Privacy Policy

Version of 23.07.2026 · umbracorporation.net

This document explains, in plain language, what Umbra Corporation collects about you, why, who we share it with and what you can do about it. It describes what actually happens in our products rather than generic boilerplate.

1. Who is responsible for your data

The data controller is:

Legal name: Umbra Corporation S.R.L.
Reg. number: 1000000000000
Registered office: str. Exemplu 1, of. 1, MD-2001, mun. Chișinău, Republica Moldova
E-mail: umbra.corporation.md@gmail.com
Phone: +373 00 000 000
Website: umbracorporation.net

We operate from the Republic of Moldova. Personal data is processed under Moldovan Law No. 133 of 08.07.2011 on the Protection of Personal Data and, for users in the European Union, under the General Data Protection Regulation (GDPR, EU 2016/679).

2. What we collect

2.1. When you create an account

Login — chosen once and never changed. It is unique and visible to other players.
Nickname — your display name, which you can change.
E-mail address — used to confirm registration and to recover access.
Password — we never see or store it. Password checking is performed by Google Firebase Authentication; all we receive is "access granted" or "access denied".
Player ID — an eight-digit number assigned automatically, used to find and open your profile.
Phone number — for registering in the messenger. It is the only way to create an account there: the number is confirmed with a code sent by SMS. The games (Fall of Cities, Galactic Cleaner) and the rest of the site do not ask for a phone number.

Your real e-mail address is stored only in your own account record. The public "already taken" registry holds an irreversible SHA-256 hash rather than the address itself, so the system can answer "this address is already registered" without revealing the address to anyone.

2.1.1. About the phone number in particular

A phone number can identify a person outside our service as well, so we handle it more strictly than anything else.

Your number is never shown to other users. It does not appear in your public profile, in chats or in friend lists. Others see only your login, nickname and player ID.
Nobody can find you by your number. People search works by login and by player ID. Entering someone's number will not bring up their profile.
We do not upload your address book. The messenger does not read the contacts on your device and does not send them to us — neither at sign-up nor later.
The number itself is stored only in your own account record. The shared "already taken" registry holds an irreversible SHA-256 hash rather than the number, so the system can answer "this number is already registered" without revealing it to anyone, users included.
The SMS code is issued and checked by Google Firebase Authentication. Delivery goes through that service and through mobile operators in your country; they see the number and the fact that a message was sent, but not the contents of your conversations.
We do not use the number for advertising and do not pass it to ad networks, data brokers or any third party other than those listed in section 4.

If you change your number, set the new one in your settings. Mobile operators eventually reassign released numbers to other subscribers — if a stranger receives your old number, they will be able to request a code to it. Keeping the number current when you change SIM matters for that reason.

2.2. What you add yourself

avatar image, avatar frame, profile background and card background;
profile biography;
privacy settings — what your public profile shows and what it hides;
in Umbra Mind, the characters you create: name, description, personality, image.

2.3. Gameplay data

your ÆC balance and its history;
inventory: chips, cards and other in-game items;
which games you marked as installed;
friends, sent and received friend requests, favourites;
your block list (visible only to you).

2.4. Communication

messages in direct and group chats, including timestamps;
group names, group avatars and membership;
pinned messages.

Messages are stored on the server — otherwise you would not see your conversations on another device. We do not read private conversations in normal operation. Access to a specific conversation happens only when a participant reports it, or when a public authority lawfully requires it. The chat is not end-to-end encrypted, so do not send passwords, banking details or identity documents through it.

2.5. Presence

the status you picked: online, do not disturb, away, offline;
the time you were last active;
the fact that you currently have Umbra Mind open (friends see this in their list).

2.6. Reports and moderation

who reported whom, the rule cited, the description and the date of the incident;
the screenshot, if you attached one;
the moderator's decision and the violation counter;
a record if a report was judged false.

Screenshots are stored on our server in a folder that is closed to the internet. Such a file can only be opened through a link containing a random key held inside the report itself, and that report is readable only by moderators and by its author.

2.7. Technical data

IP address — recorded when you submit a report, upload a screenshot, request a confirmation code or reset a password;
the date and time of those actions;
information every browser tells every website: browser type, language, operating system.

What an IP address is. It is the number your internet provider gives you when you go online — much like the return address on an envelope. Without it a website simply could not send a reply back to your device, which is why every site you open can see it and why it cannot be withheld entirely.

An IP address usually points to a city and a provider, not to a flat or a name. Only the provider can tell who was using it, and only on a lawful request. On most home connections the address changes over time anyway.

Why we keep it. Purely for protection: so that one person cannot file a hundred reports or order a hundred confirmation codes in a minute. We do not use it to track your movements, we do not build a profile from it, and we do not pass it to advertisers — we have none.

2.8. Payments

We never receive or store card numbers. Payments are handled by Paddle.com Market Limited, which acts as merchant of record and processes payment data itself. All we receive back is the confirmation: amount, currency, transaction identifier and status.

3. Why we collect it, and on what legal basis

Data	Purpose	Legal basis
Login, nickname, e-mail, password	Creating and protecting the account, signing in, recovering access	Performance of our contract with you
Phone number (messenger)	Creating the messenger account, SMS confirmation, signing in and recovering access	Performance of the contract: a messenger account cannot exist without a number
Phone number — abuse prevention	Stopping one person from creating dozens of accounts and sending spam	Legitimate interest
Progress, balance, inventory	Running the games and saving your results	Performance of contract
Friends, chats, presence	The social features you chose to use	Performance of contract
Reports, violations, screenshots	Community safety and resolving disputes	Legitimate interest and performance of contract
IP address, request times	Protection against spam, password guessing and abuse	Legitimate interest
Payment confirmations	Crediting purchases, accounting, payment disputes	Contract and legal obligation
Public profile	Showing you to other players	Your consent (privacy settings)

We do not sell your data, do not pass it to ad networks and show no advertising. We take no automated decisions producing legal effects for you: an account is only closed after a human moderator confirms it.

4. Who we share data with

We work with a few processors. Each receives only what it needs to do its job.

Who	What they receive	Why
Google Ireland Ltd. — Firebase Authentication and Cloud Firestore	Account data, profile, chats, gameplay progress	Data storage and sign-in verification
Google Ireland Ltd. — Firebase Phone Authentication	Phone number and one-time code	Sending the SMS code and verifying the number when registering in the messenger
Mobile network operators	Phone number and the text of the SMS code	Delivering the message to your phone
Google — reCAPTCHA	Your IP address and form behaviour	Telling humans from bots at registration
Google — Fonts	Your IP address when fonts load	Rendering the site's typefaces
Paddle.com Market Limited	The payment details you enter on their side	Taking payment
Our hosting provider	Technical server logs	Keeping the site running

Some of these companies are located outside Moldova and the EU. Transfers rely on the Standard Contractual Clauses approved by the European Commission or on another mechanism permitted by law.

We will also disclose data where a court, the police or another competent authority lawfully requires it.

5. How long we keep data

What	How long
Account and its contents	For as long as the account exists
Data after account deletion	Deleted; the login, e-mail and phone number are released and become available for registration again
Phone number	For as long as the messenger account exists; deleted together with it
SMS confirmation codes	Valid for a few minutes, then void and erased
Chat messages	Until deleted by their author or until the chat is removed
Reports and decisions	Up to 3 years, so that repeat offences remain visible
Report screenshots	180 days, then deleted automatically
Anti-spam records (IP + time)	10 minutes, then erased
Payment records	The period required by Moldovan tax law

6. Your rights

You may:

access the data we hold about you and receive a copy;
correct inaccurate data — nickname, biography and avatar you change yourself;
delete your account together with its data;
restrict or object to processing based on our legitimate interest;
port your data in a machine-readable format;
withdraw consent where consent was the basis — this does not undo what was done before;
complain to the National Centre for Personal Data Protection of Moldova (datepersonale.md), or, if you live in the EU, to your national supervisory authority.

Write to umbra.corporation.md@gmail.com from the address on your account. We answer within 30 days, free of charge, except for manifestly unfounded or repetitive requests.

6.1. Deleting your account

Profile → Settings → delete account. Deletion is final: your ÆC balance, inventory, friends, conversations and progress in every game are gone and cannot be restored. Your login and e-mail are then released, and anyone — including you — can register with them afterwards.

What survives deletion. Reports filed against you by others, and the decisions on them, are kept in anonymised form until their retention period ends — otherwise an offender would delete the account to erase the history and start again. Payment records are also kept, as tax law requires.

7. Children

You may create an account if you are at least 13 years old. If you are under 16, you may use the service only with the consent of a parent or legal guardian.

We do not ask for or verify age at registration. If you are a parent and find that your child created an account without your consent, write to us and we will delete the account and its data.

8. How we protect data

all traffic to the site runs over HTTPS;
we store no passwords — Google verifies them;
database access rules are enforced on the server: a browser cannot read someone else's conversation or alter someone else's profile, even with a forged request;
report screenshots sit in a folder closed to the internet;
actions open to abuse are rate-limited;
moderator rights are granted only by hand by the owner and cannot be obtained through the site.

No service is perfectly secure. If a breach occurs that threatens your rights, we will notify you and inform the National Centre for Personal Data Protection within the required time.

9. Changes to this policy

We may change this document — for example when the shop or the messenger launches. The version date appears at the top. Material changes will be announced on the site in advance. Continuing to use the service after they take effect means you accept them.

10. Contact us

Any question about data: umbra.corporation.md@gmail.com
Postal address: str. Exemplu 1, of. 1, MD-2001, mun. Chișinău, Republica Moldova