Privacy Policy

1. Controller and data protection officer

The controller of your data is the Pocket World Online team. Our data protection officer answers on the Support page, https://pocketworldonline.com/en/support/ (category "Account").

2. Data we collect

We only collect what the Game needs to work, stay fair and stay safe:

• Account: email address, password (stored only as an argon2id hash, never as text), creation date, PokéCoin balance and VIP time.
• Beta waitlist: email address, Discord username (optional), language and platform.
• Website: IP address, browser (user agent) and time of each session you start.
• Devices: each browser and game install that signs in to your account, with its last IP address, an automatic label (browser and system, such as "Chrome - macOS", or the game's system), the name you or the game give it, when it was first and last used and whether it is trusted for two-factor sign-in. You can see, rename and sign out each one on your account page.
• Two-factor sign-in, if you turn it on: the authenticator app's secret, stored encrypted, and your recovery codes, stored only as hashes.
• Game: your characters, progress, items and Pokémon; the IP address, sign-in and sign-out times, operating system and client version of each session; and hourly counts of your activity (for example steps, catches, move use and reaction times).
• Cheat protection (Windows client): every 5 minutes, how many keys and clicks reached the Game from another program; which programs running on your computer opened the Game's memory, sent as the file names of up to 8 of them with the permissions they held and whether they were digitally signed; and whether a program from a list of known cheating tools was running. To check that list, the client turns the names of running programs and the titles and class names of open windows into hashes (one-way fingerprints) on your computer and compares them there; only the tools that match are sent, never the list of programs on your computer or your window titles.
• Error reports: when the client freezes or crashes, the version, operating system, character name, the end of the client log (up to 256 KB), a copy of the Game process's memory on Windows (up to 16 MB) and your IP address.
• Reports: what you write when you report another player, with your IP address.
• Purchases and donations: nothing is sold for money yet, so we hold no payment data. We keep the history of your PokéCoins.
• Support: the messages you send us.

3. Why we use it and on what legal basis

• Creating and keeping your account, running the Game and delivering purchases: performance of a contract (LGPD, art. 7, V).
• Keeping access records (IP, date and time) for 6 months: legal obligation (Brazilian Internet Civil Framework, art. 15).
• Detecting bots and cheating, preventing fraud, protecting accounts and balancing the Game: legitimate interest (art. 7, IX), always with as little data as possible.
• Keeping tax records of purchases: legal obligation.
• Waitlist and optional announcements: consent, which you can withdraw at any time.

4. Automated decisions

An automatic system calculates a bot-suspicion score from activity and protection data. It can trigger an in-game presence check and, when a check is failed, a suspension in a weekly batch. You can ask for any such decision to be reviewed by a member of staff (LGPD, art. 20).

5. Who we share it with

We do not sell your data. We only share it with providers who process it on our behalf and under contract:

• Hosting of the Game servers and database (HypeHost), of monitoring (Hetzner) and of the website and downloads (Cloudflare).
• Sending email (Resend or another email provider).
• Bot protection on the website's forms (Cloudflare Turnstile).
• Backups, always encrypted.
• Payments: none yet, as nothing is sold for money; the payment processor will be named here before sales open.
• Authorities, when the law or a court order requires it.

6. International transfers

Some providers are outside Brazil. In those cases we rely on the safeguards in art. 33 of the LGPD, such as contractual clauses.

7. How long we keep it

• Account, characters and progress: for as long as the account exists.
• Game sessions and IP addresses, presence checks and the trade and economy log: 6 months.
• Devices, with their last IP address, browser label and name: until 6 months after their last use, or sooner when you sign the device out or delete the account. The IP address is replaced at every sign-in.
• Two-factor sign-in data: while it is on; deleted when you turn it off or delete the account.
• Hourly activity and cheat-protection data: 90 days. Suspicion score: 30 days.
• Player reports: 1 year. Moderation staff actions: 2 years. Sanction history: for as long as the account exists.
• Error reports: 30 days. Website sessions: up to 14 days. Server technical logs: up to 30 days.
• Purchases: for as long as tax law requires (usually 5 years).
• Waitlist: until the end of the closed beta, or sooner if you ask.

8. Cookies and browser storage

The website uses two essential cookies, which page scripts cannot read (HttpOnly): pw_session, which keeps you signed in (up to 14 days, ended after 12 hours without use), and pw_device, a random code that recognises this browser as one of your account's devices (365 days, renewed at each sign-in). With pw_device we email you when someone signs in from a new device, list the browser among your connected devices and, after you sign in with the two-factor code, trust it for "I lost my phone"; on its own it holds no personal data. A security code against request forgery is kept in the tab's memory and disappears when you close it. The bot-protection provider may set its own cookies on the website's forms. We use no advertising or audience-analytics cookies.

9. Your rights

Under the LGPD you can ask for: confirmation that we process your data, access to it, correction, anonymisation, blocking or deletion of what is unnecessary, portability, information about who we share it with, withdrawal of consent, objection to a processing and review of automated decisions.

Ask on the Support page, https://pocketworldonline.com/en/support/: open a ticket in the "Account" category while signed in, so we know the request comes from the account's owner. If you cannot sign in, open it there with your account's email address and we will confirm it by email. We answer within 15 days. When you delete your account, we delete or anonymise your data, except what the law requires us to keep (such as access and tax records) for the legal period.

You can also complain to Brazil's National Data Protection Authority (ANPD).

10. Children and teenagers

The Game is not meant for children under 13. If we learn that we collected data from a child without a guardian's consent, we will delete the account and the data.

11. Security

We use encrypted connections, hashed passwords, encrypted backups and restricted access to data. If an incident could cause you significant risk or harm, we will tell you and the ANPD.

12. Changes

We may update this policy. We will announce important changes on the website and by email before they apply.