Information collected
For registered players and guests, we collect information needed to provide the Service from submissions, usage and connection records, and authentication, payment and other providers. Legal terms follow applicable law; external services have their own policies.
- Account
- Email, authentication ID, login method and consent records. Passwords go to the authentication provider and are not stored in plain text.
- Game
- Name, avatar, progress, inventory, currency, trades and settings.
- Purchases
- Order, product, amount, payment status and purchase/refund records. Complete card details are handled by the payment provider, not stored by us.
- Google Login
- Permitted identifiers, email, display name, images and similar information.
- Connection/device
- IP, browser, OS, cookies, session, access and error records.
- Support
- Reply address, message, attachments, correspondence and identity-check information.
Purposes and public information
- Authentication, sessions, game, marketplace, rewarded ads, purchases, refunds, entitlements, balances and trades; storage and synchronization
- Support, identity checks, important notices; preventing, investigating and addressing unauthorized access, cheating, account abuse and payment/ad fraud
- Fault recovery, quality improvements, usage analysis, feature planning, non-identifying statistics, legal compliance, rights, disputes and related purposes
Rankings automatically include guests. Each category’s top 50 show names (a placeholder if unset), avatars, ranks and public records. Public profiles include collection and other game records. Emails and authentication IDs are not public. IP addresses support rate limits and fraud prevention; Turnstile checks send them to Cloudflare.
Cookies and local storage
These support login, guest identification, security, local settings and game copies, and connection recovery. Browser restrictions or deletion may affect login, guest access or saving. Rewarded ads are currently disabled. Before analytics or ads begin, this Policy or a cookie notice will explain providers, data, purposes, opt-out methods and handling for rewards and related features.
Ad measurement: We do not currently use ad measurement cookies or the Google Ads measurement tag.
External services and processing abroad
- Cloudflare
- Delivery, APIs, abuse protection, Turnstile and encrypted backups. A US provider operating worldwide; R2 does not guarantee a storage country. Safeguards / Locations
- Supabase
- Authentication and game-save storage. The main contracting entity is Supabase Pte. Ltd. in Singapore. US affiliates and European log facilities may process data outside the selected region. Locations and safeguards
- Information permitted through Google Login, and receiving, replying to and keeping support emails through Gmail. Processing may occur worldwide. Data handling
- GitHub (GitHub Actions)
- Backup jobs, validation and monitoring. A US provider operating worldwide. Data handling
- Resend
- Authentication and support email delivery. Recipient/reply-to addresses, content and delivery records are processed mainly in the US. Safeguards
- Stripe
- Processing payments and refunds, preventing fraud and managing payment records. Data may be processed abroad. Data handling
We do not provide personal data to third parties without consent unless permitted by law. Necessary disclosures may protect life, health or property where consent is difficult, or support lawful cooperation with authorities. Outsourcing, business succession and similar cases not legally treated as third-party provision are excluded. Worldwide operations may prevent identification of every processing country. We check provider safeguards and limit processing to what is needed; where consent for foreign transfers is required, we first provide the required information and obtain it.
Retention and deletion
- Registered data
- Kept during use. Authentication accounts and main game data are deleted on withdrawal; completed trades may remain in anonymized or similar form.
- Guests
- Policy: eligible for deletion after 30 days of inactivity, excluding registered accounts and transfers in progress. Clearing local data does not erase server data.
- Operational/access logs
- Policy: 30 days.
- Support
- Policy: one year after resolution.
- Tax records
- Normally seven years from the statutory starting date, or longer where law requires.
- Backups
- Daily encrypted R2 backups become eligible for automatic deletion after 30 days; processing may be delayed. Older GitHub copies remain until configured expiry, local copies normally 30 days after creation, and restore-test copies until their purpose ends.
Fraud investigation and dispute records may remain until resolution. Backups, authentication/fault records and local copies are not all erased at withdrawal. Browser settings can delete local copies; external providers apply their own retention rules. Uniform automatic deletion at the stated deadlines is not implemented for guests, routine logs, support or local backups; these may remain longer. Contact us for deletion.
Security
We protect data with encrypted connections and backups, restricted access, abuse detection, vulnerability handling and provider checks. For incidents, we investigate, contain and prevent recurrence, and notify individuals and authorities as required by law.
Access, correction and deletion
Under law, you may request notice of purposes, access to personal data and disclosure records, correction, addition, deletion, suspension of use, erasure and cessation of third-party provision. We use reasonable identity checks. If legal exceptions, rights protection or serious operational interference prevent compliance, we explain as far as permitted. Requests are generally free; special mailing or other actual costs are explained beforehand. Minors should review this Policy with a guardian as needed and obtain their consent before use. We verify a guardian’s relationship for requests.
Changes and contact
We publish amendments and effective dates, give advance notice of material changes through the website, game or email, and obtain consent where law requires. For questions or requests, use Contact or cosmicworld.operator@gmail.com. Our formal personal-information controller name and address are disclosed promptly by email on request, without requiring registration or a purchase.