PRIVACY POLICY

1. SCOPE

This short policy covers MODJO BRAWL at /games/modjo-brawl/. You can play as a guest, register with email + password, or sign in with Google. The full canonical text lives at artsmodjo.biz.id/privacy/.

2. DATA WE COLLECT

• Account: email, username (immutable), nickname, avatar, Terms-acceptance timestamp. Passwords are stored only as Argon2id hashes.
• Google sign-in (openid email profile only): verified email, stable Google subject ID, basic profile. Matched by subject ID, never by email alone.
• Guest: guest token + display name, single-use claim into an account.
• Gameplay: level, XP, rating, wins/losses, matches, rankings, inventory, rewards and claim records.
• Technical: SHA-256 hashes of IP and user-agent, security audit events. No ads, no trackers, no payment data.

3. COOKIES

Strictly-necessary only: identity/session cookie (HttpOnly/Secure/SameSite), CSRF token, guest cookie, and a short-lived OAuth binding cookie (am_oauth_bind). Blocking them signs you out or resets guest progress.

4. USE & SHARING

Data runs the game (sessions, progress, collection, rank), verifies rewards, and keeps play fair. Shared only with Google (when you use Google sign-in), hosting infrastructure, or when the law requires. Public screens show nicknames and stats only.

5. RETENTION & DELETION

Guests expire; accounts persist while active; deleted accounts are soft-deleted and anonymized. Request access, correction, or deletion via hello@artsmodjo.biz.id with your username or player handle.

6. CHILDREN & SECURITY

You must be at least 13 (confirmed at registration). Protected by HTTPS, hashed credentials, CSRF checks, PKCE Google flow, rate limits, and audit logs. Suspect compromise? Sign out and contact us immediately.