IdleOTSOLD WORLD. NEW RHYTHM.Privacy Policy
How IdleOTS handles account information, social sign-in, game progress and privacy requests.
This policy covers IdleOTS at idleots.net and its official test and information subdomains. IdleOTS is currently an alpha game. Features become available gradually; an optional sign-in provider is used only when you choose it and it is offered in the game.
1. Who is responsible
The data controller is Grupa Kavarito Sp. z o.o., al. Jana Pawła II 27, 00-867 Warszawa, Poland. NIP: 5272889906. KRS: 0000781212.
For privacy questions, access requests or account deletion, contact contact@idleots.net. You may also write to the postal address above, marked IdleOTS privacy.
2. Information we process
We receive information you enter, information generated while you play, and limited identity information from an optional sign-in provider you choose.
- Accounts: account identifier, character name, world, chosen character appearance, registration time, accepted terms and, where used, email address and hashed credentials for traditional sign-in.
- Game activity: character progress, equipment, inventory, quests, training, trading, coin and reward records, messages, friend lists and other game actions.
- Security: connection and request information, session identifiers, authentication attempts, and pseudonymous network and browser signals used to prevent abuse of referrals and accounts.
- Support: information you include in correspondence or a privacy request. Please do not send passwords, recovery secrets or unnecessary identity documents.
4. Why we use information
We use account and game information to provide the service you request, authenticate you, save progress and operate multiplayer features. This is based on performance of our agreement with you, Article 6(1)(b) GDPR.
We protect the service, prevent cheating and referral abuse, resolve disputes and answer support messages on the basis of our legitimate interests, Article 6(1)(f) GDPR. Network and browser comparisons can automatically flag referrals and withhold rewards. You can ask us to review a flag at contact@idleots.net.
We process information required to fulfil applicable legal obligations under Article 6(1)(c) GDPR. If a separate optional activity requires consent, we request it for that purpose and you may withdraw it. Accepting game terms is not blanket consent to marketing. Real-money payments are not enabled in the current alpha; test coins do not represent a cash balance.
5. What other players can see
Your character name and public game information, including world, level, skills, appearance, rankings and public listings, can be visible to other players. Messages you post to a public channel are visible to its audience. Private messages are provided to the participants and may be accessed where necessary to investigate abuse or support a request.
Your sign-in email, authentication identifiers and credentials are not part of public player profiles. Avoid posting personal information in names, descriptions or chat.
6. Service providers and international processing
We use Cloudflare for hosting, network delivery, database storage and security. Selected authentication providers handle the sign-in you initiate. Information may also be disclosed to authorised service personnel or authorities where necessary and lawful. We do not sell player personal data.
These providers operate international infrastructure, so relevant processing may take place outside the European Economic Area. Where required, transfers must use applicable safeguards such as adequacy decisions or standard contractual clauses. Contact us for information about safeguards relevant to your data.
7. Cookies, browser storage and retention
Technical cookies support sessions, the return from provider sign-in and account security. Game preferences may be stored in your browser. Session cookies can last up to 30 days; the referral security browser cookie can last up to 180 days. Short-lived OAuth correlation and registration grants expire after 10 minutes each. Expired authentication records are cleaned up in bounded maintenance during service use.
We retain account and game data while your account is provided, until deletion or until an alpha reset. Security and transaction records are kept only as necessary for abuse investigations, disputes and applicable legal obligations. Copies in backups may remain until the relevant backup is rotated and are not used to resume an account you have asked us to delete.
The current game does not use advertising or marketing analytics trackers. Your selected identity provider may use its own cookies on its own pages. Blocking technical cookies can prevent sign-in or security features from working.
8. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
Email contact@idleots.net. We respond without undue delay, normally within one month. If the law allows an extension because of complexity or the number of requests, we explain it within that initial month. We may need proportionate information to verify that a request concerns your account.
You can complain to the President of the Polish Personal Data Protection Office, UODO, or another competent supervisory authority. Privacy requests are normally free.
9. Information requirements and updates
Information needed to identify an account and save a character is required to provide those features. Optional information can be omitted. We do not knowingly seek unnecessary information about children; contact us if you believe a child's data needs attention.
We update this policy when data practices change, including before enabling new payment or authentication features that require further disclosures. The current version and date are shown on this page.
3. Google and Facebook sign-in
When you choose Google sign-in, we use your provider-specific account identifier and verified email to authenticate you. Basic profile information may be returned with the identity response. You choose your public character name separately. We do not receive your Google password or request access to Gmail, Drive or your contacts.
Facebook sign-in, when offered, uses an app-specific user identifier and the basic profile and email information you allow Facebook to share. It does not grant us permission to publish posts or manage your Facebook pages. Facebook may not provide an email address; any additional registration step will be shown to you.
A matching email address alone does not automatically connect a provider to an existing game account. Provider sign-in tokens are used for authentication; they are not displayed in player profiles. Google and Meta also process information under their own policies.