Privacy policy

Version 1.0 — 20/10/2026

This policy explains which personal data the game Asaria processes, why, with whom it is shared, how long it is kept and how you exercise your rights. It applies to the game on PC and mobile, to the launcher, to this website, to the forum and to support.

It was written from what the game actually does: every piece of data listed here is collected, and no data that is not listed here is collected.

1. Who is responsible

The controller is David Kevin Nogueira da Silva, Neuraframe (empresa individual, Suíça).

• Address: Rue des Fleurettes 15, CH-1400 Yverdon-les-Bains
• Contact for any privacy matter, including the data protection officer channel (LGPD): privacidade@playasaria.com

2. What data we process

2.1 Account

• Your email address.
• Your password, stored only as a cryptographic fingerprint (bcrypt): nobody on the team can read it.
• The account number, the account role (player or team) and the dates of creation and of the last sign-in.
• The version of the Terms of use and of this policy that you accepted, with the date and the IP address of the acceptance.

2.2 Sign-in security

To stop someone who stole your password from entering your account, the game recognizes the devices you have already signed in from:

• a fingerprint (SHA-256) of the device identifier sent by the launcher or the app — on PC, a random identifier created at installation; on mobile, the identifier the system gives the app — or, without one, of your network prefix;
• a short device label (for example «launcher-windows»), the approval date and the last IP address seen;
• the verification codes sent by email, stored only as fingerprints, with the IP address of the request;
• the «Remember me» sessions, with the IP address they were created from;
• sign-in attempt counters, which contain the email address or the network.

2.3 Game

• Your characters: name, class, appearance, level, experience, inventory, skills, progress, titles, position in the world and play time.
• The server's records of the game economy and events (for example crystals earned or spent, trades and transfers between accounts, rewards received).
• The IP addresses observed on connections to the shop and to support, to prevent fraud.

2.4 Communication and moderation

• In-game chat and private messages: they go through the server to reach other players and are not recorded, with one exception: when a player reports a message, that message and the recent context of the conversation are kept for moderation.
• Reports and blocks: the reports made by you or against you, and the list of players you blocked.
• Forum: your nickname, your topics, messages and votes, and the automatic translations of the messages, made by a translation model installed on our own server.
• Support: the requests you open and the messages exchanged with the team.

2.5 Purchases

Real-money purchases are made on the website and in the PC launcher, never in the mobile app. When you buy:

• the pack, the amount, the tax, the country used to compute the tax, the character who receives it and your acceptance of the purchase rules (date, version and IP address);
• from the payment processor (Stripe): a fingerprint of the payment method, the card brand, the last 4 digits and the country of the card — never the full card number, which only Stripe receives;
• in case of a chargeback or dispute: the record of the dispute and the corresponding debt.

2.6 Country and audience measurement

• Your country, deduced from the IP address by a geolocation service. It is used to compute the tax on a purchase and for campaigns reserved to certain countries. The result is kept for up to 30 days in a temporary file on the server, named from the IP address.
• The origin of the sign-up: the name of the ad, content creator or invitation through which you arrived, the platform and the country — never the IP address.
• The days you played and usage events (for example sign-up, launcher download, level up), to measure the game without tracking cookies and without an advertising identifier.

2.7 Diagnostics

• The bug reports you send from the game: your text, the boxes ticked, the game version, the platform, the system, the device model, the graphics card, the memory, the resolution, the graphics quality, the FPS, the language, recent errors and your zone and position in the game.
• The game engine diagnostics (Unity): technical crash and performance data of the device, sent to Unity Technologies.
• The game server keeps technical file copies of the characters, the ranking and the titles (with character names) and records, to be able to restore a lost character.
• The technical logs of the web server and the APIs: IP address, page requested, date and errors, to keep the service running and investigate abuse.

2.8 What we do not collect

Legal name, date of birth, postal address, phone number, documents, precise location (GPS), contacts, photos, advertising identifier, programs installed on your device, and no tracking across apps or websites.

3. Why we use the data, and on what legal basis

• Providing the game (account, characters, servers, forum, support, delivery of purchases): performance of the contract — LGPD art. 7, V; GDPR art. 6(1)(b).
• Protecting your account and the game (device recognition, email codes, attempt limits, prevention of fraud, cheating and abusive chargebacks): legitimate interest and credit protection — LGPD art. 7, IX and X; GDPR art. 6(1)(f).
• Complying with legal obligations (accounting, taxes, requests from authorities): LGPD art. 7, II; GDPR art. 6(1)(c).
• Moderating the community (reports, blocks, reported messages, sanctions): legitimate interest and protection of players, especially minors — LGPD art. 7, IX; GDPR art. 6(1)(f).
• Measuring and improving the game (bug reports, diagnostics, cookie-free measurement, campaigns): legitimate interest — LGPD art. 7, IX; GDPR art. 6(1)(f).
• Defending rights in disputes, including in court: LGPD art. 7, VI; GDPR art. 6(1)(f).

In Switzerland, we process data in accordance with the Federal Act on Data Protection (FADP).

We do not sell personal data, we do not use it for advertising and we do not make automated decisions that produce legal effects on you. Sanctions for cheating or fraud can always be reviewed by the team (see the Terms of use).

4. Who we share data with

Only with the providers the game needs to work, each for its own part:

• Hostinger: hosting of the website, the APIs and the databases; sending emails to Microsoft addresses (Hotmail, Outlook).
• Hetzner: game servers, the server that sends the game's emails (codes, notices) and the forum translation server.
• Stripe: payments. From our side, Stripe only receives the pack, the amount, the account number and the order number; card details are typed directly into Stripe.
• Unity Technologies: game engine diagnostics.
• Google: if you install the game from Google Play, Google processes the installation data under its own policy.
• IP geolocation: ipwho.is, country.is, ip-api.com, ipapi.co. They receive the IP address and return a country.
• Authorities, only when the law requires it.

Countries of the servers: FR (Hostinger), FI (Hetzner).

5. International transfers

The controller is in Switzerland, and data may be processed in the countries of the servers and providers above (including the European Union and the United States). These transfers rely on adequacy decisions or on the standard contractual clauses offered by the providers, in accordance with the FADP, the LGPD (art. 33) and the GDPR (art. 44 onwards).

6. How long we keep data

• Account and game data: as long as the account exists. After a deletion request, the account is closed immediately and erased 14 days later — the clean-up runs once a day (see item 8).
• Verification codes: valid for 15 minutes, erased the next day.
• Sign-in attempt counters: 24 hours.
• «Remember me» sessions: 30 days after their last use, plus 7 days.
• Recognized devices: up to 12 months without use.
• Country deduced from the IP (cache): 30 days.
• Reported messages and reports: 180 days.
• List of blocked players: as long as the account exists.
• Purchases (amounts, taxes, country, acceptance of the rules with the IP address of that moment): 10 years, the legal accounting retention period.
• Fraud prevention data of an account with a debt (chargeback), an active sanction or a payment made less than 121 days ago (the period during which it can still be disputed with the bank), including a keyed fingerprint (HMAC) of the account's email, which can only recognise the same address (never the email itself): as long as the debt or the sanction lasts, or until those 121 days are over.
• API error logs (may contain an IP address): up to 60 days.
• Web server access logs, kept by the hosting provider: the period set by Hostinger (its panel shows the last 7 days).
• Game records, IP addresses, measurement, support and bug reports: as long as the account exists; they are erased with it.
• Technical file copies on the game server (last state of each character, technical and moderation records, bug reports, without email): erased at most 30 days after they were last written; the log the server is currently using keeps being written until the server's next restart, during maintenance. The game server's ranking and titles keep a character for up to 30 days after it last played.
• Database backups: daily ones and those made before maintenance, 30 days; the hosting provider's automatic backups, up to 6 weeks. A deleted account disappears from them within those periods.

7. Your rights

You can ask at any time for: confirmation that we process your data, access to it, correction, portability, erasure, information about who it is shared with, and you can object to processing based on legitimate interest (LGPD art. 18; GDPR art. 15 to 22; FADP art. 25 onwards).

How to ask:

• by email, to privacidade@playasaria.com;
• in the launcher, through Support, category «Privacy»;
• to delete the account: on the Delete account page, without needing the game.

We answer within 15 days. We may ask for proof that the account is yours before acting. You can also complain to a data protection authority: the ANPD in Brazil, the authority of your country in the European Union, or the FDPIC in Switzerland.

8. Account deletion

On the Delete account page, you sign in with your email and password, receive a code by email and confirm. The account is closed immediately: you can no longer sign in to the game, the launcher, the forum or the shop. For 14 days you can still cancel from the same page. After that:

• the following are erased: the characters (what remains are game numbers with no name and no link to you: class, gender, level, experience, PK level, play time, total crystals bought and technical dates), devices and sessions, IP addresses, game records, bug reports, measurement, your forum nickname and votes, the list of players you blocked (and you leave the lists of those who blocked you), support, and the account with the same email on the test server (PBE), closed together with yours;
• your forum messages and topics stay, but signed «Conta excluída» (deleted account) — or they are erased, if you choose that option;
• the email address and password are replaced on the scheduled date: nothing links the account number to you any more — unless there is a debt, an active sanction or a payment less than 121 days old that can still be disputed: we then keep only a keyed fingerprint (HMAC) of the email, which can only recognise the same address (never the email itself); it prevents creating another account with that address and is erased as soon as the debt is paid, the sanction ends or the dispute period is over;
• only the purchase records (accounting obligation), the reports and reported messages (180 days) and, if there is a debt, an active sanction or a payment that can still be disputed, the fraud prevention data are kept, for the periods in item 6; backups and the technical copies on the game server (ranking and titles included) disappear within the periods in item 6.

9. Minimum age

The game is intended for people aged 13 and over. Between 13 and 18, the authorization and supervision of a parent or guardian is required. If we learn that an account belongs to someone under 13, it will be closed and its data erased.

10. Security

Passwords are stored with bcrypt, codes and sessions only as fingerprints, and the website and the APIs only work over HTTPS. A new device needs a code sent by email.

The game's connection to the game server is not encrypted: it never carries your password, but it carries the game actions, the chat and a temporary session identifier, valid for up to 24 hours.

11. Cookies and browser storage

The website uses no tracking or advertising cookies. It only uses:

• the idioma cookie (1 year), which remembers the chosen language;
• the asa_app cookie (1 hour), when the page is opened by the app;
• the browser's session storage, which keeps your sign-in to the website and the origin of an invitation or ad while the tab is open;
• local storage, which remembers whether you turned the music on or off.

12. Changes

When this policy changes in an important way, the new version will be published on this page with a new date, and the game will ask you to read and accept it at your next sign-in.