Privacy Policy

Version 2026-10-18 · Effective October 18, 2026

The Portuguese (pt-BR) version is the authoritative version of this document. This English version is a translation provided for convenience; in case of any discrepancy, the Portuguese version prevails.

1. About this policy

This Privacy Policy explains how personal data is processed on the website raf.dev.br, including its API, chat, games and other apps and features (the "Site"). The Site is a personal, non-commercial project run by an individual.

Controller: Rafael Pontes, an individual resident in Brazil. Contact channel: contact form.

Processing follows the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the Brazilian Internet Civil Framework (Marco Civil da Internet — Law No. 12,965/2014) and, where applicable (for example, to users in the European Economic Area), the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).

Use of the Site is also subject to the Terms of Use.

2. Data we collect

We collect only what is needed for each purpose, in the categories below.

a) Account

username, e-mail and, optionally, name;
password, which is never stored in readable form;
when you create an account with a username and password, the confirmation of your e-mail through a code or link sent to it (the account is only created after that). The account e-mail is used only for messages about the account — sign-up confirmation, password resets and security notices —, never for advertising;
display name (nickname) and profile photo;
profile privacy settings, such as who can see your photo and whether other people can find you by name;
preferences and settings, access roles and account creation date;
record of your acceptance of the Terms of Use and this Policy (version and date).

b) Google sign-in (if you use it)

Google account identifier, e-mail, name and profile photo. On your first Google sign-in, an account is created automatically, and your Google photo becomes your profile photo on the Site. You can change or remove it at any time on your profile page.

c) Content you create

chat messages: in public rooms, in private/direct conversations and whispers;
nicknames used in chat and games;
games and apps data: progress, characters, virtual items and currencies, quests, results, scores and settings (such as keybinds). Rankings, which only include accounts, show your display name unless you choose to appear anonymous;
social features: friendships, friend requests and invite links, and your choices about what friends can see;
support tickets you open, with the messages exchanged with the administrators.

Private messages are not end-to-end encrypted: they are stored on the server so the conversation can be displayed.

Presence and activity: while you use the Site, we keep track of whether you are connected or idle and which part of the Site you are using (for example, which game you are in and where your character is). This is shown to your friends according to your choices: you can appear offline, busy or away and hide what you are doing. This information only exists while you are connected and does not build a history.

d) Contact form

Name, e-mail and/or phone number, message and, for abuse prevention, technical data about the submission, such as the IP address. If you are logged in to your account when sending, the message is also linked to it. A copy of the message is e-mailed to the Site's contact mailbox, so we can reply.

e) Access logs and statistics

On every visit — including by visitors without an account — we record:

full IP address, date and time, and the page visited;
how you arrived at the Site: referring site (e.g. Google or Instagram) and campaign, if any;
general characteristics of your device and browser, such as device type, system, screen size, language and timezone.

Purposes: security, attack prevention and abuse investigation; compliance with a legal obligation (Marco Civil da Internet, article 15); and aggregated audience statistics. Legal bases: legal obligation and legitimate interest.

f) Optional statistics (only with your consent)

If you consent through the privacy banner, we use Google Analytics (Google LLC), with analytics cookies, to understand how the Site is used, and your visits are also linked to an anonymous identifier for this browser, to count unique visitors more accurately. Without your consent, no analytics cookies are stored and Google only receives anonymous signals about visits, without cookies. Google processes this data under its own privacy policy. You choose in the privacy banner or, if you have an account, when accepting the Terms of Use (the choice is saved to your account), and you can change your mind at any time in "Privacy preferences" (in Options or at the end of your profile), without affecting processing carried out before the change.

g) Security records

temporary login attempt counters, to stop automated attacks;
moderation records, such as bans;
an audit history of account creation, changes and deletion (what was changed, username, e-mail and the IP address of whoever performed the action), kept for security and legal defense purposes.

h) Push notifications (only if you enable them)

The technical data needed to deliver notifications to your browser. Notifications are delivered through the browser vendor's push service (such as Google, Mozilla or Apple). You can disable them at any time on the Site or in your browser settings.

3. Cookies and browser storage

The Site currently does not use advertising cookies; if that changes, this Policy will be updated beforehand. We only use:

Session cookie (strictly necessary): keeps you logged in.
Local browser storage: your preferences (such as language, sound, animations and game and app settings), your privacy choice, an anonymous identifier used for guests in chat and games, a flag saying a session is open (no account data), used only so the page opens in the right state, and temporary browsing information, such as the page to return to after logging in.
Temporary storage: chat data that is cleared when the tab is closed.
Google Analytics cookies (optional): stored only with your consent, to measure visits and use of the Site; removed if you withdraw consent.

You can delete this data at any time by clearing cookies and site data for raf.dev.br in your browser settings. Deleting the cookie ends your session; clearing local storage restores the default preferences.

4. Purposes and legal bases

We process personal data under article 7 of the LGPD and, where applicable, article 6 of the GDPR:

Performance of a contract: creating and maintaining your account and providing chat, games and other features.
Legitimate interest: security, fraud and abuse prevention, moderation, statistics and improvement of the Site, respecting your rights and legitimate expectations.
Legal obligation: keeping access logs (Marco Civil da Internet, article 15) and complying with orders from authorities.
Consent: optional browser-linked statistics and push notifications; it can be withdrawn at any time.

Data may also be used for the regular exercise of rights in judicial, administrative or arbitration proceedings.

6. Retention and deletion

Account: for as long as it exists. When it is deleted, its data is erased, and the messages you sent in chat remain only in anonymized form.
Access logs: for the period required by law (at least 6 months); after that, only in non-identifying form, for statistics.
Contact messages: for as long as needed to handle the request.
Security and moderation records: for as long as needed to protect the Site and to defend legal rights.

Data may be kept longer when necessary to comply with a legal obligation or an order from an authority, or for the regular exercise of rights (LGPD, article 16).

7. Your rights

You have the rights set out in article 18 of the LGPD (and, where applicable, in the GDPR): to confirm and access your data, correct it, request its anonymization, blocking or deletion, portability, information about sharing, to withdraw consent, to object to processing and to complain to the ANPD or your local data protection authority.

Through the Site's support (in your account menu) you can request a copy of your data, released for download within 15 days, and make other requests about it. On your Profile page you can delete your account. If you have no account, use the contact channel (contact form).

8. Security

encrypted connections (HTTPS) across the whole Site;
passwords stored irreversibly, using algorithms designed for that purpose;
protections that make session theft harder;
attempt limits against abuse and automated attacks;
role-based access control for administrative functions;
data minimization principle.

No system is 100% secure. In the event of a security incident that may cause significant risk or harm, affected data subjects and the ANPD will be notified as required by law.

9. Children and teenagers

The Site is not directed to children under 13, who must not use it. Teenagers aged 13 to 17 may only use the Site with the authorization of a parent or legal guardian. If you believe a child has provided us with personal data, please contact us so it can be deleted.

10. Changes to this policy

The Site is constantly evolving. New features may process data within the categories, purposes and legal bases already described in this Policy without requiring a new version.

When there is a material change — such as a new category of data, a new purpose or a new kind of sharing —, the new version is published on this page with its effective date, and users with an account will need to accept it to keep using the Site.

11. Contact

Questions and requests about privacy and personal data: contact form. Controller: Rafael Pontes.

As a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022), the controller does not appoint a data protection officer (DPO); this channel is the means of communication with data subjects.