cards). The rule is in the Terms, section 8.

We keep purchase records while your account exists. If you delete your account, we keep them without your player id for as long as tax and accounting law requires (up to 7 years). Google Play or Apple keeps its own record of your order under its own policies.

7Name reports

If another player's name breaks the rules, you can tap or long-press their row on RANK (or DAMAGE, when it is switched on) and choose REPORT NAME. BLOCK PLAYER on the same sheet hides that player's name and picture for you, and sends us a report marked as a block. Your blocks are kept on your phone, and Settings → Blocked players → UNBLOCK ALL undoes them. For each report or block we store:

• the name, where you saw it (RANK or DAMAGE), the league, the time and whether it was a report or a block, and
• a hash of your player id, so one player cannot flood us with reports.

A name reported by several different players is hidden on the leaderboards until we have reviewed it (reports from new accounts don't count towards this), so one player's report alone never hides a name. To count them, we keep with the name a hash of the player id and of the install id of each player whose report counted, so the same player or phone never counts twice. We review reports within 24 hours.

We never store the reported player's id, and they are never told who reported or blocked them. Reports are deleted automatically after 90 days, and a name's count 90 days after its last counted report or our last review of it. How we act on them is in the Terms.

8Security and fair play

• Everything the game sends to us travels encrypted (HTTPS).
• The game cannot write to our database. Every change goes through our server, which checks it first. You can read only your own account.
• Firebase App Check checks that requests come from the real game on a real device: with Google Play Integrity on Android, and with Apple's App Attest on iPhone.
• Our server checks every fight result and caps results that are not possible. Rate limits stop floods of requests.
• Our logs never contain your name, your email or purchase tokens.

No system is perfectly safe. If a breach ever puts your data at risk, we will report it as the law requires and tell players in the game.

9Why we may use your data

Data protection law in the EEA, the UK and Switzerland asks us to name a legal basis for each use:

Some things happen automatically: our server caps impossible fight results, and it blocks buying after the refunds described in the Terms. None of these has a legal or similarly significant effect on you. Email us to have one reviewed by a person.

10Who gets your data, and where

We share data only with:

• Google, which runs the services the game is built on: Firebase and Google Cloud (servers, database, sign-in, crash reports, usage analytics and App Check), Google AdMob (ads) and Google Play (downloads and payments). Firebase and Google Cloud work on our instructions. AdMob and Google Play also use data under Google's privacy policy.
• Apple, on iPhone: the App Store (downloads and payments) and App Attest, which checks the game is genuine. Apple uses data under Apple's privacy policy.
• Other players, who see only your public profile (section 3).
• Our email provider, which holds the emails you send to support@media-mc.com.
• Authorities, when the law requires it, or when needed to protect players and the game from fraud or abuse.

No other company receives your data from us.

Where it is processed. Our game servers and database run on Google Cloud in Belgium (europe-west1). Some Google services, such as Firebase Authentication, Crashlytics, Google Analytics, AdMob and Google Play, may process data in other countries, including the United States, under Google's data processing terms and the European Commission's Standard Contractual Clauses. On iPhone, Apple's services may also process data in other countries, under Apple's privacy policy. We work from Israel, which the European Commission recognises as protecting personal data adequately.

11Deleting your account, and what stays

We keep your account until you delete it, even if you stop playing. You can delete it at any time:

• In the game: Settings → Delete account. It needs the internet and takes up to a minute.
• Without the game: email us from the Google account linked in the game (Android). The steps, and what we can do for an account that was never linked, such as every iPhone account, are on Delete your account.

Uninstalling the game does not delete your account. Deleting removes your sign-in (and any Google link), your name, picture, progress, the items you bought, your places on the leaderboards, your fight history, your Terms record and your refund status. On your phone, the game clears your account's saved data and reminders.

What stays after a delete

If you linked Google, your Google account may still list Shield & Shred as a connected app. You can remove it at myaccount.google.com/connections.

12The old game, before 2.0

Shield & Shred has been rebuilt from scratch for 2.0. Every account starts again at Bronze — everyone's. Nothing from the old game carries over.

When an Android phone updates to 2.0, the first launch wipes the old game's data from the phone and, where the law asks for it, asks for your ad consent again. The old game was never released on the App Store.

13Children

Shield & Shred is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 is playing, email support@media-mc.com. When we learn that an account belongs to a child under 13, we delete its data.

14Your rights

You can see most of your data in the game, change your name in Profile and delete your account in Settings. For anything else, email support@media-mc.com.

In the EEA, the UK and Switzerland

You have the right to:

• get a copy of your data, and have it corrected;
• have it deleted, or its use restricted;
• object to uses based on our legitimate interests, such as crash reports;
• receive the data you gave us in a format a machine can read;
• withdraw your ad consent at any time, in Settings → Privacy options (this does not undo what happened before);
• complain to your local data protection authority. EU authorities are listed here; in the UK it is the ICO; in Switzerland it is the FDPIC.

We answer within one month. If a request is complex, the law lets us take up to two more months, and we will tell you if we need them.

In US states with privacy laws

Depending on your state, you may have the right to know what we collect, get a copy, correct it, delete it, and not be treated differently for using these rights. Where your state's law gives you the right to opt out of the “sale” or “sharing” of personal information for ads, Settings → Privacy options lets you do so (where shown). If you don't see the row, email us to opt out (on Android before version 2.0.3, you can also delete or reset your advertising ID in your phone's settings). For anything else, email us. If we turn a request down, you can appeal by replying to our answer.

We don't sell personal information for money. On iPhone, and on Android since version 2.0.3, the game asks only for non-personalised ads, so nothing is “shared” for personalised (cross-context behavioural) ads. On Android before version 2.0.3 (including version 2.0.0, which a phone runs until the game is updated), Google's ad SDK may “share” your identifiers, ad interactions and approximate location with Google for personalised ads. That is the only selling or sharing of personal information, now and in the past 12 months. We don't use or disclose sensitive personal information. An authorised agent can make a request for you with your signed permission, and we may ask you to confirm it.

The kinds of data the game handles are: identifiers (player id, install id, the app set ID on Android or the identifier for vendors on iPhone, and on Android before version 2.0.3 the advertising ID), commercial information (purchase records, on Android), app activity (gameplay and ad interactions), approximate location (from your IP address, through Google's ad SDK) and, only if you link Google, your email address. It comes from you, your phone and Google.

Showing an account is yours

The game doesn't know who you are, so we may need to check that a request comes from the account's owner. The surest way is to write from the Google account linked in the game (Android). A player id alone is not proof: anyone who sees it can copy it. On iPhone, where the game cannot link Google yet, use the game itself where you can: deleting in Settings → Delete account needs no other proof.

15This website

This website, sns.media-mc.com, is hosted on Firebase Hosting (Google). Like any web server, its logs record your IP address and browser for security, and Google keeps those logs under its own policies. It sets no cookies and runs no analytics or trackers, and its fonts are served from this site.

The Report a bug page only opens your own email app with a message filled in. The website itself stores nothing you type. What you then send us is a support email (section 2).

Links to Google Play, the App Store and other Google or Apple pages are covered by those companies' own privacy policies.

16Changes to this policy

When this policy changes, we post the new version here with a new date. Important changes are also announced in the game. We don't email you about changes: the game doesn't ask for your email, and the email of a linked Google account is used only for the link and to check deletion requests.

17Contact us

For questions about your account, include the player id from Settings → Support. To delete your account, follow Delete your account, because a player id alone cannot prove the account is yours.