Preliminary version, under legal review. The fields in brackets will be filled in before launch.
Courtesy translation. If there is any difference, the Portuguese version (Brazil) prevails.
Privacy Policy
Version of October 8, 2026
GoOne is a game with no ads. We do not sell data, we do not build behavior profiles for advertising and we do not use tracking cookies. This policy explains which personal data we use, why, and how you exercise your rights under Brazil’s General Data Protection Law (Law 13,709/2018, LGPD).
1. Who is the controller
[RAZÃO SOCIAL], CNPJ [CNPJ], [ENDEREÇO COMPLETO]. The data protection officer is [NOME DO ENCARREGADO], at contact@playgoone.com.
2. Data we use
| Data | Why | Legal basis |
|---|---|---|
| Sign in with a 6-digit code; subscription notices | Performance of the contract | |
| Full name and date of birth | Identify the account holder and know whether they are a child (under 12), to ask for a guardian’s authorization | Performance of the contract; compliance with a legal obligation |
| Phone (optional) | Help recover the account, if you ask | Consent |
| Guardian’s email (under 12) | Ask for and record the guardian’s authorization | Guardian’s consent (LGPD, art. 14) |
| Nickname | Appear on the leaderboard and on certificates; never your name | Performance of the contract |
| Language | Send emails and notices in your language and draw the certificate image | Performance of the contract |
| Game data | Levels, scores, wins, form reached, lives, gold bars, story choices, D20 rolls; saving your progress, building the leaderboard and detecting cheating | Performance of the contract; legitimate interest (fair play) |
| Sign-in with Google or Apple | The account identifier and the email that Google or Apple send us | Performance of the contract |
| Subscription | Plan, dates and status of the subscription; payment is processed by Apple, Google or Stripe, and we never see the card number | Performance of the contract; legal and tax obligation |
| Device notification token | App notices (such as the end of the free trial); news only with your permission | Performance of the contract; consent (news) |
| IP and email of each code request | Limit requests to prevent abuse; deleted up to 7 days after expiry | Legitimate interest (security) |
| Error reports | Fix failures: version, device, screen and an internal identifier, with no email, name, phone, IP or session secrets | Legitimate interest (game operation) |
| Message sent through the contact form | The name, email, subject and text you write; used only to answer your message. They arrive in our official mailbox and are kept in the team panel, only to track what has already been answered. Children under 12 should write with the help of a parent or guardian | Legitimate interest (answering people who write to us) |
We do not ask for location, contacts, photos, microphone or access to other apps. The game has no chat between players. Sound, vibration and accessibility settings stay only on your device.
3. Children and teenagers
The game is for all ages and follows the best interest of children and teenagers. Anyone under 12 needs a guardian’s authorization, requested by email at sign-up. Until it is given, the child plays normally but does not appear on the leaderboard, cannot share certificates and cannot subscribe. A guardian can ask at any time for access, correction or deletion of the data, at contact@playgoone.com.
4. What becomes public
The leaderboard shows only the nickname, the form and the score. Certificates start private: a certificate’s page and image only exist after you share it, and you can make it private again on the Wall. Certificate pages do not appear in search engines. Name, email, phone and age never appear.
5. Who we share with
Only with companies that run the game for us, under contract and only for these purposes: hosting and database (such as Vercel, Cloudflare, Fly.io and the database provider), email delivery (Resend), notifications (Firebase Cloud Messaging, from Google), subscriptions (Apple, Google, RevenueCat and Stripe), sign-in (Google and Apple) and error reports (Sentry). Some are outside Brazil; transfers follow art. 33 of the LGPD, with protective contract clauses. We also give data to authorities when the law requires it. The screen fonts are hosted by us: no third-party font service receives your IP.
6. For how long
- As long as the account exists.
- When you delete the account (in the game, Account and then Delete account), we immediately erase name, email, phone, date of birth, guardian’s email, nickname, Google and Apple sign-ins, notifications and leaderboard position; certificates go offline (a shared image copy may stay in cache for up to a day).
- Games and payment records remain, with no data that identifies you, for auditing and for the period tax law requires.
- Sessions expire after up to 30 days without use; sign-in codes, up to 7 days after expiring.
- Contact form messages stay in the official mailbox and in the team panel only as long as needed to answer them; once archived, they are deleted from the panel within 12 months, and can be deleted sooner on request by writing to the same address.
7. Your rights
You can confirm whether we process your data, access it, correct it, ask for portability, deletion, information about who we share it with, and revoke consents (LGPD, art. 18). Two things are in the game itself, under Account: Download my data (a full copy, as a JSON file, that you can take to another service) and Delete account. For the rest, write to contact@playgoone.com. We answer within 15 days. You can also complain to Brazil’s National Data Protection Authority (ANPD).
8. Ads and messages
GoOne has no advertising, does not sell or rent data and does not show targeted ads. E-mail messages are only service ones (login code, subscription and account notices) and, if you accept, game news; you can turn the news off whenever you like, in Account, Notifications.
9. Cookies and similar technologies
We use necessary cookies (to keep you signed in and to remember your cookie choice) and, if you allow it, preference cookies (the language) and error reports without personal data. No advertising cookies and no cross-site tracking. On your first visit you choose, and you can change it at any time under Cookie preferences, in the footer. The full list is in the Cookie Policy.
10. Security
We do not use passwords: login is by one-time code. Codes and sessions are stored encrypted (hashed), connections use HTTPS, and internal access to data is restricted and logged.
11. Changes
We will give notice in the game and by e-mail before important changes. This page always shows the version in force and its date. See also the Terms of Use and the Code of Conduct.