Totem Roll Privacy Policy

Last updated: October 24, 2026

This policy explains what data Totem Roll collects, why we collect it, who we share it with, and what your rights are. We use plain language. If anything is unclear, contact us using the details at the end.

Who is responsible for the game
What data we collect
Data we do not collect
How we use the data
Legal bases
Automated decisions and review by a person
Ads
In-app purchases
Where data is stored and for how long
Who we share data with
International transfers
Cookies and website
Children and teenagers
Your rights
How to exercise your rights
Security
Data protection officer
Changes to this policy
Applicable law
Contact

1. Who is responsible for the game

Totem Roll is developed by Brightloop Games, the trade name of Douglas Viana de Moraes, an individual based in Nova Friburgo, RJ, Brazil. For the purposes of the Lei Geral de Proteção de Dados (LGPD), the data controller is Douglas Viana de Moraes, as an individual.

Contact address: Rua Benjamin Constant, 1205, sala 101, Conselheiro Paulino, Nova Friburgo, RJ, Brasil, 28633-000
Phone: +55 22 99855-9113
Email: contato@brightloopgames.com.br
Website: https://brightloopgames.com.br/totemroll

2. What data we collect

We collect only what the game needs to work, measure how it is used, show ads, process purchases, and keep the leaderboard fair. We split the data into two groups: data from your device, which exists even without an account, and account data, which exists only if you choose to sign in with Google or Apple.

Device data (no account):

Player identifier: a random code (the "pid", a UUID) generated on your device the first time you open the game. It does not contain your name, email, or phone number.
Age range: the game gets your age range (under 13, 13 to 15, 16 to 17, or 18 or older) from the Google Play age signal (Play Age Signals), from Apple (Declared Age Range), or from a neutral question about your year of birth. We keep only the range, on this device. We never keep the year of birth. Only the range you give in the question is sent to the server, as a statistical event; a range received from Google or Apple is not sent for analysis.
Usage data (telemetry) linked to the pid: session start, level started and finished, relic choice, tutorial use, rewarded ads watched, purchases made (only as an event, with no payment data), and technical errors. We also send the app version and channel.
Approximate country: derived from the IP address on the server. The IP address is not stored in the game database. The hosting provider (Cloudflare) processes the IP address in transit to deliver and protect the service (for example against attacks and abuse), and the game does not store it.
Android advertising ID: the device's advertising identifier, used by Google AdMob to show ads (see section 7).
Purchase data: receipts and purchase tokens processed by the store (Google Play), used to deliver the item you bought. From the token we keep only the SHA-256 hash, never the token itself. We also keep the order number, the product, the purchase state, the expiry, and the date.
Saved progress: without an account, progress is saved only on your device. With an account, a copy is kept in the cloud (see below).
Match data (sharing of plays): piece positions, dice, relics, and score, used to recreate plays on video and, if the option is on, shared with your nickname. Sharing only applies to players who stated they are 18 or older. Legal basis: see section 5. Players under 18: only with the legal guardian's authorization. You can turn this off in Settings, under "Allow showing my plays".

Account data (only if you sign in):

Sign-in identity: signing in with Google or Apple is optional. We keep only the SHA-256 hash of the identifier that Google or Apple sends us. We do not receive or keep your email, name, or photo. An account can have both Google and Apple linked as ways to sign in. If you link a way to sign in that already belongs to another account, we can merge the two accounts, at your request and with your confirmation.
Sessions and devices: each session uses a random code, and on the server we keep only its hash. Each account can have up to 3 active devices. For each device we keep an identifier generated by the game, the platform (Android, iOS, or web), and the date of last use.
Cloud progress: a compressed copy of your progress, which the server stores without opening it, with a numeric summary (level, stars, and best score) so you can choose which version to keep.
Pearl wallet and entitlements: an append-only pearl ledger (each purchase, earning, spending, refund reversal, or account merge creates a line with the balance, chained by hash to the previous ones) and the list of entitlements you have (permanent items, Season Pass, VIP). Account purchases are tied to a pseudonym, which is a hash made with a secret key of ours.
Leaderboard: for each ranked match, the game sends the replay (the record of your moves: pieces placed, dice, relics used, and choices). It includes, for each dragged piece, a short sample of the pointer or finger path (6 to 12 points, with board position and time). We use the path only for anti-cheat and leaderboard fairness, and it is kept together with the replay. We keep each player's highest verified score on each leaderboard, with the date. Your nickname only appears on the leaderboard if you allowed showing your plays and are 18 or older. We also produce aggregated, anonymous match statistics (score, relics, pace and path measurements), with no identifier.
League: a hidden skill rating (MMR), league points (LP), and a summary of your latest matches, calculated on the server.
Review flags: replays with suspicious patterns are flagged for review by a person (see section 6).

Server security data:

Access logs: technical records of access to the server (date and time, route accessed, and result), used for security, fraud prevention, and defense of rights.
Public timestamp: once a day, we publish to a public timestamping service (OpenTimestamps) only the hash of the head of the pearl ledger. That hash contains no personal data and cannot identify anyone.

Controlling usage data: you can turn sending usage data on or off in the "Send usage data" option, in Settings. Outside the European Union, the United Kingdom, and Switzerland, this option is on by default. In those three territories, sending only starts after you give consent. With sending turned off, nothing is sent, except a deletion request that you make. For players whose age range is "under 13", sending usage data stays off.

3. Data we do not collect

We do not ask for your name, email, phone number, tax ID, address, credit card data, or contact list. Even when you sign in with Google or Apple, we do not receive or keep your email, name, or photo, only the hash of an identifier.

The game requests only these Android permissions: internet access, network state, vibration, advertising ID (AD_ID, used by the Google SDK), and Google Play billing (BILLING). It does not request precise location, contacts, photos, camera, or microphone.

4. How we use the data

Running the game: saving your progress and unlocking levels. With an account, keeping your progress in the cloud and making your pearls and purchases work on up to 3 devices.
Statistics and balancing: understanding which levels are hardest and tuning the game. This data is pseudonymized.
Fixing errors: identifying and fixing technical faults.
Leaderboard integrity and anti-cheat: checking ranked matches, identifying impossible scores and play patterns that do not look human, and flagging cases for review by a person. The pointer or finger path is used only for this.
League: calculating your hidden skill rating and league points.
Ads: showing optional rewarded videos and, where allowed, personalized ads.
Purchases and pearl wallet: delivering pearls, season pass, subscriptions, and other purchased items, preventing the same order from being credited twice, and removing what a purchase granted when the store refunds it.
Protecting children and teenagers: adapting the game to your age range.
Security and audit: limiting abuse, preventing fraud, keeping access logs, and making it possible to check that the pearl and purchase records have not been altered.
Legal obligations and defense of rights: keeping purchase and pearl ledger records for the period described in section 9.

We do not sell personal data. We do not use data from children and teenagers for advertising profiling.

5. Legal bases

For users in Brazil (LGPD, Law 13.709/2018):

Usage data (telemetry): legitimate interest (art. 7, IX). We use this data to improve the game, balance levels, fix errors, and identify impossible scores, in pseudonymized form. You can turn off sending at any time in Settings.
Personalized ads: legitimate interest (art. 7, IX), with your right to object through the "Personalized ads" option in Settings.
Play sharing: legitimate interest (art. 7, IX), with your right to object through the "Allow showing my plays" option in Settings, which is on by default. Players under 18: only with the legal guardian's authorization.
Account, cloud progress, pearl wallet, and purchases: performance of a contract (art. 7, V).
Leaderboard, league, and anti-cheat: legitimate interest (art. 7, IX) in keeping competition fair, with the right to object through the contact email.
Purchase and pearl ledger records, for 10 years: compliance with a legal or regulatory obligation (art. 7, II) for the minimum period required by law, which is 5 years, and regular exercise of rights in judicial, administrative, or arbitration proceedings (art. 7, VI) for the rest of the period, with retention within the limits of art. 16 and, after the account is deleted, only under a pseudonym.
Age range and protection of minors: compliance with a legal obligation (art. 7, II), under Law 15.211/2025 (ECA Digital), and the best interests of children and teenagers (art. 14).
Security, access logs, and fraud prevention: legitimate interest (art. 7, IX).

For users in the European Union, the United Kingdom, and Switzerland:

Usage data (telemetry): consent (art. 6(1)(a) GDPR). Sending only starts after you say yes.
Personalized ads: consent (art. 6(1)(a) GDPR).
Play sharing: consent (art. 6(1)(a) GDPR). The option is off until you turn it on.
Account, cloud progress, pearl wallet, and purchases: performance of a contract (art. 6(1)(b) GDPR).
Leaderboard, league, and anti-cheat: legitimate interests (art. 6(1)(f) GDPR) in keeping competition fair, with the right to object (art. 21 GDPR).
Purchase and pearl ledger records: legal obligation (art. 6(1)(c) GDPR) during the period required by law, and legitimate interests (art. 6(1)(f) GDPR) in the defense of legal claims during the rest of the 10 years.
Age range and protection of minors: legitimate interests (art. 6(1)(f) GDPR) in protecting children and teenagers.
Security, access logs, and fraud prevention: legitimate interests (art. 6(1)(f) GDPR).

For users in Switzerland, the Swiss Federal Act on Data Protection (nLPD/FADP) also applies, with the same rights described for the European Union.

6. Automated decisions and review by a person

The leaderboard and the league use automatic calculations (score, hidden skill rating, and league points) and automatic checks. An automatic check may refuse a submitted match that would be impossible under the game rules, and that match then simply does not enter the leaderboard.

The system also flags replays with suspicious patterns, such as pace or drag path that do not look human, for review. A flag does not punish anyone. No decision that significantly affects you, such as removing a score, suspending access to the leaderboard or the account, or taking back rewards, is made solely by automation: a person reviews the case first. There are no automatic bans.

You have the right to ask for an explanation of the criteria used and for review by a person of any decision based on automated processing (art. 20 LGPD; art. 22 GDPR). To do so, write to contato@brightloopgames.com.br. We do not publish the exact detection thresholds, so that they cannot be bypassed.

7. Ads

Ads are provided by Google AdMob. When you watch a rewarded video, the Google SDK collects the advertising ID, ad interaction data, diagnostic data, and approximate location, in order to show and measure the ad. Details are in anuncios-e-consentimento.md. In short:

In the European Union, the United Kingdom, and Switzerland, the game shows the Google UMP consent form the first time you open it. Personalized ads are only used if you accept. You can change your choice later in Settings, under "Privacy options".
In Brazil and other countries, the "Personalized ads" option in Settings is on by default. If you turn it off, the game asks Google for non-personalized ads only.
You can decline personalization without losing access to the game.
For players who declare they are under 18, when the game has that information, we use only non-personalized ads (see section 13).

8. In-app purchases

Purchases are made through your device's store: today, through Google Play Billing, and the payment is processed by Google. On iPhone, they will be made through the App Store, once the game is available there. Totem Roll does not receive or store card data. We receive only the purchase receipt and token, which we use to confirm the purchase with the store and deliver the item. From the token we keep only the hash.

The item is delivered only after our server confirms the purchase with the store. With an account, the order is tied to the account through a pseudonym, and each order can be credited only once.

When the store refunds or reverses a purchase, it notifies us, and we remove what the purchase granted, as described in the Terms of Use. Brightloop does not refund directly: refunds are made by the store.

9. Where data is stored and for how long

Server: Cloudflare Workers, D1 database, and Cloudflare storage, operated by Cloudflare, Inc. (USA). Data is kept in the D1 database, with jurisdiction in the European Union.
Device: progress and preferences are saved on the device. Without an account, only there.
Raw usage data: event batches are kept for 90 days. Aggregated records and the player record (pid, version, country, and dates) are kept for up to 24 months. After those periods, they are deleted.
Leaderboard replays, with the drag path: kept until the later verification of the score, when the replay is discarded, or for up to 2 years, whichever comes first. They are also deleted when the account or the data is deleted.
Leaderboard marks: each player's highest verified score on each leaderboard is kept for up to 2 years without improvement, or until deletion.
Sharing replays and highlights: replays are kept for 180 days. Unapproved highlights are deleted after 180 days. Approved highlights stay until you ask for removal or deletion of your data.
Account, cloud progress, devices, sessions, and league: as long as the account exists. Sessions last 60 days, renewed when you use the game. When the account is deleted, this data is deleted.
Purchase records and pearl ledger: kept for 10 years. This period is double the legal minimum of 5 years and serves to defend rights in a possible dispute (LGPD, art. 7, VI, and art. 16). While the account exists, the records stay tied to it. After the account is deleted, they stay only under a pseudonym, with no name, no email, and no link to your sign-in, until 10 years have passed from the date of each record, and are then deleted. A monthly audit copy of these records, also pseudonymized, is kept for the same period.
Public timestamp: the hash published once a day on OpenTimestamps contains no personal data and, being public, cannot be withdrawn.
Server access logs: kept for 1 year.
Database backups: deleted data is also erased from backups within 30 days, except for the records that the law or the defense of rights require us to keep, described above.
Anonymized statistics: aggregated statistics, with no identifier, may be kept, because they do not identify you.
Deletion request: we delete the data linked to your pid or account within 30 days, as described in exclusao-de-dados.md.

Google: Google AdMob (ads), Google Play Billing (purchases), Sign in with Google, and Play Age Signals (age signal).
Apple: Sign in with Apple and Declared Age Range (age signal), and the App Store, once the game is available there.
Cloudflare, Inc.: hosting of the server, the database, and the audit archive.
OpenTimestamps (public timestamping servers): receive only a daily hash, with no personal data.
The public: if play sharing is on, the play and your nickname may appear on the Brightloop Games website and social media, as described in the Terms of Use.
Authorities: only when there is a legal order or an obligation set by law.

We do not sell or rent personal data. These providers process data under their own policies, such as the Google Privacy Policy.

11. International transfers

Google, Apple, and Cloudflare may process data outside Brazil, including in the database with jurisdiction in the European Union. This transfer is supported by the standard contractual clauses in the data processing agreements of those companies, under art. 33 of the LGPD and art. 46 of the GDPR. OpenTimestamps receives only a hash, which is not personal data.

12. Cookies and website

The app does not use cookies. The website https://brightloopgames.com.br/totemroll is a static page, with no analytics and no cookies.

13. Children and teenagers

Totem Roll is intended for people aged 13 or older and is not directed at children. We process the data of children and teenagers in their best interests, under Law 15.211/2025 (ECA Digital) and art. 14 of the LGPD.

To adapt the game to your age, we use the age range described in section 2. When there is no age information, we treat the person as not an adult for ads and play sharing, which is the more protective option.

Under 13: the game works locally only. There is no cloud account, no purchases, no sending of usage data, no personalized ads, and no play sharing. If an account already exists and the age range becomes under 13, the account is deleted automatically, and the progress stays on the device.
13 to 17: we do not profile for advertising. Ads are always non-personalized and plays are not shared.
18 or older: the options described in this policy apply according to your choice.

We do not knowingly collect data from children under 13. If we find that we collected data from a child in that situation, we delete it. If you are a legal guardian of a child and think this happened, write to us.

The target audience declared on Google Play is 13 and older. The game does not take part in the Designed for Families program.

14. Your rights

Under the LGPD (art. 18), you can ask for:

confirmation that we process your data;
access to your data;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
portability of the data to another provider;
information about the entities we share data with;
withdrawal of consent;
objection to processing based on legitimate interest;
explanation and review by a person of decisions based on automated processing (art. 20).

Under the GDPR, you can also ask for restriction of processing, object to processing, not be subject to decisions based solely on automated processing, and lodge a complaint with the data protection authority of your country. In Brazil, the authority is the ANPD (National Data Protection Authority).

15. How to exercise your rights

Delete the account, in the app: Settings, then Account, then "Delete account". We delete the cloud progress, the device list, the sessions, the identifier links, the entitlements, and your identity on the leaderboard and in the league. Purchase and pearl records stay only under a pseudonym, as explained in section 9.
Delete the device data, in the app: Settings, then "Delete my data". This button deletes the data saved on the device, creates a new identifier, and asks the server to delete everything linked to the old identifier.
By email: contato@brightloopgames.com.br. Include your identifier (pid), which appears in Settings, so that we can find your data. We cannot find an account by name or email, because we do not keep that data.
Response time: generally up to 15 days to respond to a request, as set by the LGPD. Deletion of server data happens within 30 days.
Removing a shared play: by email to contato@brightloopgames.com.br. We remove it within 5 business days from the channels we control.
Review by a person: by the same email, for any decision about the leaderboard, the league, or the account.

We may ask for minimal information to confirm that the request is yours. We will not ask for data that we do not use in the game.

16. Security

We use reasonable technical and organizational measures to protect the data. Data is encrypted in transit (HTTPS/TLS) and stored on Cloudflare infrastructure, with encryption at rest. We keep only hashes of the sign-in identifier, the session codes, and the purchase tokens. The pearl ledger is chained by hash, and the hash of its end is timestamped every day on a public service, so that any improper change can be detected. There are per-minute usage limits against abuse. Access is restricted to the developer's account. No system is completely secure. If an incident occurs that could cause you a relevant risk, we will notify you and the ANPD, as required by law.

17. Data protection officer

Data protection officer (DPO): Douglas Viana de Moraes
DPO contact: contato@brightloopgames.com.br
European Union representative (art. 27 GDPR): none appointed at this time. For data subjects in the European Union, the contact is the email address above.

18. Changes to this policy

When we change this policy, we will announce it in the app and update the date at the top of the document. Important changes, such as collecting a new type of data, will be announced before they take effect. Where the law requires it, we will ask for new consent.

19. Applicable law

This policy follows the LGPD, Law 15.211/2025 (ECA Digital), and other Brazilian laws. If the law of your country gives you additional rights, those rights remain in force.

20. Contact

For questions, requests, or complaints about privacy, write to contato@brightloopgames.com.br or visit https://brightloopgames.com.br/totemroll.