Privacy and personal data policy
This policy explains which personal data G-Dungeons processes, why, and how to exercise your rights. It was drafted under Colombian Law 1581 of 2012 and its regulations [REVISAR with a lawyer]. If this translation and the Spanish version differ, the Spanish version prevails [REVISAR].
1. Data controller
J Labs [REVISAR: legal name, tax id (NIT) and address], Colombia. Contact for anything about your data: soporte.gdungeons@gmail.com [REVISAR: final email].
2. What data we process
| Data | Purpose |
|---|---|
| Email address | Identify your account, send you the verification and password-recovery codes, and important service notices. We do not send advertising. |
| Keeper name | Show you to other players in the game: map, alliances, chat, Arena rankings and Monolith War. |
| Password | Stored only in irreversible hashed form; nobody can read it. |
| Country and age range | Check that you are allowed to register and, in the Monolith War, assign your region's schedule. We only store whether you are an adult or between 13 and 17; we do not store your exact age or date of birth. |
| Acceptance of the terms and, for minors, the guardian-authorisation statement | Keep a record of the accepted version and of the authorisation. |
| Game progress | Your dungeon, creatures, resources, orders, battles and alliances; and, since Beta 4.0, your leaders (level, stars, mastery and ascension), their skills, your equipment and its refining, the Sovereign Vault, your cards and Album, your camps in the special zones, your duels, ELO and ranking in the Arena, and your participation in the Nexus and the Monolith War. |
| Chat messages and alliance names | Show them to the players they are addressed to and moderate content. |
| Atsios wallet and ledger | Balance, debt and every movement (date, amount, reason), so the balance always reconciles, to handle claims and to prevent duplication. |
| Purchases | Account, package, platform, provider, status, amount and currency, the provider's order id and date. Of the Google Play receipt we keep only a cryptographic digest (SHA-256), never the receipt itself. Used to credit Atsios, handle refunds, prevent fraud and keep the accounts. |
| Account activity log | Sign-ins, verifications, password changes and requests, for security and support. |
| IP address | Appears in the server's technical logs and is used, in a summarised and irreversible form, to limit abusive attempts. |
| Technical metrics | Response times and daily aggregated counts to keep the server performing. They do not include your IP address. |
| Game error reports (only if you turn them on) | Off by default; turned on in Settings → Account → Privacy. If the game fails, when the next session starts it sends the kind of error, its first line without e-mails, paths or long numbers, where in the code it happened, the version and the platform. It stays in the server's technical logs, not in the database, and is used only to fix failures. Turning it off deletes the pending report from the device. |
We do not ask for your real name, address, phone number or documents. We do not store card numbers, bank details or payer data: the payment provider handles them under its own policy. We do not use advertising, commercial profiling or third-party analytics or advertising tools. The web version does not use tracking cookies; it only stores in your browser what is needed to keep your session and preferences.
3. Minors
- Children under 13 are not allowed. If we learn that an account belongs to a child under 13, we delete it together with its data.
- People aged 13 to 17 may only register and make purchases with the authorisation of their parent or legal guardian, declared when creating the account. We process their data respecting their best interests and fundamental rights, and only so that they can play.
- The legal guardian may at any time ask to know the minor's data, correct it, withdraw the authorisation or request deletion of the account by writing to the contact email. We may ask for reasonable proof that the person writing is the guardian.
- We recommend that minors do not share personal data in keeper names, alliances or messages.
4. Who we share data with
We do not sell or transfer your data. It is only processed, on our behalf or as payment processors, by the providers needed to run the service:
- DigitalOcean (United States): hosting of the server and the database.
- Resend (United States): sending verification and recovery emails. It receives your email address and the message content.
- Google Play: processes payments made on Android. It tells us the purchase status and the order id.
- Wompi (Bancolombia) and Mercado Pago: process payments made on PC. They tell us the payment status and the order id.
Each payment provider processes the payer's data under its own privacy policy. This means some data is stored and processed outside Colombia; by registering you authorise that transfer for the purposes described. We may also hand over data when a competent authority requires it under the law.
5. How long we keep it
- Account data and progress are kept while the account exists.
- Verification and recovery codes expire after 15 minutes, and email content is deleted from our queue after sending.
- Technical notifications sent by payment providers are deleted after 30 days.
- The purchase records and the Atsios ledger are kept for [REVISAR: accounting and tax period, proposed 5 years].
- When you ask to delete your account, we delete your email, keeper name, password, progress, leaders, equipment, Vault, cards, camps, Arena and Nexus data and messages within 15 business days at most [REVISAR]. Purchase records and the Atsios ledger are not deleted but anonymised (unlinked from your email and name) and kept for the period above, because the law requires us to keep accounting records. Encrypted backups may remain for a limited time until they rotate [REVISAR: backup rotation period].
6. Your rights
You can know, update and correct your data; ask for proof of the authorisation you gave; know how we have used it; revoke the authorisation and ask for your data to be deleted; and access it free of charge. To exercise them:
- In the game, under "My account", you can download a copy of your data (including leaders, skills, equipment, Vault, cards, camps, Arena, Nexus, wallet and purchases), sign out of all sessions and request account deletion.
- By email, writing to the contact address from your account's email. We answer queries within 10 business days and complaints within 15 business days at most.
- If you no longer have the game installed, you can request account deletion by email [REVISAR: web deletion-request link required by Google Play].
If you live in Colombia and believe we did not handle your request, you may go to the Superintendencia de Industria y Comercio after complaining to us. If you live in another country, you may also exercise the rights your local law grants you by writing to the same address.
7. Security
The connection to the game is encrypted. Passwords and codes are stored as hashes, the email queue is encrypted, payment receipts are stored as a cryptographic digest and the database is not reachable from the Internet. No system is infallible: if an incident affects your data, we will tell you and report it to the authority where required.
8. Changes to this policy
If we change this policy we will publish the new version here with its date. If the change affects the purposes or the data processed, we will ask you to accept it again.