Privacy Policy

Developer: Christian Bonafena. Country/jurisdiction: Indonesia. Contact: gugubabastudio@gmail.com.

Effective [REQUIRED: publication date]. Version 2026-09-07.1. This policy covers Project Rezor, its game services, and this website. Rezor is intended for people aged 13 and older; it is not directed to children under 13.

Accounts and authentication

Online play creates a guest account using random device/profile and account identifiers. These are app-generated identifiers, not advertising IDs. Your installation stores its authentication secret in local application storage; our database stores a keyed digest used to check it. Session tokens and short-lived world tickets authenticate connections. Never send device secrets, session tokens or login codes in email or chat.

Email linking is optional. If you link or sign in with email, we process your email address and send a six-digit code through Resend. Codes expire after ten minutes. The database stores a digest of the code, attempt counts, timestamps and source IP address for account security and abuse prevention. Expired login challenge records are removed 24 hours after expiry. Resend necessarily processes the recipient and message, including the delivered code.

Your character and activity

We store character names, appearance/profile, level, progress, inventory, equipment, currency, friends, trades and gameplay state to operate and recover your game. Character names, character identifiers, profile details and leaderboard progress are visible to other players and on public profile/leaderboard pages. Your friend list is private to your account. Party membership and presence support gameplay. Offline saves and remembered profiles remain on your device until removed; uninstall behavior depends on your device and its backup settings.

Chat and safety

We store message text, sender, timestamp, channel and authorized audience for 30 days. Local, server and party messages are visible to their audiences; private messages are restricted to participants and may be reviewed by authorized staff when reported. Reports, report explanations, appeals, policy acceptance, blocks, staff decisions and relevant evidence support moderation. Reported evidence remains while a case or appeal is open and for 90 days after closure; resolving an appeal restarts that period. Minimal active sanctions remain as needed to enforce them. Audit records follow the corresponding case/sanction retention. Account deletion removes ordinary chat, acceptance and blocks; restricted case evidence follows these exceptions.

Security and operational records

Servers and infrastructure process IP addresses and limited operational/security records to deliver the service, diagnose failures and prevent abuse. Security logs are retained for no more than 30 days. We exclude authentication secrets, email contents and chat bodies from general application logs. Database backups expire within seven days. After a restore, expired data and outstanding deletions are processed before service resumes. We do not use IP addresses to build advertising profiles.

Gems and transactions

Real-money Gem checkout is currently disabled. We already store in-game Gem balance changes and trade records for consistency and abuse investigation. Historical transaction payloads can contain account/character identifiers and game-state data; removing names does not make these records anonymous. Retention: [REQUIRED: justified retention period and deletion/minimization procedure for immutable trade and Gem records]. We will update this policy and store declarations before enabling purchases. Purchase functionality would process store/provider transaction references, products, amounts and purchase/refund history; the store handles payment details.

Providers and transfers

Hosting: Hostinger, region Jakarta, Indonesia; this infrastructure processes stored game data and network traffic. Email delivery: Resend, for login and deletion notifications. Support mailbox: Gmail, for support correspondence. These providers may process data in other countries according to their agreements and infrastructure. We may disclose information when required by applicable law or necessary to address abuse or security incidents. We do not sell personal data or run ads in the current game.

Access, deletion and contact

Request access or deletion by contacting gugubabastudio@gmail.com; see account deletion instructions. We verify ownership and do not disclose another person's data or confidential moderation material. In-app deletion is available to guests and linked accounts under Settings → Account & Login. Deletion is scheduled after a 48-hour cancellation window; signing in does not cancel it. We remove ordinary account data, character progress and login credentials, subject to the transaction, safety and backup exceptions above. Minimal account/character keys can remain attached to retained records.

Closed support requests and correspondence are removed after 90 days, subject to any specifically documented legal retention obligation. We aim to acknowledge requests within seven days and complete verified access requests within 30 days, or sooner where applicable law requires. If verification or an applicable exception affects your request, we explain this. Material changes will be reflected here with a new effective date.