What stays local.
What your account stores.

Scope

This policy covers the TotalIQ companion app, the pointgard.net account portal, and the optional AutoBattle and Merc-X premium services operated by IDI Studios.

Data stored on your AutoBattle account

IDI Studios stores your email address, player name, beta-access status, token balances and token activity, redeemed offers, and the names and last-seen times of devices you link. When cloud recovery is active, we also store up to five recent account-owned backup archives containing your saved workflows, tap coordinates, image-target settings and cropped reference pictures, battle setup and plan, calculator profile, recognition hints, and automation-learning history. Production and Test use the same account backup so you can move between them.

Your connected game account

When you choose to connect a supported game account, AutoBattle opens an isolated sign-in view so you can authenticate directly with the account provider. After the connection is verified, the sign-in view is closed and its cookies and temporary browser state are cleared from the app. The resulting account session is encrypted before it is stored by the private AutoBattle service and is used only for read-only background refreshes of the account information shown to your approved AutoBattle account. It is not shared with other AutoBattle users.

Depending on what your connected game account exposes, the synchronized snapshot may include your player and city identifiers, realm and clan membership, profile image, heroes, captains and artifacts, equipment, enchantments and gems, talents, research, Hall of Fame progress, troop and mercenary counts, clan buildings and research, clan chests and announcements, and live realm-event information. Shared realm or clan data may also be refreshed by the central collector, but another account's private player snapshot is never substituted for yours. You can disconnect the game-account link from the app; doing so removes the stored session and stops those account refreshes.

Recognition data that stays on your Android device

Live screenshots used to find targets are processed on the device and discarded. AutoBattle does not upload temporary screen captures, OCR text, live field contents, or diagnostic logs as part of cloud recovery. Only pictures you explicitly save as reference targets or Learn Troop crops are included in your private profile backup.

Private runtime assets

Proprietary reference catalogs, artwork, and other protected runtime resources are not bundled in the public APK. After account and device approval, the app downloads an authenticated, encrypted, device-bound asset pack from private storage. The cached pack remains encrypted at rest and cannot be used as an authorization credential.

Help Make AutoBattle Smarter

Adaptive intelligence is enabled by default after the app shows you a notice, and you may turn it off at any time in AutoBattle settings. When enabled, the app may send a normalized target category, verified success or failure, rounded timing, a random event identifier, app version, and—for crypt recognition only—a canonical-source alias and scale bucket. This data helps improve recognition for all users.

Adaptive-intelligence event payloads do not include screenshots, OCR text, tap coordinates, player or game-account identifiers, troop quantities, workflow names, account contents, game credentials, device credentials, or diagnostic logs. The service associates each event with an opaque authenticated device session for abuse prevention, rate limiting, and contributor thresholds. Raw observations are deleted after 35 days and are not published into the shared recognition model until the minimum contributor and observation thresholds are met.

What the app sends

The Android app sends an opaque device credential, a device label, and the minimum cycle events needed to reserve, complete, or release a token. A device credential can be revoked from your account. It is encrypted by Android Keystore on the device, while the server stores only a cryptographic hash. Profile backups are sent over HTTPS, stored in private object storage, checked for integrity before restore, and downloaded only after a linked device session is authenticated. The encrypted game-account connection and synchronized snapshot described above are sent only to the private AutoBattle service.

Security and service providers

Website sign-in uses one-time email codes. Browser sessions use secure, HTTP-only cookies. Account records are stored with Supabase, email delivery is handled by the configured mail provider, and abuse checks use Cloudflare Turnstile. These providers process only the data needed to provide their part of the service.

Control and deletion

You can revoke linked devices from the account page. Unlinking or uninstalling the app does not delete the account backup, so it remains available for recovery. The five newest completed backups are retained; newer backups replace older history. You can disable adaptive-intelligence telemetry in AutoBattle settings and disconnect the game-account link in the app without deleting your AutoBattle account. To request access, correction, or deletion of your account data, email development@idistudios.io from the address on the account.