Privacy Policy

Version 0.1 (draft) · last updated October 28, 2026

Draft. This policy describes what the Game actually stores today and will be reviewed by a lawyer before public launch, in line with the LGPD (Law 13,709/2018). Items marked like this are still to be filled in.

1. Controller

COMPANY NAME, CNPJ 00.000.000/0000-00, is the controller of your personal data. Data protection contact (DPO): name and e-mail.

2. What we collect

Account: username, e-mail, the date you accepted the Terms and confirmed you are 18+, and your password stored only as a salted hash (we never see or store the password itself).
Sign-up protection: a salted hash of your IP address at sign-up, kept for up to 7 days to limit mass account creation. If the anti-bot check is on, Cloudflare Turnstile processes your browser signals.
Game data: your save (Pokémon, items, progress), chat messages, friends, trades and Market history.
Invite code: the referral code you arrived with, if any.
Payments: order number, amount and status of each Pix charge, and the CPF you enter at checkout, which we keep only to issue the nota fiscal (invoice) the law requires. Payments are made by Pix through Efí; your bank details and the payer's name stay with your bank and Efí, and we only receive the payment confirmation. Your CPF is not shown to other players and is not sent to Efí.
Gems: deposit references, transaction signatures and the withdrawal addresses you give. Blockchain transactions are public by nature.
Technical: session tokens and server logs kept by our host, Cloudflare.

3. Why we use it (legal basis)

To run your account and the Game: performance of the contract (LGPD art. 7, V).
To process payments and keep tax and accounting records: legal obligation (art. 7, II).
To prevent fraud, cheating and abuse: legitimate interest (art. 7, IX).

We do not sell your data and we do not use it for advertising.

4. Who we share it with

Cloudflare (hosting, database and anti-bot), which may process data outside Brazil under its own safeguards.
Efí (Pix payments).
Authorities, when the law requires it.

Your username, level, rankings, public team and profile are visible to other players.

5. Cookies and browser storage

The Game uses your browser's local storage to keep you logged in, remember settings and keep a local copy of your save. We do not use advertising or tracking cookies today. If that changes, we will ask first.

6. How long we keep it

Account and game data: while the account exists. Payment records: for the period tax law requires (generally 5 years). Sign-up IP hashes: up to 7 days. Chat messages: retention period to be set.

7. Your rights

Under the LGPD you can ask to confirm, access, correct, export or delete your data, and to withdraw consent where it applies. Write to DPO e-mail from the e-mail on your account; we answer within 15 days. Some records (payments) must be kept by law even after an account is deleted. You can also complain to the ANPD.

8. Security

Passwords are hashed with PBKDF2 and a unique salt, connections use HTTPS, and access to the admin tools is restricted. No system is perfectly safe: if a breach affects you, we will tell you and the ANPD as the law requires.