Privacy policy

1. Who is responsible

Kleos Online is run by Roove, the controller of the data described here. For any privacy matter, including reaching the person in charge of data protection, write to contato@kleosonline.com.br.

2. Data we keep

• Account: nickname, e-mail, language, your password in encrypted form (scrypt; never the password itself), the creation date and the last access date. Guests don’t give an e-mail: their account is tied to a code stored on the device.
• Game: character, chosen god and chariot, items, level, masteries, drachmas, glory, missions, campaign, friendships, match history and the recording of the moves (replay).
• Access: the session codes of each signed-in device. The server keeps only a digest (hash) of them.
• Security: the IP address is kept for up to 10 minutes to limit repeated attempts to sign in, create an account or change the password.
• Device: the website and the game store in the browser or the app the access code, the chosen language (in a cookie) and preferences such as sound and music. The app also stores the game files so it can play without downloading everything again.
• App measurement: in the Android app, Google Analytics for Firebase measures how the game is used (app opens, matches started and finished with mode and result, account creation and game updates), with a random app identifier. Analytics does not use the device’s advertising ID and does not receive your e-mail or nickname.
• Ads in the app: the app shows Google AdMob rewarded ads, which you choose to watch in exchange for drachmas. AdMob may use the device’s advertising ID and device data to choose and measure ads, under Google’s privacy policy. Where the law requires it, the app asks for your consent first; on iPhone, the system asks whether the app may track. You can decline, reset the advertising ID or turn off personalization in the device settings and still get ads, just not personalized ones. The Kleos server only receives from Google the confirmation that the ad was watched, with a single-use code and no personal data.
• Notifications in the app: the app only sends notifications if you allow them when it asks. To deliver game notices, we keep a device identifier for notifications (the push token), linked to your account and its language, and delete it when you sign out. You can turn notifications off at any time in the device settings.
• Website measurement: Google Analytics measures visits to the website (pages viewed, where visitors came from, clicks on Play). Measurement cookies (_ga) are only used if you accept them in the notice; otherwise only anonymous, cookieless signals are sent.

3. What we use it for

• Creating and keeping your account and progress, and letting you sign in on other devices (performance of contract, LGPD art. 7, V).
• Running matches, rankings, friendships and missions (performance of contract).
• Sending account e-mails: e-mail confirmation and password recovery. We don’t send marketing.
• Protecting the game and players against abuse, cheating and account takeover (legitimate interest, art. 7, IX).
• Understanding how the app is used, to improve the game (legitimate interest, art. 7, IX).
• Sending game notices in the app, such as events and news, if you allow notifications (consent, art. 7, I).
• Measuring website use, when you accept measurement cookies (consent, art. 7, I). You can refuse without losing anything in the game.

4. What other players see

Your nickname, god, level, medal, glory and match results are shown to other players in matches, rankings and friend lists. Your e-mail is never shown to anyone.

5. Who data is shared with

We don’t sell or rent personal data. We use providers that process data on our behalf, only to make the game work:

• Server and database hosting (DigitalOcean, in the United States).
• Sending account e-mails (an e-mail delivery provider).
• Google Analytics and Firebase (Google), only for the website and app measurement described above.
• Google AdMob (Google), for the rewarded ads in the app described above.
• Expo (a notification delivery service), which passes the app notifications on to Google (Android) and Apple (iPhone), which deliver them to the device.
• Google Play and the App Store, which distribute the app and follow their own privacy policies.

6. International transfer

Because hosting is in the United States, data is stored outside Brazil. This is done to perform our contract with you (LGPD art. 33, IX) and with providers that adopt adequate security measures.

7. How long

Data is kept while the account exists. When you delete the account, we immediately erase the account, character, items, missions, friendships and sessions. Matches you played remain in other players’ history, with nothing that identifies you. Database backups are replaced periodically and stop containing your data in that cycle.

8. Your rights

Under the LGPD (art. 18), you may ask at any time for: confirmation that we process your data, access, correction, portability, deletion, information about who we share it with and withdrawal of consent. Write to contato@kleosonline.com.br from your account’s e-mail; we reply within 15 days.

You can change your language and password in My account yourself and delete the whole account on the Delete account page or in the game, under Account. You may also complain to Brazil’s National Data Protection Authority (ANPD).

9. Children

Kleos Online is not directed at children under 13. If you know of an account belonging to a child under 13, write to contato@kleosonline.com.br and we will delete it.

10. Security

The connection to the website, the game and the app is always encrypted (HTTPS). Passwords and access codes are kept on the server only as digests (hash), and database access is restricted.

11. Changes to this policy

When this policy changes, the date at the top changes too. Important changes will be announced on the website or in the game.