Privacy Policy — DDRO (working title — swap on naming decision)
DRAFT — Cowork, 12 Jul 2026. Not yet published. Review by a qualified lawyer before public launch. Written to match what the code ACTUALLY does as of v0.14.10 — if implementation changes, this document must change in the same doc-sync pass (standing norm).
Last updated: [DATE]
1. Who we are
DDRO is a browser-based game operated by [OPERATOR NAME / Rj's legal name or entity — decide at launch]. Contact: [CONTACT EMAIL].
2. What we collect, and why
| Data | Source | Why | Legal basis |
|---|---|---|---|
| Email address, name, sign-in identity | Our auth provider (Kinde) at signup | Account access, PvP email digest | Contract (running the game you asked for) |
| Game data: champions, builds, plans, items, duels, ratings, progress | Your play | The game itself; your build fights others asynchronously | Contract |
| Gameplay analytics events (e.g., fights fought, features used), keyed to a pseudonymous account id | Server-side + in-browser (PostHog, EU region) | Understanding what's fun, broken, or ignored — balancing and product decisions | Legitimate interest |
| Error reports (stack traces, request context) | Sentry | Fixing crashes | Legitimate interest |
| Transactional email delivery data | Resend | Sending the PvP digest / notifications you're due | Contract |
| User-uploaded images (custom avatars) | You, if you upload one | Displaying your chosen avatar to other players — only after a moderator approves it | Contract (you asked for it) |
User-uploaded images (custom avatars). Uploading is optional. Images are re-encoded server-side and metadata is stripped (photo EXIF — e.g. GPS location — never reaches storage). They are stored in a private Vercel Blob store and are visible to no one but you and moderators until a moderator approves them (pre-moderation); only approved images render to other players. Deleting your account deletes your uploaded images and their stored files (clause 6); a moderation rejection or revert also deletes the stored files.
Deliberate choices, reflected in code: our analytics person profiles carry no email property (targeting and identification happen by pseudonymous id only), and our analytics live in PostHog's EU data residency. We do not sell data, run ads, or share data with anyone except the processors listed above, who act on our instructions.
3. Cookies and local storage
We keep this deliberately minimal — there is no cookie banner because there is nothing to consent to:
- Auth session cookies (our auth provider's, httpOnly): strictly necessary to keep you signed in. Consent-exempt.
- Analytics is cookieless by configuration: our in-browser analytics runs with in-memory persistence only — no analytics cookie, no localStorage/sessionStorage entries. Events key to your pseudonymous account id (never your email). Some ad-blockers block it entirely — the game works fine anyway (and we knew you'd do that).
- Local storage holds only preferences you set yourself (e.g., replay speed). No tracking, no identifiers.
If we ever want marketing cookies or richer in-browser persistence, a consent prompt ships first and this section changes.
4. Where your data lives
Game database: MongoDB Atlas. Hosting: Vercel. Analytics: PostHog (EU). Errors: Sentry. Email: Resend. Auth: Kinde. Each processes data under its own data-processing terms; we configure them toward EU processing where the option exists.
5. How long we keep it
Account and game data: while your account exists. Analytics and error data: per-tool retention windows (typically 12 months or less). Backups roll off on the infrastructure's schedule.
6. Deleting your account — what actually happens
Settings → Delete account. This permanently deletes your user record, champions, inventory, duels, notifications and uploaded avatar images (database rows in one transaction; the stored image files immediately after — any stragglers are unreachable and swept per our runbook). We retain a one-way hash of your sign-in id (a "tombstone") whose only purpose is preventing deleted-account re-grant abuse — it cannot be reversed into your identity. Erasure from the auth provider and analytics follows our internal runbook. If any step needs manual action, we complete it within 30 days of request.
7. Your rights
Depending on where you live (GDPR and similar): access, correction, deletion, portability, restriction, objection, and complaint to your data protection authority. Write to [CONTACT EMAIL]; we'll answer within 30 days. Deleting in-app (clause 6) is the fastest path for erasure.
8. Children
The Game is not directed at children under 13 (or your country's digital consent age). We don't knowingly collect their data; if you believe a child is playing, contact us and we'll delete the account.
9. Changes
Material changes to this policy will be announced in-game or in community channels before they take effect.