Privacy Policy

Project: Auto Territory · Developer type: Individual developer · Version 2.0 · Effective date: 20 October 2026

This policy explains what personal information we actually process when you use AUTO TERRITORY (the "Game") and its recharge (in-game purchase) service, why we process it, how long we keep it, who we share it with, and how you can exercise your rights. "Required items" are needed to provide the Game; "optional items" are collected only with your separate consent.

1. Controller and scope

Controller: Ren Ito (an individual developer; "we", "us"); address: 12-40-7 Nakacho, Kawaguchi-shi, Saitama 332-0022, Japan; email: correa19980@gmail.com.
This policy covers the web, H5 and native clients of the Game, the Game website, and the in-game recharge service.
The Game currently accepts top-ups only in USDT on the TRON network (TRC-20); it does not accept card or other fiat payments. If we add other payment methods, we will update this policy first.

2. Information we collect

2.1 Required items

The items below are necessary to provide the Game or the related feature. Without them that feature is unavailable (for example, you cannot enter the Game without confirming your birth year and month, and you cannot make purchases without binding an email or Google account).

Category	What it covers	Purpose	Retention
Account data	Account name, nickname, name tag, avatar id, one-way password hash, authenticator binding secret, bound email address; guest accounts use a device-generated credential whose hash is stored server-side	Registration, sign-in, account binding, saving progress, preventing account takeover, contacting you about account and order issues	While the account exists; deleted on account deletion
Google sign-in data	When you choose Continue with Google or bind a Google account, the `openid email profile` scopes provide a Google account identifier, email address, email-verification status, display name and profile image, subject to the data Google returns	Identify and sign in to your Game account, bind an identity, display account details, account recovery	While the account exists; deleted on unbinding or account deletion
Birth year and month	The birth year and month you confirm the first time you enter the Game after registering (pre-filled as 18 years before the current month; please change it to your real value); we do not collect the day of birth	Determine your age band to apply minor-protection rules: no purchases under 13, spending limits for minors. Never shown to other players	While the account exists; deleted on account deletion (the age confirmation recorded with an order is kept for the order retention period)
Billing country	Your billing country or region (pre-set from the Game language at registration, editable) and its change history	Decide the available payment currency and methods, the legal notices to show and the minor spending rules that apply; prevent cross-region price arbitrage	While the account exists; change history for 3 years
Recharge and order data	Order number, item, list price, discounts and recharge coupons, amount paid and currency, payment method, order status and times, records of in-game currency granted and reclaimed; the terms version accepted at order confirmation, consent to immediate delivery and waiver of the withdrawal right (EU/UK), the birth year-month confirmation before the first purchase and your age at that time; refund, statutory withdrawal, chargeback and dispute records; debt and offset records	Complete purchases and delivery, refunds and withdrawals, reconciliation, accounting and tax filing, handle disputes and chargebacks, meet legal obligations	10 years from the end of the order (or longer where the law requires)
USDT payment data	The deposit address assigned to your account, the payer's on-chain address, transaction hash, amount, block time and confirmation status; for a USDT refund, the receiving address you provide and we verify	Identify and confirm payments, handle under-, over- and late payments and refunds, reconciliation, sanctioned-address screening	Kept with its order for 10 years (the blockchain record itself is public and cannot be deleted; see section 5)
Security and risk data	A device-generated install ID; a device environment fingerprint (computed from graphics renderer, screen, time zone, language, font and similar traits; only a hash and bit mask are stored); automation or emulation signals; IP address and IP range (stored as keyed one-way digests) and the country and network operator number (ASN) inferred from them; device and IP-range digests at registration; risk assessment results, actions taken and links between accounts	Prevent account takeover, mass registration and abuse of promotions, card fraud and chargeback fraud; keep accounts and transactions secure	Risk events 3 years; account links 2 years; lists per their own expiry (e.g. IP 30 days, device 180 days); on account deletion account links are deleted and risk events keep only the conclusions needed for financial audit
Access logs	IP address, request time and outcome in the server gateway and security audit logs	Troubleshooting, defending against attacks, security audit	30 days
Device and usage statistics	Language, client type, anonymous device id, session id, event time, and minimal connection and error fields	Measure startup, login, lobby, matchmaking, match, reconnect and error flows and improve reliability	Raw events 90 days; de-identified daily aggregates kept long term
Match data	Queue and matchmaking records, parties, line-ups and formations, battle progress, results, settlements, rankings and replays	Run matches, produce records and replays, settle in-game assets and handle abnormal matches	While the account exists; on account deletion your own match records and match event log are deleted, and your nickname in other players' records and replays becomes "Deleted Player" with no avatar; replays per section 7
Social and chat	Friend relationships, party history, presence, direct messages and related reports or moderation records	Provide friends, parties and direct messages; word filtering, anti-spam and misconduct handling	Direct messages up to 90 days, inbox records up to 30 days; friendships, friend requests and block lists until removed, and removed in both directions on account deletion (you disappear from the other player's friend list)
In-game asset records	Gold and diamonds (paid and free recorded separately), hero and pet fragments, gacha, shop, mail, login rewards, dungeon and season reward records	Grant and deduct in-game assets correctly, handle duplicate requests, failed grants and settlement checks; compute statutory figures such as paid balances	While the account exists; on account deletion every balance (including paid diamonds and gold, and any amount held for you because it exceeded the cap) is forfeited and the forfeit is recorded; recharge-related entries for the order retention period
Local preferences	Language, audio, quality, camera, presence, tutorial progress, read notices and document-consent versions	Remember your choices; some signed-in settings sync to the account, while guest settings remain on the device	On your device until you clear site data; synced settings follow the account

2.2 Optional items (separate consent)

Category	What it covers	Purpose	Retention
Gender	"Male" or "Female". The default is "Prefer not to say", in which case we store no gender	Show it to other players on your profile card	Until you switch back to "Prefer not to say" (which withdraws consent and deletes it immediately) or delete your account

When you choose "Male" or "Female", the Game asks for your separate consent to this processing. Declining does not affect any feature of the Game.

2.3 Information from third parties

Google: only when you choose Google sign-in or binding, the data listed in table 2.1.
TRON blockchain: we read transfers to your deposit address from public on-chain data.

3. What we do not collect

We do not collect a billing address, and we do not collect payment credentials such as card number, expiry date, security code or payment-account password: the Game currently accepts only on-chain USDT transfers.
We do not collect identity documents or real-name verification data, and we do not read contacts, SMS, photo libraries, precise location or microphone input.
We do not put passwords, one-time codes, session tokens or payment credentials into analytics events or logs. Passwords are stored only as hashes and one-time codes are used only for verification.
The client diagnostic probe is off by default. It only collects summary data when you are explicitly taking part in troubleshooting and have been allow-listed, and it never records request or response bodies.

4. How we use information

We use the information above only for the purposes listed in section 2: providing and maintaining the Game, verifying sign-in, keeping accounts and transactions secure, completing purchases and refunds, applying minor-protection rules, syncing progress and settings, providing friends and chat, settlement and anti-cheat, handling faults and reports, producing de-identified aggregate statistics, and complying with the law. We do not ourselves use personal information for personalised advertising and we do not sell it; for the Google ads in the web version, see section 5. Analytics events never contain nicknames, chat text, passwords, tokens or IP addresses.

Automated risk assessment: when you place an order or pay, the system scores it automatically from the security and risk data above. A score may send the order to manual review, delay delivery, apply a spending limit or reject the order. You can ask us at the email in section 13 to explain the reason and have a person review it again.

Google user data is used only to complete Google sign-in or account binding. We do not use Google user data for advertising, sell it, or use it for purposes unrelated to sign-in and account security. OAuth authorization codes are used only to exchange and verify an identity and are not retained as Game profile data.

5. Sharing and processors

TRON blockchain: USDT transfers are recorded on the public TRON blockchain. Anyone can see the addresses, amount and time of a transaction, and it cannot be changed or deleted. This is a property of the blockchain, not a disclosure by us; we never publish which on-chain address belongs to which Game account. We query on-chain transactions through a blockchain data service (TronGrid), giving it only our own deposit addresses.
Advertising (web version): the web version shows rewarded ads through Google AdSense ("watch an ad for a reward"), which play only when you choose to watch them. Third-party vendors, including Google, use cookies and similar technologies to serve ads based on your prior visits to this website or other websites; Google's use of advertising cookies enables it and its partners to serve ads to you based on those visits. You can opt out of personalised advertising in Google Ads Settings; see how Google uses this data. We only record the outcome of an ad reward you claim (placement, time and the screen where the ad was shown) and never give advertisers your account, nickname or email address.
Sign-in and notifications: Google (Google sign-in only); the email delivery service Brevo (sends verification codes and account and order notices; receives your email address and the message content).
Infrastructure: servers and databases are hosted by VMISS in its data centre in Tokyo, Japan, solely to store and run the Game's data.
Tax, accounting and regulators: to the extent the law requires, we provide order and transaction records to tax authorities, regulators or auditors.
Legal disclosure: we may disclose information when required by law, when lawfully requested by a regulator or court, or when necessary to protect players, the service or public safety.
Apart from the above we do not provide your personal information to third parties. The Game's internal services share data only as needed to provide the corresponding feature.

6. International transfers

The Game's servers are located in Tokyo, Japan. Wherever you access the Game from, your personal information is transferred to and stored there.
Google (sign-in and web-version ads) may process data in the United States and other countries; the email delivery service Brevo is based in France (EU).
The items, purposes and retention periods transferred are those in section 2; transfer happens over TLS-encrypted networks when you use the corresponding feature.
We transfer data across borders only under conditions the applicable law permits (for example your consent, standard contractual clauses, or an adequacy decision for the destination) and require recipients to protect it to a standard comparable with this policy. You can ask us at the email in section 13 for details of the recipients or refuse the transfer; if you refuse, features that need it (such as purchases) will be unavailable.

7. Retention and deletion

Retention periods for each category are listed in section 2. When a period ends or the purpose has been fulfilled we delete or anonymise the data.
Order, transaction and ledger records are kept for 10 years from the end of the order for accounting and tax, dispute handling and statutory reporting, and are not used for anything else; after account deletion only the minimum identifiers needed to meet legal obligations remain.
Gender: deleted immediately when you switch back to "Prefer not to say".
Risk data: risk events 3 years, account links 2 years, lists per their own expiry, after which they lapse automatically.
Direct messages are kept for up to 90 days, chat inbox records for up to 30 days, and raw analytics events for 90 days.
Replay retention follows its server class: normal 7 days, ranked 30 days, favourite 30 days, report 90 days, and featured replays may be kept long term.

8. Security

Traffic uses TLS; passwords use one-way hashes; risk identifiers such as IP and device fingerprint are stored as keyed one-way digests whose keys are rotated.
Birth year-month and gender live in a separate private table and are not returned by profile-card interfaces (gender is returned only when you have agreed to show it).
Internal access follows least privilege; sensitive operations in the admin console require two-step verification and are audit-logged.
If a personal-information security incident occurs we will take remedial action and notify you and the regulator as the law requires.

9. Your rights

View and edit: on your in-game profile card you can view and change your nickname, avatar, gender, birth year-month and billing country, as well as language, audio, quality, camera and presence preferences.
- Birth year-month: you can change it freely before your first purchase. After the first purchase it can only be changed to a later month (a younger age); to change it to an earlier month, email us so we can verify. If it was still the untouched default at your first purchase, you may change it yourself once more afterwards.
- Billing country: you can change it freely before your first purchase; after that, once every 30 days, and not while you have an unfinished order or an unpaid debt.
- Gender: change it any time; switching back to "Prefer not to say" withdraws consent and we delete it immediately.
Access and copy: you can ask by email for a copy of the personal information we hold about you (including purchase history).
Correction, deletion and restriction: you can ask by email to correct inaccurate information or to delete, restrict or stop processing your information, except information the law requires us to keep (such as order records).
Withdraw consent: optional items can be withdrawn at any time (see above). Withdrawing your consent to this policy as a whole means you can no longer use features that need sign-in and a network connection.
Object to automated decisions: see section 4.
Delete your account: you can request deletion yourself under Settings in the game (guest accounts too), or email correa19980@gmail.com and we will submit it for you after verifying that the account is yours.
- Request: to confirm that it is really you, your most recent sign-in must be within the last 10 minutes; otherwise please sign in again first. The confirmation screen lists the paid diamond and gold balances that will be forfeited, and you can submit only after confirming them; if the balances grow after you confirm, you will be asked to confirm again.
- 15-day cooling-off period: you can keep signing in and cancel the request at any time, but you cannot make purchases. If a purchase is still open when the period ends (payment in progress, under review, or a refund or dispute in progress), deletion waits until it is settled, and you can still cancel until then. Once deletion has started it cannot be cancelled and you can no longer sign in.
- Deleted when it runs: account name, password and authenticator binding, linked email address and Google account, guest credentials, sign-in records (including IP addresses), birth year-month, gender and the related consent, billing country, the device and IP-range digests recorded at registration, the account links and feature details in risk data, your friendships (both ways), the friend requests you sent and received, your block list and other players' block entries for you, your online status, and your own match records and match event log; all sign-in sessions are revoked at the same time.
- Anonymised and deactivated: your nickname becomes "Deleted Player", your avatar is reset, titles, avatar frames and card faces are no longer shown, and your profile can no longer be searched or matched; other players see "Deleted Player" on profile cards. In other players' match records and replays your nickname also becomes "Deleted Player" and your avatar is no longer shown; the match results and line-ups stay as part of their game records. Direct messages, replays and raw analytics events are deleted automatically on the schedule in section 7.
- Kept: order, transaction, refund and dispute records and the ledger, for the statutory period in section 7 (10 years from the end of the order), linked only to the deleted account's internal number, with device and network digests replaced by irreversible pseudonyms; deleted when the period ends.
- When deletion runs, all of your in-game currency balances (including paid diamonds and gold, and any amount held for you because it exceeded the cap) are forfeited, the forfeit is recorded, and nothing is refunded; if you want a refund, request it before asking for deletion. The email address and Google account that were linked can register a new account after deletion, but the old account's data is not restored.
Guest-account credentials are stored on the device; clearing browser site data makes that guest account unrecoverable.
We reply within 30 days of receiving a request (or sooner where the law requires). You also have the right to complain to the data-protection authority where you live.

10. Minors

Minors should use the Game with the consent and guidance of a parent or guardian, and must obtain that consent before making purchases.
No purchases under 13. Accounts whose birth year-month shows an age under 13 cannot place orders, and we process no purchase-related information for them.
Purchases by minors are subject to a monthly spending limit according to the billing country (as stated on the recharge page); orders over the limit cannot be submitted.
In Japan, Korea, the United States and certain other regions, you are asked to confirm your birth year-month again before your first purchase; the confirmation and your age at that time are kept with the order to apply minor-protection rules.
We do not knowingly collect more information about minors than these features need, and we do not target minors with personalised advertising.
A parent or guardian who wants to access, correct or delete a minor's information, or to make a request about a minor's purchases, can email correa19980@gmail.com.

11. Changes to this policy

We may update this policy because of legal changes or feature changes. After an update we will notify you in the Game and ask you to confirm again the next time you sign in. Material changes (such as new items collected or new third parties) will be explained more prominently.

12. Regional supplements

EU / UK: our legal bases are performance of a contract (account, matches, purchases), legal obligation (order and tax records, minor protection), legitimate interests (risk control and security, statistics) and your consent (gender).
Korea: required and optional items are listed separately in section 2, and optional items are collected with separate consent; entrusted processing and overseas transfers are described in sections 5 and 6.
Japan: when we provide personal data to a third party in a foreign country, we provide the name of that country and information about its personal-information protection system as required by the Act on the Protection of Personal Information.
California and other US states: we do not sell personal information. The Google ads in the web version may use cookies for cross-context behavioural advertising; you can opt out of personalised advertising in Google Ads Settings.

13. Contact us

For any question, request or complaint about this policy or your personal information, contact Ren Ito (privacy officer: Ren Ito), correa19980@gmail.com.