Privacy policy

1. Who is the controller

The data controller is the party responsible for Oddside, who develops and operates the game independently, in Brazil, and also acts as the person in charge of personal data processing (LGPD, art. 41). Contact for anything privacy-related: hello@playoddside.com.

2. What data we process

Account data. When you sign in with Discord, we receive your Discord identifier, your username and your display name. We do not ask for or receive your email, your password, your servers or your messages. We also keep the language you chose, the dates of creation and access, and the account status (active or banned).

Character data. Name, appearance, skills, items, currency, bank, position in the world, friends and blocks, groups and the history of trades between players.

Game logs. Events such as fights, defeats, crimes and notoriety, trades and transactions, player and moderation reports and, for moderation and security, chat messages. Chat is transmitted to other players in real time and may be recorded for a limited time to look into abuse.

Technical data. IP address and connection details (to limit abuse and protect the servers), app and system version, and error reports sent by the app.

Contact. If you write to us, we keep the message and your email address to reply.

This website. The website uses no advertising cookies and no visitor analytics. We only set one functional language-preference cookie (oddside_lang), for one year. The website's host may record the IP address and request data in technical logs.

3. What we use the data for, and the legal basis

• To create and keep your account and characters and to make the game work: performance of the contract to use the game (LGPD, art. 7, V; GDPR, art. 6(1)(b)).
• To protect the game and people: preventing fraud, cheating, abuse and attacks, enforcing the terms of use and moderating: legitimate interest (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
• To improve the game: understanding errors, performance and how the tests are used, in aggregate wherever possible: legitimate interest.
• To answer your contact and handle requests about your data: preliminary procedures of the contract, legitimate interest and legal obligation.
• To meet legal obligations or authorities' orders, and to defend rights in proceedings: legal or regulatory obligation and the regular exercise of rights (LGPD, art. 7, II and VI; GDPR, art. 6(1)(c) and (f)).

We do not sell personal data, do not use it for advertising and do not make automated decisions that have legal effects on you. When a purpose depends on your consent, we will ask for it, and you can withdraw it at any time.

4. Who we share it with

We share data only with those who help us run the game, and only what is needed:

• Discord, which authenticates you and tells us your identifier and name;
• hosting and infrastructure providers that run the game server and this website and that keep the backups;
• other players, who see your character's name and appearance, the messages you send and your public actions in the world; we do not show your Discord account;
• authorities, when there is a legal obligation or a valid order.

5. International transfers

Some of the services above operate outside Brazil, including in the United States. When your data is transferred, we rely on the mechanisms in the LGPD (art. 33) and the GDPR, such as standard contractual clauses and the safeguards those providers offer.

6. How long we keep it

• Account and characters: while the account exists. Deleting a character erases, at once, the character, its items, bank, currency and the records tied to it. Deleting the account erases its data.
• Game and security logs: for as long as needed for moderation and security, as a rule up to 12 months, and longer if needed to look into abuse or meet a legal obligation.
• Backups: they are overwritten in regular cycles, and deleted data disappears from them within a few weeks.
• Contact messages: for as long as needed to handle the request.

If the test ends, we will delete or anonymize the data that is no longer needed.

7. Your rights

Under the LGPD (art. 18) and the GDPR, you may at any time and free of charge:

• confirm that we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• ask for anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data, and deletion of data processed with your consent;
• ask for portability of your data, where applicable;
• know which entities we share your data with;
• withdraw consent, where processing is based on it, and object to processing based on legitimate interest;
• ask for restriction of processing (GDPR) and review of automated decisions;
• lodge a complaint with Brazil's National Data Protection Authority (ANPD) or, if you are in the European Union, with the data protection authority of your country.

To exercise any right, write to hello@playoddside.com. We may ask for information to confirm who you are, and we will answer within 15 days, as the LGPD provides, or within one month, as the GDPR provides.

8. Children and teenagers

The game is not aimed at children under 13 and should not be used by them. If you are between 13 and 17, you need a guardian's permission (see the terms of use), and your data is processed in your best interest (LGPD, art. 14). If we find we collected a child's data without the due permission, we will delete it.

9. Security

We adopt proportionate technical and organizational measures, such as protected connections for sign-in, restricted access to the servers, backups and limits against abuse. No system is completely secure: if an incident could cause relevant risk or harm, we will tell you and the ANPD, as the law requires.

10. Changes to this policy

We will update this policy when the game or the processing of data changes. The update date is at the top of the page, and relevant changes will be announced in the game or through another channel.

11. Contact

Questions, requests and complaints about privacy: hello@playoddside.com.