Privacy Policy

1. Data we collect

• Account data: email address, nickname, password (stored only as an irreversible hash), optionally an avatar, a short bio and gender, an 18+ age confirmation flag, your language and profile settings.
• Sign-in with Google: your Google account identifier, email address, name and profile picture (the picture is used as an initial avatar). We never receive your Google password.
• Game data: matches played and their results, rating, XP and level, inventory and in-game balance (“Simoleons”), trades and market deals, achievements, game settings.
• Communication: in-match chat messages and private messages to friends, reports and moderation decisions, bans and appeals.
• Technical data: IP address and browser information (User-Agent) in the session log, activity times, server logs. We use them for security and abuse prevention, including multi-account detection.
• Sign-in and spam protection: a log of failed password sign-in attempts (email address, number of attempts, lock time). After 10 wrong passwords in a row, sign-in for that email is blocked for 15 minutes and the account owner is sent an email. Request counters by IP and email for registration, password reset and resending a confirmation email (no more than 5 per 24 hours) are kept for no longer than a day.
• Age confirmation: at registration you confirm that you are 18 or older (signing in with Google counts as that confirmation). The flag is stored in your profile.
• Payment data: when you buy in-game currency, payment is processed by Stripe. We do not receive or store your card details — only the payment confirmation, amount and date.
• Matches in trial mode and in friends' rooms: the nickname you enter and your actions inside the match while it lasts. Afterwards a short record is kept: date, duration, number of players and bots, result. Guest nicknames are not stored in it; if you played while signed in, the record is linked to your account and used only for statistics and handling reports.

2. Why we use data

• to provide the game: account, matchmaking, rating, market, trades, chat, inventory;
• to keep the Platform safe and fair: fraud, cheating, hacking and multi-account prevention, handling reports;
• to process payments and keep records of in-game currency;
• to send service emails: email confirmation, password reset, security notices, and emails about trades and friend requests if you have enabled them;
• to understand how the Platform is used and improve it based on anonymous statistics;
• to comply with the law and protect our rights.

3. Legal bases

Where the GDPR applies, we process data on the basis of: performance of our contract with you (the Terms of Service), our legitimate interests (security, fraud prevention, improving the service), your consent (optional notification emails), and compliance with legal obligations.

4. What other players see

Your nickname, avatar, rank and game statistics are visible to other players. You control the visibility of statistics, inventory and badges in Settings → Privacy. Your email address, IP address and payment data are never shown to other players.

5. Who we share data with

We do not sell personal data and do not use it for advertising. To operate the Platform we use third-party services that process data on our behalf:

• Vercel — website hosting; Render — game server hosting;
• Neon — database (EU region, Frankfurt);
• Google — sign-in with Google and email delivery;
• Stripe — payment processing.
• Data may also be disclosed when required by law enforcement or a court.

6. Data from Google services

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google account data only to sign you in and create your profile on the Platform, and we do not share it with third parties or use it for advertising.

7. International transfers

Some of our providers may process data outside your country, including in the United States. In such cases we rely on safeguards provided by law, such as standard contractual clauses.

8. Cookies and local storage

We only use strictly necessary technical cookies and browser local storage: the sign-in session, your selected language, temporary data during Google sign-in, sound settings and your seat identifier in the current room. There are no third-party advertising or analytics cookies on the Platform.

9. How long we keep data

• account data and game history — while the account exists;
• sign-in sessions are kept until they expire and are removed on sign-out or password change;
• after an account is deleted the email, nickname and avatar are erased irreversibly and the profile is anonymized. Records of payments, reports and matches are kept in anonymized form for security, investigations and legal compliance;
• messages and reports may be kept for a limited time to review violations.
• short records of matches played in rooms — while they are needed for statistics and handling reports.

10. Your rights

You may request access to your data, its correction, deletion, restriction of processing, portability, object to processing and withdraw consent. You may lodge a complaint with the data protection authority of your country. Much of your data you can change yourself in profile settings. For account deletion or other requests, contact us using the details below. We will respond within a reasonable time, usually within 30 days.

11. Age

The Platform is intended for people aged 18 and over. We do not knowingly collect data of minors; if we learn that an account belongs to a person under 18 we may block it and delete the data.

12. Security

Passwords are stored as hashes, connections are encrypted, access to data is restricted. Two-factor authentication is available for accounts. No service can guarantee absolute security, so use a unique password and enable two-factor authentication.

13. Changes to this policy

We may update this policy. The date of the latest update is shown at the top of the page. We will announce material changes on the site.

14. Contact

For questions about data and to exercise your rights, contact the Platform operator:

Email: mpoly.noreply@gmail.com