Privacy notice

This notice explains which data is used to confirm the purchase, maintain the two authorized accesses and protect the game against abuse.

Data and purpose

We receive from the checkout platform the email, purchase identifier and status, and the dates needed to confirm, maintain or revoke access to the game. The current offer uses Hotmart. At login, you provide the email and transaction code. We store the email and a cryptographic hash of the code, not the code in plain text. Technical information, such as cryptographic hashes of the IP address and email used in login attempts, helps limit abuse. The session uses a necessary cookie to maintain access.

Payment data is processed by the checkout platform, not by the game. The game does not receive or store card data. Cloudflare hosts the access system and its database. Investigation progress remains in the browser’s local storage on the player’s device.

To measure the demo funnel, we record only aggregate counts for steps such as landing-page view, demo start and completion, and click-through to the sales page, together with language and campaign parameters (UTM/SCK/SRC) when present. These records do not receive email, name, purchase code, payment data, location or IP address and are deleted after 90 days. The browser avoids repeating the same step within the session using only the tab’s temporary storage.

Each purchase authorizes up to two devices through random identifiers in necessary cookies, without fingerprinting or location tracking. We store only hashes of these identifiers and invites. The device cookie lasts up to one year; deleting cookies may require support recovery. Invites are single-use and expire in one hour. Device hashes are kept while the purchase provides access; device records from revoked purchases and expired invites are removed during daily cleanup. We keep the date of the last device transfer to limit abuse; this record is replaced on the next transfer and removed after purchase revocation.

Retention and security

Expired sessions and expired technical login-attempt records are automatically removed during daily cleanup. Technical IDs for purchase events are removed after 90 days. Purchase and access records remain for as long as necessary to provide the game, handle purchase changes and comply with applicable obligations. Access uses HTTPS, protected sessions and verification of purchase notifications.

Your requests

To request information, correction or deletion of your data, write to arquivocruzado@gmail.com. We will confirm your identity before consulting or changing records. Data that must be kept for access, disputes or applicable obligations may be preserved for the necessary period.