Minion game: Privacy Policy

Who runs the game

Doombringerz's Community runs this browser game at doombringerz.com. Data controller: Ridoco, De Nieuwe Erven 3-12572, 5431 NV Cuijk, Netherlands (KvK 95439609 · BTW NL005153257B49). Contact: contact@ridoco.com.

What data is collected

• Game state stored in your browser's localStorage (character name, progress, settings). Never sent to the server unless you create an account.
• Account data (only if you log in): username, email, your password as a one-way hash (never the password itself), chosen faction, in-game activity.
• Server logs: IP address, user-agent, timestamps. Kept 30 days for abuse prevention.
• Purchases (only if you buy Essence of Hell or the Overseer Pass): what you bought, the payment reference and the date, and for a bundle the price you paid. You pay on Stripe's or PayPal's own checkout page. Essence of Hell bundles go through Stripe. The Overseer Pass goes through Stripe or PayPal.
• Checkout consent: when a purchase asks you to confirm statements about your right of withdrawal, Ridoco stores for each statement your account, the purchase it belongs to, the product name, the exact wording, a hash of that wording, the language it was shown in, your email address, your IP address, your browser's user agent and the time.
• Cookies: the game sets a session cookie and a CSRF security cookie when the game loads, also if you are not logged in. No third-party tracking cookies. No analytics cookies.

Why it is processed

• Provide the game (contract, Art. 6(1)(b) GDPR).
• Prevent abuse and secure the service (legitimate interest, Art. 6(1)(f)).
• Comply with legal obligations.

What other people can see

Anyone can read the following without logging in. Only players with an account appear in them.

• Leaderboard: the top 20 players by prestige points, with username, display name, avatar, in-game name, rank and faction.
• Hall of Fame: every 5 minutes the top 20 players by prestige points are listed on the site's Hall of Fame page. Each entry shows your display name (or your username if you have none), your avatar, a "Top Minion #N" badge with your place, your prestige points and a link to your profile page at /users/your username.
• Player profile: anyone who knows your username can look up your display name, avatar, in-game name, title and aspect, rank, faction, prestige points, number of prestiges, total offerings earned, number of achievements, and chosen profile frame and background.
• World chat: the last 50 messages, each with the sender's username and the time it was sent.
• Activity feed: some of the social actions you take while logged in are posted to the feed with your in-game name, avatar and faction. If you have not set an in-game name, your display name is used, or your username if you have no display name. The last 50 posts are shown.

Banned and deleted accounts are left out of the leaderboard, the Hall of Fame and the profile lookup.

Your rights (GDPR)

You can request access (Art. 15), correction (Art. 16), erasure (Art. 17), portability (Art. 20), or object to processing (Art. 21). Open a support ticket, or email contact@ridoco.com (contact@doombringerz.com as a secondary address). You also have the right to complain to your national data protection authority.

Data sharing

Ridoco does not sell your data. Your data reaches these recipients:

• netcup and the Anexia group companies it relies on: server hosting, databases and backups, in Germany and Austria.
• Discord: login, community features and operator notifications. United States.
• Stripe and PayPal: payments, if you buy anything in the game. They also act as independent controllers for their own fraud prevention and regulatory duties. EU and United States.
• Mollie: payments by iDEAL, bank transfer and SEPA Direct Debit, where that option appears at checkout. European Union.
• Google: business email. EU and United States.
• Sentry: error and crash reporting, which can include your IP address and account identifier. EU and United States.

Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses together with encryption in transit.

The complete list, including the recipients that only apply to the shop and to order tracking, is in the site privacy policy.

Retention

• Account data: until you delete your account.
• Server logs: 30 days.
• Backups: up to 90 days.
• Purchase records, with the name and email address they were issued to: 7 years from the purchase, also after you delete your account. Dutch tax law requires this.
• A refund when your account is closed: your email address until the refund is paid, and the refund record for 7 years after that.
• Checkout consent records: 7 years from the moment you confirmed. If you delete your account, the user agent is removed and the rest stays until the 7 years are up.

Children

This service is not intended for users under 13. In the EU/EEA, users under 16 need parent consent (or the local minimum age). If Ridoco learns it has collected data from a child below the applicable age, it deletes that data.

Changes

When this policy changes, the date at the top changes.