Di data controller na:
We dey operate from Republic of Moldova. Personal data dey process under Moldovan Law No. 133 of 08.07.2011 on Protection of Personal Data, and for users wey dey European Union, under di General Data Protection Regulation (GDPR, EU 2016/679).
Your real e-mail address dey stored only for your own account record. Di public "already taken" registry get one hash (SHA-256) wey no fit reverse instead of di address itself, so di system fit answer "dis address don already register" without showing di address to anybody.
Phone number fit identify person even outside our service, so we dey handle am stricter pass any other data.
If you change your number, set di new one for your settings. Mobile operators go later give di numbers wey people don release to other subscribers — if stranger receive your old number, dem fit request code with am. So e important make you keep number up to date when you change SIM.
Messages dey stored for server — if no be so, you no go see your conversations for another device. For normal operation we no dey read private conversations. Access to particular conversation dey happen only when participant report am, or when competent authority legally demand am. Di chat no be end-to-end encrypted, so make you no send password, banking details, or identity documents through am.
Screenshots dey stored for our server inside folder wey no dey open to internet. Dis kind file fit only open through link wey get random key wey dey inside di report itself, and only moderators and di person wey write di report fit read am.
We no dey ever receive or store card numbers. Paddle.com Market Limited dey handle payments, dem be di merchant of record wey dey process payment data demself. Wetin we dey receive back na just di confirmation: amount, currency, transaction identifier, and status.
| Data | Purpose | Legal basis |
|---|---|---|
| Login, nickname, e-mail, password | Creating and protecting di account, signing in, recovering access | Performance of our contract with you |
| Phone number (messenger) | Creating di messenger account, SMS confirmation, signing in and recovering access | Performance of contract: messenger account no fit exist without number |
| Phone number — abuse prevention | Stopping one person from creating plenty accounts and sending spam | Legitimate interest |
| Progress, balance, inventory | Running di games and saving your results | Performance of contract |
| Friends, chats, presence | Di social features wey you choose to use | Performance of contract |
| Reports, violations, screenshots | Community safety and resolving disputes | Legitimate interest and performance of contract |
| IP address, request times | Protection against spam, password guessing, and abuse | Legitimate interest |
| Payment confirmations | Crediting purchases, accounting, payment disputes | Contract and legal obligation |
| Public profile | Showing you to other players | Your consent (privacy settings) |
We no dey sell your data, we no dey give am to advertising networks, and we no dey show any advertising. We no dey take automated decisions wey go produce legal effects for you: account go only close after human moderator confirm am.
We dey work with small number of processors. Each one dey receive only wetin dem need for dia job.
| Who | Wetin dem dey receive | Why |
|---|---|---|
| Google Ireland Ltd. — Firebase Authentication and Cloud Firestore | Account data, profile, chats, gameplay progress | Data storage and sign-in verification |
| Google Ireland Ltd. — Firebase Phone Authentication | Phone number and one-time code | Sending di SMS code and verifying di number when registering for messenger |
| Mobile network operators | Phone number and text of di SMS code | Delivering di message to your phone |
| Google — reCAPTCHA | Your IP address and form behaviour | Telling humans from bots for registration |
| Google — Fonts | Your IP address when fonts dey load | Rendering di site typefaces |
| Paddle.com Market Limited | Di payment details wey you enter for dia side | Taking di payment |
| Our hosting provider | Technical server logs | Keeping di site running |
Some of dis companies dey located outside Moldova and di EU. Transfers dey rely on di Standard Contractual Clauses wey European Commission approve, or another mechanism wey law permit.
We go also disclose data where court, police, or another competent authority legally require am.
| Wetin | How long |
|---|---|
| Account and im contents | For as long as di account exist |
| Data after account deletion | Dem go delete am; di login, e-mail, and phone number go release and go dey available again for registration |
| Phone number | For as long as di messenger account exist; dem go delete am together with di account |
| SMS confirmation codes | Valid for small minutes, then e go void and dem go erase am |
| Chat messages | Until di author delete am or until dem remove di chat |
| Reports and decisions | Up to 3 years, so dat repeat offences go still dey visible |
| Report screenshots | 180 days, then dem go delete am automatic |
| Anti-spam records (IP + time) | 10 minutes, then dem go erase am |
| Payment records | The period required by Moldovan tax law |
You fit:
Write to umbra.corporation.md@gmail.com from di address wey dey your account. We go answer within 30 days, free of charge, except for requests wey clearly no get foundation or dey repeat.
Profile → Settings → delete account. Deletion na final: your ÆC balance, inventory, friends, conversations, and progress for every game go gone and e no fit restore am. Your login and e-mail go release after dat, and anybody — even you — fit register with dem after.
You fit create account if you don reach at least 13 years old. If you dey under 16 years old, you fit only use di service with consent of parent or legal guardian.
We no dey ask or verify age for registration. If you be parent and you see say your child don create account without your consent, write us and we go delete di account and im data.
No service dey perfectly secure. If breach happen wey go threaten your rights, we go notify you and inform di competent data protection authority within di required time.
We fit change dis document — for example when shop or messenger launch. Di version date dey show for top. Material changes go announce for di site in advance. If you continue to use di service after dem take effect, e mean say you accept dem.
Any question about data: umbra.corporation.md@gmail.com
Postal address: str. Exemplu 1, of. 1, MD-2001, mun. Chișinău, Republica Moldova
Umbra Corporation