Privacy Policy

1. Scope and contact

This policy covers the BiteFight Ruins Bridge browser extension, its license and subscription features, the related account-linking service and support requests about the extension. The service is operated under the team name Master Extensions Team. Contact: [email protected] or the contact form.

Ruins Helper is the companion simulator. Visiting it, the BiteFight lobby, a checkout page or another external service also involves that service’s own data practices. This policy does not describe all unrelated features of those websites.

2. Data used by the extension

The extension does not ask for your BiteFight password, read payment card numbers, use a browser-history permission or collect unrelated pages as a browsing-history dataset. Its tab permission can expose open tab URLs to the extension; code uses that access to locate the game, lobby and helper tabs.

• Game data from pages you open: game server, character identifier, race, layer, enemy lineup, available units and capacity. The extension uses these to identify the relevant game tab, search for formations and fill the selected formation.
• Results and battle history: formations, estimates, costs, losses, rewards, battle outcome, report identifiers and timestamps. Pro, its trial and Max can record supported manually started battles locally and reuse compatible verified formations across servers when search settings, enemies and combat data match. History is organized by game server. Browsing Ruins Ledger is a Max feature.
• BiteFight lobby email: read from the signed-in lobby when you visit it or the extension checks an already-open lobby tab. It is compared with the email linked to your license.
• License data: the account email, installation/session credential, trial dates, paid status, selected plan, subscription status and relevant payment dates returned by the license provider.
• Secondary account emails: up to two addresses you choose to link to an active Max license, their association with the primary license email and creation timestamps.
• Preferences: selected language, unit selection, search mode, search limits and other Bridge settings.
• Support data: your name, email, category, message and any information you choose to include. Please do not send game passwords, card numbers or session credentials.

3. Local storage and Chrome synchronization

Language, license/session state, game results and the battle ledger are stored in the browser profile. The saved lobby email is encrypted locally; its encryption key is kept in that profile. Encryption reduces casual exposure but cannot guarantee secrecy from someone who controls your device or browser profile.

Bridge search and configuration preferences use Chrome’s synchronized storage. If browser synchronization is enabled, Google may store and synchronize those preferences according to your Chrome settings and Google’s Privacy Policy. Game history and the saved lobby email are not deliberately uploaded through that settings-sync mechanism.

The simulator has its own browser storage. Removing Bridge does not automatically erase data held by the simulator, Google or the payment and hosting providers.

4. Online services and data flows

We do not sell personal information, use the extension for advertising profiles, or include advertising or analytics SDKs in Bridge. External websites and payment providers may use their own cookies, analytics and fraud-prevention tools; visiting a themed payment page does not disable their independent practices.

• Ruins Helper: relevant layer, enemy, army and search data passes between the game tab and the simulator tab. The simulator performs the search in your browser; Bridge does not upload the battle ledger to the Max account database. Opening the site still sends normal web-request information, such as your IP address and browser information, to its hosting service.
• ExtensionPay: provides trial activation, magic-link sign-in, plan information and license checks. Requests include a license/installation credential; signup and login use your email. We receive the account email and entitlement information needed to provide access. See ExtensionPay’s published privacy information.
• Stripe: processes checkout, recurring charges, payment authentication and subscription billing. Stripe may receive contact and billing details, card/payment details, tax information, IP/device information and transaction records. Card numbers and security codes are entered with Stripe, not read or stored by Bridge. We may access relevant customer, invoice and payment records in the merchant dashboard. See Stripe’s Privacy Policy.
• Cloudflare Workers and D1: host the Max account-linking API and database. The API receives your license credential and an email being checked, added or removed. It verifies the paid Max entitlement with ExtensionPay, then stores the primary/secondary email association and creation timestamp in D1. The current application database does not deliberately store that credential as an account-linking record. Infrastructure can process network and security metadata. See Cloudflare’s Privacy Policy.
• Max website tools: Dynamic Lab and Test Bench require the installed extension and a paid Max entitlement. Necessary Secure, HttpOnly, SameSite cookies hold short-lived authorization challenges and access sessions. Cloudflare D1 stores hashed challenge, ticket and session values with expiry times to prevent replay and enforce access. The license provider and, where needed, the linked-email service verify eligibility; the Max tool session tables do not store the payment credential or account emails as session records.
• Support delivery: the site contact form forwards the message and contact details to our support inbox through Resend. Direct email is handled by the email providers involved. See Resend’s Privacy Policy and Google’s Privacy Policy.

5. Purposes and legal bases

Where the GDPR applies, account activation, license checks, linked-account management, chosen features and support needed to deliver the service rely on performance of the contract or steps you request before entering it. Responding to general enquiries and protecting access against abuse may rely on legitimate interests in operating and securing the service, balanced against your rights. Necessary accounting, tax and legal records rely on applicable legal obligations.

Optional search behavior is controlled by your settings. Any processing that legally requires separate consent must use that consent; accepting the Terms is not blanket consent to unrelated marketing or unnecessary tracking. We do not use these data to make decisions about employment, credit or similarly significant matters. A license mismatch may automatically block access; contact us if you believe that result is wrong.

6. Disclosure and international processing

Data is shared only as needed with the providers named above, authorized support personnel and, where legally necessary, advisers, authorities or parties handling a dispute or a business transfer. Any transfer of the service must continue to respect applicable privacy requirements. Human access is limited to support, security, legal obligations and other purposes permitted by law and the Chrome Web Store’s user-data rules.

These providers may process data outside your country, including outside the EEA or UK. Where applicable, transfers require a recognized legal mechanism, such as an adequacy decision or standard contractual clauses, and any necessary additional safeguards. Contact us for information about the safeguards applicable to your data. Hosting on Cloudflare does not mean that every record remains in one specified country.

7. Retention

• Local preferences, license cache and ledger remain in the profile until replaced, removed through browser controls or cleared with extension data. The results cache retains up to 30 contexts; the ledger currently has no automatic age-based expiry. Logging out preserves settings and history.
• D1 account links remain until removed through Max management or deleted following a verified support request. Subscription expiry alone does not currently trigger automatic deletion. Retention is reviewed according to whether restoring access or resolving an account issue still requires the association.
• License/trial and billing records are held by the relevant providers and by us where needed to restore access, prevent repeated trial abuse, administer subscriptions, comply with legal record-keeping duties or resolve disputes. Applicable legal periods and the provider’s retention rules determine the duration; deleting the extension does not erase invoices or cancel the subscription.
• Support correspondence is retained while an enquiry is being handled and for as long as reasonably necessary to follow up, demonstrate its resolution or meet a legal obligation. Technical logs and backup copies follow the relevant infrastructure service’s retention and recovery rules.

8. Your controls and rights

You can change preferences, sign out locally, remove a secondary address when management access is available, disable or uninstall the extension, and manage browser/site storage and synchronization. To delete server-side links when you no longer have Max access, change the primary email, obtain a copy of account records or make a privacy request, contact [email protected]. Removing data needed to verify a license can prevent access. Cancellation of billing is a separate action.

Where applicable, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent where consent is the basis, without affecting prior lawful processing. Some records must be retained by law. We may ask for proportionate proof that you control the relevant account; never send a password or full card details.

GDPR requests are normally answered within one month. If the law allows more time because of complexity or volume, we will explain the extension within that initial period. You may complain to the competent data-protection authority, particularly where you live, work or believe a violation occurred, and seek judicial remedies. These rights do not depend on first contacting us.

9. Security and permissions

License and account-service requests use HTTPS; access checks and database queries are scoped to the authenticated license. Local encryption and browser isolation are safeguards, not a promise that compromise is impossible. Protect your email account, browser profile and magic links; do not share license URLs or credentials.

Bridge uses tabs/active-tab access to find the relevant pages, scripting to reconnect extraction in supported tabs, storage for the data described above and host access for the game, lobby and license services. It reads loaded game content and fills form controls; it does not itself submit the game’s START action or recruit units. A game action you initiate can generate the game’s own network requests.

10. Age and changes

Bridge is not directed to children under 16. Paid purchases require the legal capacity to subscribe or authorization from a parent or guardian, subject to applicable law and the game’s age requirements. If you believe a child has supplied data without the required authorization, contact us.

We will publish a dated revision when practices change and give an appropriate in-product or account notice for material changes where required. New purposes requiring consent will not be authorized merely by editing this policy. This notice is provided in English; mandatory local law prevails over any inconsistent wording.