Privacy Policy

1. Controller and data protection officer

Controller: [legal entity name and tax ID to be defined].

Data protection officer (art. 41 LGPD): [name to be defined]. Channel to exercise your rights and reach the officer: [contact channel to be defined before launch].

2. What data we collect

• Account data: identifier, username and display name of your Twitch, Discord, Kick or Google account (for Google, also the verified email). We never receive your password.
• Game data: inventory, balance, XP, commands typed and when.
• Purchase data: orders for Crystals and cosmetics, amounts and status. Payment is processed by a third-party provider; we do not store card numbers.
• Visit origin: a cookie stores where you came from and the pages you opened, so we know which campaigns work.
• Contacts: email and details you type into the waitlist and contact forms.
• Report data: when you report, we store your identifier, the reported profile, the reason and the text you write. When you are reported or appeal, we store the decision, the reply and the appeal text.

3. Purposes and legal bases

• Running the game, saving progress and building rankings. Basis: performance of a contract (art. 7, V LGPD).
• Processing purchases of Crystals and cosmetics and honouring consumer rights. Basis: contract (art. 7, V) and legal obligation (art. 7, II).
• Receiving reports, applying moderation measures, reviewing appeals and preventing fraud and bots. Basis: legitimate interest (art. 7, IX) in keeping the environment safe and legal or regulatory obligation (art. 7, II), notably the reporting tools required by the Games Legal Framework.
• Publishing aggregated moderation statistics on the transparency page. Basis: legal or regulatory obligation (art. 7, II); the numbers identify no one.
• Showing streamers aggregated channel numbers and brands aggregated campaign numbers. Basis: legitimate interest (art. 7, IX), with no player personal data given to brands.
• Understanding product growth (origin and visits). Basis: legitimate interest (art. 7, IX); you can delete cookies at any time.
• Answering contacts and announcing waitlist openings. Basis: consent (art. 7, I), which you may withdraw.
• Keeping access logs where the law requires. Basis: legal obligation (art. 7, II).

We do not sell your data.

4. Reports: who sees what

• The reported player sees the decision and reason, never the identity of the reporter, except by legal order.
• The reporter sees only the outcome of the report.
• Only moderation staff access the text of reports and appeals.
• The transparency page shows totals only; numbers below 5 are shown as “fewer than 5” so no one can be recognised.

5. How long we keep data

• Reports, decisions and appeals: 12 months after being filed, or after the appeal window closes if that is later. After that, free text and identifiers are anonymised and only de-identified counts remain, for statistics.
• Account and game data: while the account exists.
• Account deletion: on request we anonymise the user record and personal identifiers. Orders are kept for the tax-record period required by law, and the legal basis, period and wording are to be confirmed by counsel.
• Coin ledger records (balance audit): kept without personal names for as long as needed for the integrity of the game economy.

Banned accounts keep the record of the measure for the period above, to prevent fraud and allow appeals.

6. Cookies

We use essential cookies (login session) and origin and visit cookies (anonymous identifier and first-visit origin). You can delete them in your browser at any time.

Visits and clicks on brand campaign pages are counted once per unique visitor using that same anonymous identifier; brands only receive aggregated numbers, never the identifier.

7. Sharing and international transfers

Display name and XP appear in public rankings and profiles. You can hide your profile under My account. Streamers see the names of players in their channel. Hosting, payment and login providers process data on our behalf under contract. We may share data with authorities where the law requires.

Some providers are outside Brazil; in those cases we apply the safeguards required for international transfers.

8. Your rights (art. 18 LGPD)

• Confirm that we process your data and access it.
• Correct incomplete or outdated data.
• Request anonymisation, blocking or deletion of unnecessary data or data processed unlawfully.
• Request portability, when regulated.
• Know with whom we share data.
• Withdraw consent and object to processing based on legitimate interest.
• Request review of decisions made solely by automated processing. PlayCmdr moderation is carried out by people.

Write to [contact channel to be defined before launch]. We reply within the legal deadline. You may also complain to the Brazilian data protection authority (ANPD) or your local authority.

9. Children and teenagers

Data of children and teenagers is processed in their best interest, with consent of at least one guardian where the law requires. Guardians can request access and deletion through the contact channel.

10. Changes

This policy may change. The version date is at the top of the page and relevant changes will be announced on the website.