Privacy Policy

1. About this policy

This Privacy Policy explains how personal data is processed on the website raf.dev.br, including its API, chat and games (the "Site"). The Site is a personal, non-commercial project run by an individual.

Controller: Rafael Pontes, an individual resident in Brazil. Contact channel: contact form.

Processing follows the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the Brazilian Internet Civil Framework (Marco Civil da Internet — Law No. 12,965/2014) and, where applicable (for example, to users in the European Economic Area), the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).

Use of the Site is also subject to the Terms of Use.

2. Data we collect

We collect only what is needed for each purpose, in the categories below.

a) Account

• username, e-mail and, optionally, name;
• password, which is never stored in readable form;
• when you create an account with a username and password, the confirmation of your e-mail through a code or link sent to it (the account is only created after that). The account e-mail is used only for messages about the account — sign-up confirmation, password resets and security notices —, never for advertising;
• nickname and avatar image, which is publicly viewable by URL;
• preferences and settings, access roles and account creation date;
• record of your acceptance of the Terms of Use and this Policy (version and date).

b) Google sign-in (if you use it)

Google account identifier, e-mail, name and profile photo. On your first Google sign-in, an account is created automatically, and your Google photo becomes your profile photo on the Site. You can change or remove it at any time on your profile page.

c) Content you create

• chat messages: in public rooms, in private/direct conversations and whispers;
• nicknames used in chat and games;
• game data: Overworld characters (appearance, position, inventory, gold, quests, level), game match results and scores, and game keybinds. Game rankings, which only include accounts, show your display name unless you choose to appear anonymous;
• support tickets you open, with the messages exchanged with the administrators.

Private messages are not end-to-end encrypted: they are stored on the server so the conversation can be displayed.

d) Contact form

Name, e-mail and/or phone number, message and, for abuse prevention, technical data about the submission, such as the IP address. If you are logged in to your account when sending, the message is also linked to it. A copy of the message is e-mailed to the Site's contact mailbox, so we can reply.

e) Access logs and statistics

On every visit — including by visitors without an account — we record:

• full IP address, date and time, and the page visited;
• how you arrived at the Site: referring site (e.g. Google or Instagram) and campaign, if any;
• general characteristics of your device and browser, such as device type, system, screen size, language and timezone.

Purposes: security, attack prevention and abuse investigation; compliance with a legal obligation (Marco Civil da Internet, article 15); and aggregated audience statistics. Legal bases: legal obligation and legitimate interest.

f) Optional statistics (only with your consent)

If you consent through the privacy banner, we use Google Analytics (Google LLC), with analytics cookies, to understand how the Site is used, and your visits are also linked to an anonymous identifier for this browser, to count unique visitors more accurately. Without your consent, no analytics cookies are stored and Google only receives anonymous signals about visits, without cookies. Google processes this data under its own privacy policy. You choose in the privacy banner or, if you have an account, when accepting the Terms of Use (the choice is saved to your account), and you can change your mind at any time in "Privacy preferences" (in Options or at the end of your profile), without affecting processing carried out before the change.

g) Security records

• temporary login attempt counters, to stop automated attacks;
• moderation records, such as bans;
• an audit history of account creation, changes and deletion (what was changed, username, e-mail and the IP address of whoever performed the action), kept for security and legal defense purposes.

h) Push notifications (only if you enable them)

The technical data needed to deliver notifications to your browser. Notifications are delivered through the browser vendor's push service (such as Google, Mozilla or Apple). You can disable them at any time on the Site or in your browser settings.

3. Cookies and browser storage

The Site currently does not use advertising cookies; if that changes, this Policy will be updated beforehand. We only use:

• Session cookie (strictly necessary): keeps you logged in.
• Local browser storage: your preferences (such as language, sound, animations and game settings), your privacy choice, an anonymous identifier used for guests in chat and games, and a flag saying a session is open (no account data), used only so the page opens in the right state.
• Temporary storage: chat data that is cleared when the tab is closed.
• Google Analytics cookies (optional): stored only with your consent, to measure visits and use of the Site; removed if you withdraw consent.

You can delete this data at any time by clearing cookies and site data for raf.dev.br in your browser settings. Deleting the cookie ends your session; clearing local storage restores the default preferences.

4. Purposes and legal bases

We process personal data under article 7 of the LGPD and, where applicable, article 6 of the GDPR:

• Performance of a contract: creating and maintaining your account and providing chat, games and other features.
• Legitimate interest: security, fraud and abuse prevention, moderation, statistics and improvement of the Site, respecting your rights and legitimate expectations.
• Legal obligation: keeping access logs (Marco Civil da Internet, article 15) and complying with orders from authorities.
• Consent: optional browser-linked statistics and push notifications; it can be withdrawn at any time.

Data may also be used for the regular exercise of rights in judicial, administrative or arbitration proceedings.

5. Sharing and international transfers

We do not sell personal data. It may be shared only with:

• the infrastructure provider that hosts the Site (including its own mail server, which sends the account messages);
• Google, only if you use Google sign-in;
• Google, as the Google Analytics provider, to measure use of the Site (with cookies only if you consent);
• browser push services, only if you enable notifications;
• public authorities, when required by law or court order.

Some of these providers may process data outside Brazil. In such cases, the international transfer takes place under the conditions of article 33 of the LGPD and, where applicable, with the safeguards provided for in the GDPR (such as standard contractual clauses adopted by the providers).

What you post in public areas — nickname, avatar, messages in public rooms and data shown in games and rankings — is visible to other users.

6. Retention and deletion

• Account: for as long as it exists. When it is deleted, its data is erased, and the messages you sent in chat remain only in anonymized form.
• Access logs: for the period required by law (at least 6 months); after that, only in non-identifying form, for statistics.
• Contact messages: for as long as needed to handle the request.
• Security and moderation records: for as long as needed to protect the Site and to defend legal rights.

Data may be kept longer when necessary to comply with a legal obligation or an order from an authority, or for the regular exercise of rights (LGPD, article 16).

7. Your rights

You have the rights set out in article 18 of the LGPD (and, where applicable, in the GDPR): to confirm and access your data, correct it, request its anonymization, blocking or deletion, portability, information about sharing, to withdraw consent, to object to processing and to complain to the ANPD or your local data protection authority.

Through the Site's support (in your account menu) you can request a copy of your data, released for download within 15 days, and make other requests about it. On your Profile page you can delete your account. If you have no account, use the contact channel (contact form).

8. Security

• encrypted connections (HTTPS) across the whole Site;
• passwords stored irreversibly, using algorithms designed for that purpose;
• protections that make session theft harder;
• attempt limits against abuse and automated attacks;
• role-based access control for administrative functions;
• data minimization principle.

No system is 100% secure. In the event of a security incident that may cause significant risk or harm, affected data subjects and the ANPD will be notified as required by law.

9. Children and teenagers

The Site is not directed to children under 13, who must not use it. Teenagers aged 13 to 17 may only use the Site with the authorization of a parent or legal guardian. If you believe a child has provided us with personal data, please contact us so it can be deleted.

10. Changes to this policy

This Policy may be updated. Each new version is published on this page with its effective date. In case of material changes, users with an account will need to accept the new version to keep using the Site.

11. Contact

Questions and requests about privacy and personal data: contact form. Controller: Rafael Pontes.

As a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022), the controller does not appoint a data protection officer (DPO); this channel is the means of communication with data subjects.