Privacy Policy
This text explains what data the game Rift Guardians and this site process, what for, where it is kept and what you can do about it. It applies together with the Terms of Use.
This is a translation of the Portuguese version. If the two differ, the Portuguese version prevails.
In a few lines
- The game does not ask for an e-mail, password, real name, phone number or ID document.
- The online account is a key created on your computer. The server stores an identifier, the display name you choose and your progress in the game.
- There are no ads, no purchases, no text or voice chat, and no third-party analytics or tracking tools.
- The data is kept on a server in São Paulo, Brazil. We do not sell or hand over data to anyone.
- You can export and delete your account from inside the game at any time.
- The campaign works without an online account. If you do not accept this policy, the game stays on your computer only.
1. Who is responsible
The party responsible for the data (the "controller", in the language of Brazil's General Data Protection Law — LGPD) is Vitor Moura, an individual, independent developer, in Brazil. There is no company behind the game.
Contact for any privacy matter: contato@riftguardians.tech
Because this is a small one-person project, there is no separate data protection officer: that address is the channel for data subjects and for Brazil's data protection authority (ANPD). We answer requests within 15 days.
2. What data the server stores
Data only exists on the server if you create the online account, which happens after you accept the terms the first time you run the game with an internet connection.
| Data | What it is | What it is for |
|---|---|---|
| Device identifier | A random code created by the game on first run. It is not derived from your hardware and does not identify the computer outside the game. | Recognizing your account when the game opens. |
| Account secret | A random key created on your computer. The server stores only a cryptographic digest (hash) of it, never the key. | Proving it is you, in place of a password. |
| Sessions | Temporary access codes, also stored as digests. | Keeping you signed in without resending the key on every request. |
| Account | Account identifier, creation date and last-change date. | Running the account. |
| Acceptance of the documents | The version of the Privacy Policy and Terms of Use you accepted, the day you accepted, and your answer to "Are you 18 or older?" (yes or no only; we do not ask for a date of birth). | Recording that you accepted the documents and knowing when to show a new version. |
| Display name | The name you choose (it starts as "Guardião"). It is visible to your friends, to whoever receives your friend code and to rivals in PvP. | Showing who is who. |
| Progress | Stages won, stars, unlocked commanders and guardians, in-game currencies, missions, achievements, game preferences (such as your emote wheel). | It is your saved game in the account. |
| In-game currency ledger | Every gain or spend of in-game currency and items, with date and origin. These are game currencies with no monetary value. | Checking balances and fixing mistakes. |
| Campaign matches | The game sends the recording of the match's commands so the server can replay the match and check the result. The server stores the summary: stage, commander, result, stars, duration, date and verification codes. | Preventing fake progress and counting rewards. |
| PvP matches | Mode, date, duration, result, whether someone abandoned, and the identifier of the rival's account. During the match, both players' commands pass through the server. Repeated abandons create a waiting time, which is also recorded. | Making the match happen, checking the result and discouraging abandons. |
| Friends | Your friend code, friends list, friend requests sent and received, and accounts you have blocked. | Friendships and challenges. |
| Presence | Whether you made a request to the server in the last minute ("online"). Kept only in the server's memory, not written to disk. | Showing your friends who is in the game. |
| In-game mail | Messages that we send (notices, compensation) and whether they were read and claimed. Players do not send messages to each other. | Delivering notices and rewards. |
| Technical logs | IP address, date and time, requested address, game version and result of each request made to the server. | Security, per-IP request limits and troubleshooting. |
Your IP address is also used, at the moment of the request, to limit the number of requests per minute and, in online PvP, for the server to relay the match packets. In online PvP, players do not connect directly to each other: everything goes through our server, and your rival does not receive your IP.
3. What stays only on your computer
Your Windows user's data folder holds the saved game, the account key (encrypted by Windows itself for your user), the queue of what has not been sent to the server yet, your settings and the game's log file (Player.log). None of this is sent to us automatically, except the progress that is part of the online account. The game does not send error reports on its own.
4. What the game does not collect
- Real name, e-mail, phone number, address, ID document, date of birth or photo.
- Payment data. The game has no purchases.
- Precise location, contacts, files, microphone or camera.
- Conversations. There is no text or voice chat between players; communication is through emotes and ready-made pause reasons.
- Behavioural profiles for advertising. There are no ads and no third-party analytics or advertising tools in the game.
On first run the game only asks whether you are 18 or older. We do not ask for your date of birth or any document.
5. Connections the game makes
- The game server (
api.riftguardians.tech, in São Paulo): account, stage verification, PvP, friends and mail. Only after you accept the terms. - The public status file: when it opens, the game checks a small file hosted on GitHub Pages to learn the server address, the newest version and whether there is maintenance. The game sends none of your data in that request, but GitHub, like any website, receives the IP address of whoever makes the request.
- The game does not connect to ad networks or analytics services.
6. What we use it for, and on what legal basis
The LGPD requires a legal justification for each use of personal data. Ours are:
- Providing the online game you asked for (performance of a contract, art. 7, V): account, progress, ledger, matches, friends and mail. Without this data there is no online account.
- Protecting the service and other players (legitimate interest, art. 7, IX): technical logs, request limits, checking matches against cheating and recording PvP abandons. We use the minimum, for a short time.
- Complying with the law (art. 7, II): if a competent authority demands data through a valid order.
We do not use your data for advertising, we do not build profiles, and we make no automated decisions that affect you outside the game. Inside the game, the server automatically refuses stages and matches that do not check out; if you think a refusal was a mistake, write to the contact address.
7. Where the data is kept and who else has access
Only the person responsible has access to the data. To make the game work, we use these providers:
| Provider | What for | What passes through it |
|---|---|---|
| Hostinger | Hosts the game server (a virtual machine in São Paulo, Brazil). | All the data in section 2. |
| GitHub | Stores the daily backup of the database, encrypted, in a private repository. Only the person responsible has the key that opens the backup. It also hosts this site, the public status file and a mirror of the download. | The encrypted backup; and, when you visit the site or the game reads the status file, your IP address, as with any website. |
| itch.io | Hosts the game's page and download. | Nothing from your game account. What itch.io records when you visit or download is covered by its own privacy policy. |
GitHub's servers are outside Brazil. The backup leaves Brazil encrypted, and the key never leaves the hands of the person responsible.
We do not sell, rent or hand over data. We only give data to authorities when the law requires it.
8. For how long
| Data | Period |
|---|---|
| Account, progress, ledger, matches, friends | For as long as the account exists. We do not delete inactive accounts today; if that changes, we will announce it beforehand. |
| After you delete the account | The data leaves the database immediately. |
| Backups | Each backup is kept for up to 30 days. A deleted account may remain inside the encrypted backups until they expire. |
| In-game mail | 30 days per message, unless the message states another period. |
| Sessions and match tickets | They expire by themselves (hours or days). |
| Technical logs with IP | Up to 30 days. |
If the online service is shut down, the data will be erased after a notice period for anyone who wants to export.
9. Your rights and how to use them
The LGPD gives you, among others, the right to confirm whether we process your data, to access it, correct it, request its deletion, request portability, know who it is shared with, and object to processing. In practice:
- See and take your data: in the game, under Settings → Online account → Download my data. The game writes a file with everything the server has about your account.
- Delete: in the game, under Settings → Online account → Delete my online account. Deletion is final and erases the account, progress, ledger, matches, friendships (on both sides) and mail.
- Correct: the display name is changed in your profile, in the game.
- Any other request or question: write to contato@riftguardians.tech.
Because we store no e-mail or real name, we cannot confirm by e-mail that an account is yours. That is why exporting and deleting are done from inside the game, on the computer where the account lives. If you have lost access to that computer, write anyway and tell us your friend code; we will do what we can, but we may be unable to fulfil a request without being sure the account belongs to the person asking.
If you believe we have not respected your rights, you can complain to the ANPD (gov.br/anpd). If you live outside Brazil, you may also have rights under your local law; write to us and we will do our best to honour them.
10. Children and teenagers
The game is fantasy-themed, with no chat between players and no purchases, and we process the minimum of data about anyone, of any age.
- If you are under 18, ask your parent or guardian to read this policy and the Terms of Use with you before creating the online account.
- Parents and guardians can export or delete the account through the game itself at any time, or write to the contact address.
- The campaign can be played without an online account; in that case none of the player's data reaches our server.
- We do no advertising and no profiling of anyone, and therefore of no child or teenager.
- The display name is the only thing written by the player that other people see. Tell the child not to use their real name.
11. Security
- Communication with the server is encrypted (HTTPS).
- The server does not store the account key, only a digest of it.
- The key on your computer is encrypted by Windows for your user.
- Backups are encrypted before they leave the server.
No system is perfect. If there is an incident that may bring relevant risk or harm to players, we will give notice on this site, through in-game mail and on Discord, and notify the ANPD as the law requires.
12. This site
This site is made of static pages: it uses no cookies, has no sign-up, has no ads and loads nothing from third parties. The only exception is the Server status page, which reads the public status file hosted on GitHub Pages. The service that hosts the site (GitHub Pages) logs visitors' IP addresses, like any host.
13. Changes to this policy
When this text changes, the version and date at the bottom of the page change, and important changes will be announced in the game and in the News. Earlier versions are kept and can be requested through the contact address.
Version 1.0 · 11 October 2026