Skip to content
TbxIdle

Legal

Privacy Policy

Last updated: 2026-09-10

This policy explains what TbxIdle collects, why, and what you can ask us to do about it. It is written to Brazil's General Data Protection Law (LGPD, Law 13.709/2018). The controller of your data is TbxIdle, and the way to reach us is an email to [email protected].

What we collect

  • Your account. A username, a password (stored only as a PBKDF2 hash; we never hold the password itself), and an email address if you give one. The email is optional and is used only for your account: we send a link to confirm it and, when you ask, a link to reset your password. Once confirmed, it is also given to our payment provider as the payer's email when you buy coins, so the purchase receipt reaches you. We never send marketing.
  • Your game data. Characters, levels, skills, items, gold, coins, friends, market offers, mail, coin transfers (who sent them, to which character, how many and when) and the settings your auto-pilot runs on.
  • Purchases. For each coin purchase: the pack, the amount, the payment identifier from our payment provider and whether it was paid. The payment provider is Mercado Pago: it receives the amount, your account's identifier and, if confirmed, your email. Card and Pix credentials are handled by it and never reach us.
  • Invites. If you signed up through an invite link, we store which account invited you and a one-way hash of the IP address the sign-up came from, to detect fraud.
  • Server logs. Ordinary technical logs, kept for a short period for operating and debugging the service. We never log passwords, password hashes or session tokens.

What we do not collect

  • No advertising or third-party tracking cookies. The site sets no cookie of its own.
  • Your session token is kept in your browser's local storage so you stay signed in; it is not a cookie and it is not sent anywhere but our own API.
  • Chat is not stored. The server keeps recent lines in memory and loses them on restart.

Cookies and local storage

This site sets no cookies at all; no advertising, no analytics, no consent banner to click away, because there is nothing to consent to. What we do use is your browser's own local storage, which is not a cookie: it is never sent with a request, no other site can read it, and clearing your browser data removes it. Three things are kept there:

  • your session token and account name, so you stay signed in;
  • an invite code, if you arrived through an invite link, until you register;
  • your own interface preferences; interface size, light effects, power saving. These never leave your browser and we never see them.

The game itself also caches its artwork (sprites, maps) in your browser so it does not download the same pictures twice. That cache holds pictures only, no personal data.

Why we may use it (legal bases)

  • Performing the contract; running your account, your characters and your purchases.
  • Legal obligation; keeping the records tax and consumer law require of a sale.
  • Legitimate interest; keeping the game secure and fair, which is why invite sign-ups carry a hashed IP.

Who else sees it

Our hosting provider (Amazon Web Services, in the São Paulo region) and our payment provider (Mercado Pago), each only to the extent needed to run the service. We do not sell your data and we do not share it for advertising. Your character names, levels and vocations are public inside the game; they appear in the highscores and in chat.

How long we keep it

Account and game data for as long as the account exists. Purchase records for as long as tax and consumer law require. Deleting a character removes it and its friendships; closing an account removes its data except records we are obliged to keep.

Your rights

Under the LGPD you may ask us to confirm what we hold, correct it, anonymise or delete it, tell you who we shared it with, or give you a portable copy. Email [email protected] and we will answer within the legal deadline. You may also complain to the ANPD.

Children

The Service is not intended for children under 13. If we learn we hold data from a child under 13, we delete it.

Changes

If this policy changes materially we will say so on this page and update the date above.