Privacy Policy

1. Who we are and how to reach us

• Developer: Gilbran Clesio da Silva Rocha Junior (CNPJ 67.860.951/0001-01, Brazil)
• Contact: privacidade@rocruzta.com.br
• No formal Data Protection Officer (DPO) designated at this time — for small-scale operations, Brazil's LGPD allows this formality to be waived as long as there is an effective contact channel for data subjects to exercise their rights (see section 7). This may change as the app grows.

2. What data we collect

2.1. Account data (when you sign in with your Google account)

• Creating an account is only via Google Sign-In — there is no email/password signup, and we never store any password.
• From Google we receive and store: your email, a unique identifier for your Google account (not reversible to the email alone), and the display name you choose in the game.
• We do not have access to any other information from your Google account (password, contacts, other apps, etc.).

2.2. Game progress data

• No account / local mode: your progress (squad, items, map, settings) is saved only on your own browser/device's local storage — we do not send this to any of our servers while you have not signed in with your account.
• With an account: currency balance, collection of unlocked characters, shards, gacha pull history (kept for probability audit purposes), and the full progress of your current run — automatically synced across every device where you sign in with the same account.

2.3. Device and advertising data

• When displaying ads (Google AdMob), the ad SDK collects: IP address, the device's advertising identifier, ad interaction, and diagnostic data — used by Google to serve and measure ads.
• We do not collect precise geolocation.

2.4. Premium currency purchases

• Age verification (Android): before allowing any real-money purchase, we check Play Age Signals, a Google Play feature that confirms whether you are over 18. We only receive and store the result of that check (verified or not) and the date — we never receive or store an ID document, photo, card, or birth date; this verification is performed entirely by Google.
• On the Android app: the purchase itself is processed by Google Play Billing — we never see or store any card/payment data.
• On the web version: the purchase is processed by Stripe — same thing, we never see or store card data.
• What we ourselves store: the transaction identifier (given by Google/Stripe), which package was purchased, how much currency was credited, and when — needed for audit, support, and detecting refunds/chargebacks.

2.5. What we do NOT collect

• We do not request or store payment data (card number, CVV, etc.) directly, on either platform.

3. How we use the data

• Authenticate your account and keep your progress synced across devices.
• Validate gacha pulls and currency balance on the server (for security).
• Display rewarded ads and measure their performance.
• Diagnose technical issues and prevent abuse/fraud.
• Comply with legal obligations (e.g., logging pulls for probability audits).

4. Who we share data with

• Google AdMob (Google LLC): to serve and measure ads. Subject to Google's Privacy Policy.
• Google Play Billing (Google LLC): processes premium currency purchases on the Android app.
• Stripe (Stripe, Inc.): processes premium currency purchases on the web version. Subject to Stripe's Privacy Policy.
• Backend hosting provider: Hetzner Online GmbH (Germany) — see section 11 on international data transfer.
• We do not sell personal data to third parties.
• We may share data if required by law, court order, or to protect our rights/safety or those of third parties.

5. Ads and advertising identifiers

• We use Google AdMob for rewarded ads (watch an ad, earn in-game currency).
• You can limit/reset your Advertising ID in your Android device's settings (Settings → Google → Ads).
• In regions requiring consent (EU/UK/Switzerland, and some US states), we will show a consent screen before any personalized ad.

6. Legal basis (LGPD/GDPR)

• Contract performance: to provide the service you requested (account, saved progress).
• Consent: for personalized ads (where required) and any collection that is not strictly necessary.
• Legitimate interest: fraud/abuse prevention, technical diagnostics.
• Legal obligation: logging gacha pulls for probability audits.

7. Your rights

You have the right, at any time, to:

• Confirm whether we process your data and access a copy of it.
• Correct incomplete/outdated data.
• Request deletion of your account and associated data — already possible directly inside the app (delete account button, next to your profile), or, if you no longer have access to the app, by requesting it by email on this page.
• Revoke consent (e.g., for personalized ads) without affecting basic use of the game.
• Request portability of your data.
• We respond to access requests within 15 days (LGPD's deadline).

To exercise any of these rights, contact us via section 1.

8. Data retention and deletion

• Account data is kept for as long as your account exists.
• You can delete your account at any time, directly in the app — deletion is immediate and permanently erases email, Google identifier, currency balance, character collection, run progress saved in the cloud, and pull history associated with the account, except where the law requires retention for a set period. Without access to the app, you can request the same deletion by email on this page.
• Progress saved only locally (no account) is deleted when you uninstall the app or clear its data.

9. Security

• We do not store any password — authentication is entirely delegated to Google Sign-In.
• Communication between the app and the server is authenticated by token (JWT).
• In case of a security incident that puts your data at risk, we will notify Brazil's National Data Protection Authority (ANPD) and you within 3 business days of becoming aware of the incident.

10. Children and teenagers

• Vale das Lendas is not specifically directed at children, but we recognize that the visual style may attract players of any age.
• We do not intentionally collect data from children under 12 without specific and prominent consent from a legal guardian (LGPD Art. 14), and we do not show personalized ads to a user identified as a child/teenager.
• Brazil's "ECA Digital"/Felca Law (Law 15.211/2025), in effect since 03/17/2026, prohibits paid loot boxes in products directed at children/teenagers or likely to be accessed by that audience, unless access is restricted to adults 18+, and requires age verification more robust than simple self-declaration.
• For this reason, real-money premium currency purchases are restricted to adults 18+. On the Android app, this is enforced through Play Age Signals — we only allow the purchase once Google itself confirms your age (we never accept self-declared age inside the game). If your age has not been confirmed by Google yet, the purchase stays unavailable until you verify it directly in your Google Account settings, outside our app. The web version does not have this mechanism yet, so real-money purchases on the web remain unavailable.

11. International data transfer

• Our server runs on cloud infrastructure located in Germany (European Union) — which constitutes an international data transfer under the LGPD (Art. 33).
• The European Union has an adequacy decision recognized by ANPD's Board of Directors (Resolution No. 32/2026), which provides adequate legal basis for this transfer without the need for additional Standard Contractual Clauses.

12. Changes to this policy

We may update this policy as the app evolves. Material changes will be communicated inside the app or by email, when applicable.