Personal data processing policy

1. Data controller

Auron Tale Games, tax ID C.C. 1088316772, domiciled at Calle 100 #16A-72, Pereira, Colombia. Email for queries, claims and exercising your rights: sam94c@gmail.com.

2. Data we process

• Account data: username, email, preferred language and password (stored only as a hash, never in readable form). Profile picture where the feature is available.
• Game data: matches, moves, results, statistics, ELO points and rank.
• Session and security data: session identifier (stored as a hash), platform, browser or device used and usage dates. Your IP address is processed to limit abuse and protect the service; in contact forms we only store a hash of the IP.
• Mobile app data: if you enable notifications, your device's push notification token.
• Contact data: if you write to us or join the waitlist, your name, email, subject and message.
• We do not request sensitive data (health, racial origin, political or religious orientation, biometric data, among others).

3. Purposes

• Creating and managing your account and authenticating you.
• Providing the game service, saving your history and computing statistics and ELO.
• Ensuring security and preventing fraud, cheating and abuse.
• Sending you service communications, such as email verification, password reset and match notifications.
• Handling your queries, requests, complaints and claims.
• Improving the service using aggregated information that does not identify you.
• Complying with legal obligations and responding to requests from competent authorities.
• Sending you game news only if you expressly and separately authorize it, such as when joining the waitlist. You can withdraw that authorization at any time.

4. Authorization

We process your data with your prior, express and informed authorization (Law 1581 of 2012, art. 9), which you give by accepting this policy when creating your account. We keep proof of that authorization. We do not need authorization in cases the law exempts, for example when a competent authority requires it.

5. Your rights as a data subject

Under Article 8 of Law 1581 of 2012, you may:

• Know, update and correct your data.
• Request proof of the authorization you gave.
• Be informed about how your data has been used.
• File complaints with the SIC for violations of the law.
• Revoke the authorization and request deletion of your data when legal principles and guarantees are not respected or there is no legal or contractual duty to keep it.
• Access your personal data free of charge.

6. How to exercise your rights

Write to us at sam94c@gmail.com stating your username, your sign-up email and what you request. We may ask for additional information to verify your identity.

We will answer queries within a maximum of 10 business days, extendable by 5 more business days if we tell you why (art. 14). Claims for correction, update or deletion will be resolved within a maximum of 15 business days, extendable by 8 more business days (art. 15).

You may only go to the SIC after exhausting this procedure with us (art. 16). For now, account deletion and data edits are not done from the app but through this channel.

7. Who we share data with

We do not sell your personal data. We use providers that process data on our behalf (processors) solely to provide the service:

• Infrastructure, hosting and database.
• Cloudflare, for anti-bot verification (Turnstile) and network protection, when active.
• Cloudinary, to store profile pictures, when the feature is active.
• Expo, to send push notifications to the mobile app.
• Google Fonts, which serves the site's typefaces and receives your IP address when loading them.

8. International transmission and transfer

Some of these providers may store or process data outside Colombia. By accepting this policy you expressly authorize that transmission or transfer. We require providers to apply adequate security and confidentiality measures, in line with Article 26 of Law 1581 of 2012 and SIC instructions.

9. Cookies and local storage

• Session cookies (HttpOnly): used only to keep you signed in. They are necessary for the service to work and cannot be read by the page's code.
• Browser local storage: stores your preferred language.
• We use no advertising cookies or third-party analytics tools. The anti-bot verification service may use its own technical signals to tell people from programs.

10. Security

We apply reasonable technical and organizational measures: passwords stored as hashes, session tokens stored as hashes and rotated, HttpOnly cookies, request limits and anti-bot verification. No measure is infallible. If an incident affecting your data occurs, we will handle it and inform the SIC and affected data subjects as required by regulation.

11. Retention

We keep your data while your account is active and afterwards only for as long as needed for the purposes described and to meet legal obligations. When you request deletion and there is no legal duty to keep the data, we will delete or anonymize it.

12. Minors

The service is not directed at children under 14. Teenagers aged 14 to 17 may only sign up with the authorization of their parents or legal guardian, and the processing of their data respects the best interests of the minor and their prevailing rights (Law 1581 of 2012, art. 7, and Law 1098 of 2006). If we detect a minor's data without the required authorization, we will delete it.

13. National Database Registry

Where the law requires it, we will register the databases containing personal data in the National Database Registry (RNBD) administered by the SIC.

14. Effective date and changes

This policy applies from the update date shown above. If we change it substantially we will let you know and, where the law requires, ask for your authorization again.