This Privacy Policy explains how we collect, use, and protect your personal data when you play Nivara. We comply with the EU General Data Protection Regulation (GDPR) and applicable data protection laws.
The data controller is Tao Wang, reachable at support@gamestao.com.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Username, email address, hashed password | Authentication, account management | Contract (Art. 6(1)(b) GDPR) |
| Game state | Progress, inventory, match history, coins balance | Game functionality, server authority | Contract |
| Transaction data | Purchase amounts, and the transaction identifier issued by the payment processor for your platform (Paddle on the web, Apple on iOS) | Payment processing, fraud prevention | Contract; Legal obligation |
| Technical data | IP address, device type, browser, session logs | Security, debugging, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Analytics | Gameplay events, session duration (anonymised) | Game balance and improvement | Legitimate interest |
Who processes your payment depends on where you play. In both cases we never see or store your card number or billing address — the processor holds those directly, and we receive only the amount, the product, and a transaction identifier.
We do not sell your personal data. We share data only with:
We use browser local storage to save your session token and game settings. We do not use third-party tracking cookies. A consent dialog is shown on first launch.
Account data is retained for as long as your account is active. Transaction records are kept for 7 years to comply with EU accounting law. You may request deletion of your account at any time (see §7).
Under GDPR you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict or object to processing, and data portability. To exercise any right, email support@gamestao.com. We will respond within 30 days.
We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We use industry-standard measures including HTTPS, hashed passwords, and access controls. No method of transmission over the internet is 100% secure.
We may update this policy. Material changes will be communicated via in-game notice or email.
For privacy questions or GDPR requests: support@gamestao.com.