This policy explains what data the game Fortaleza Final (fortalezafinal.com.br) collects, why, who we share it with and how you can exercise your rights, in line with Brazil's General Data Protection Law (Law 13,709/2018, “LGPD”). We collect the minimum needed for the game to work. The Portuguese version prevails in case of discrepancy.
1. Who we are
Fortaleza Final is an independent real-time strategy game made in Brazil and played in the browser. The game's owner is the controller of the data described here. See section 11 for how to reach us.
2. Data we collect
If you create an account
- Sign-up: username, display name and email. Your password is never stored: we keep only a cryptographic hash (bcrypt) that cannot be reversed.
- Game progress: level and XP, missions, campaign, chosen look (paints, emblems, skins, items), statistics (matches, wins, losses, kills), ranked points and seasons.
- Social: friends, friend requests and room invites, clan and referrals (who joined through your invite link).
- Rewards and abuse prevention: coded device and network identifiers linked to the account, plus activity records used to validate referrals. They do not prove that someone follows a social media profile.
- Saved match: a copy of your ongoing match so you can resume it.
If you buy skins or Pedritas
- We keep what was purchased, the Mercado Pago payment ID, the amount, your Pedrita balance and the history of top-ups and purchases.
- Payments are processed by Mercado Pago. Card details are typed into Mercado Pago's own secure form and never pass through the game or reach us. Pix codes are generated by Mercado Pago. We may send Mercado Pago your email and username to identify the payment.
Records from the former guest mode
- Guest mode has been disabled. Previously, to limit guest matches, we created a non-reversible code (hash) from your IP address and browser. The IP itself is not stored. The code is deleted after 60 days of inactivity.
From every player
- Usage statistics: anonymous visit and match records with a random identifier created on your device, whether it is a phone, the game mode and the visit source (for example, a promotional link).
- Crash reports: when the game closes unexpectedly we send technical data (browser, screen size, memory, graphics quality, last error message and match state) to fix the problem.
- Entry funnel: before and after login, we record registration screens, attempts, error categories, tutorial steps and the first match. Random identifiers and protected browser/network codes connect these steps and limit abuse. This funnel does not record form contents, passwords, typed email addresses or raw error messages. The dashboard is private.
- Support: when you use the Support button we receive your in-game name, email (if provided), your message and device technical data.
- Multiplayer: your name, emblem and look are visible to other players in the room. Chat messages go through the room host's device and are not stored on our server. In general chat, messages are stored on the server, linked to the account, together with moderation and suspension records.
- On your device: the game uses your browser's local storage for your session, preferences (language, sound, quality), guest progress and saved match. You can erase this data by clearing the site's data in your browser. We also use a signed device identification cookie, lasting up to one year, for reward abuse prevention.
3. How we use it
- To run the game: login, saving progress, online matches, ranked, friends and clans (performance of the service you requested).
- To deliver what you bought and meet legal and tax obligations related to payments (contract and legal obligation).
- To limit guest-match abuse and prevent fraud and cheating (legitimate interest).
- To understand how many people play, fix bugs and improve the game (legitimate interest, using anonymous or technical data).
- To answer support messages and send important account notices. We don't send spam or sell your email.
4. Who we share it with
We don't sell your data. We use these providers to run the game, each under its own privacy policy:
- Supabase: database and online-mode server (accounts, progress, rooms).
- Vercel: hosting for the website and the payment server.
- Mercado Pago: Pix and card processing.
- Google: ads (Google AdSense) and web fonts (Google Fonts).
- FormSubmit: email delivery of support messages.
- jsDelivr and cdnjs: delivery of the game's libraries (such as the 3D engine).
Some of these services are located outside Brazil; data is transferred to provide the service, as allowed by the LGPD. We may also disclose data when required by law or court order.
5. Ads and cookies
The site shows Google AdSense ads. Google and its partners may use cookies and identifiers to show ads based on your visits to this and other sites. You can turn off personalization at adssettings.google.com and learn how Google uses data at policies.google.com/technologies/partner-sites. The game itself doesn't use its own tracking cookies; it uses the local storage described above.
6. Retention
- Account and progress: while the account exists. When you ask for deletion we erase account data, except what the law requires us to keep.
- Purchase records: for the period required by tax and consumer law.
- Guest code: up to 60 days of inactivity.
- Statistics, crash reports and support: as long as needed for analysis and support.
7. Your rights
Under the LGPD (art. 18) you may request: confirmation that we process your data, access, correction, deletion of your account and data, portability, information about sharing and withdrawal of consent. You can change your email anytime on your account screen. For other requests, use the channel in section 11. We reply within the legal deadline and may ask you to confirm the account is yours. You may also file a complaint with Brazil's data protection authority (ANPD).
8. Children and teens
Fortaleza Final is a strategy game for a general audience. We don't ask for ID, address, phone number or date of birth. Players under 18 should play with their parents' or guardians' knowledge, and purchases require a guardian's permission. If you are a guardian and want a child's data removed, contact us through section 11.
9. Security
We use encrypted connections (HTTPS), store passwords only as hashes, restrict database access with security rules and process payments outside the game through Mercado Pago. No system is 100% secure; if an incident puts you at risk we will notify you as required by the LGPD.
10. Changes to this policy
We may update this policy as the game changes. The date at the top shows the current version; important changes will be announced in the game.
11. Contact
For privacy questions or to exercise your rights, open the game and tap ⚙ Settings › Help › Support, choose “Account / login” and write your request (include an email so we can reply).
General chat and community rewards
General chat messages and your player name are visible to other accounts. Automated moderation blocks offensive language and suspends chat access. Moderator emanuel can remove messages and review suspensions through support.
To prevent repeated claims, we use a device identification cookie (ff_device) and protected codes derived from the network/IP address. Reward tables do not store raw IP addresses. We also record active play time and play dates to validate referrals. Rewards are limited by account, device and network; people sharing a network may not qualify for the same bonus. The Instagram bonus relies on the player's confirmation after opening the profile and does not automatically verify following. Reward records are retained to prevent repeat claims; contact support for questions or deletion requests.