1. Controller
SIA Handly, registration number 44103133064, is the controller for the Final Exodus website, player registration and account service. Contact us at 1exodusgame@gmail.com for privacy requests. We have not appointed a data protection officer because one is not currently required for the described processing.
2. Data we process
- For a private account: fictional player name, account identifier, interface language and document acceptance versions/timestamps. We do not request email, country, legal name or birth date.
- For an email account: the same data plus the verified address. Email-mode eligibility is checked during the request, but citizenship or the reason for selecting a mode is not stored in the account.
- Age confirmation: only whether you confirmed being at least 16, without a birth date or identity document.
- Authentication and security data: password hash, one-time recovery-code digests, session state, login attempts, keyed abuse-prevention identifiers, timestamps and security events. Plain recovery codes and pending registration passwords are not stored.
- Technical data: requested URL, IP address, browser user agent, referrer, response status and diagnostic information in server logs.
- Communications: messages and information you send when requesting support or exercising your rights.
3. Purposes and legal bases
- To create and operate your account and provide the game service: performance of our contract with you (GDPR Article 6(1)(b)).
- To verify email, prevent fraud, rate-limit abuse, protect accounts and maintain service integrity: our legitimate interests in operating a secure service (Article 6(1)(f)).
- To maintain legally required records and respond to authorities: compliance with legal obligations (Article 6(1)(c)).
- To send optional marketing in the future: consent where consent is required (Article 6(1)(a)). Registration emails are transactional, not marketing.
4. Registration and children
Registration is limited to users who confirm that they are at least 16. We do not knowingly offer the account service to younger children and do not provide a parental-consent workflow. If you believe a child registered contrary to this rule, contact us so we can investigate and remove data where appropriate.
5. Recipients and service providers
We disclose data only when needed to operate the service, protect users or comply with law. Current providers include Brevo for transactional email and Cloudflare for Turnstile bot detection and related security. Hosting, network and database providers may process technical data on our instructions.
We do not sell personal data. We do not use registration email addresses for third-party advertising.
6. International transfers
Some providers may process data outside Latvia or the European Economic Area. Where GDPR requires safeguards, we rely on an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism and assess supplementary security measures where appropriate.
7. Retention
- Unverified registration links normally expire after one hour; verified completion sessions normally expire after 30 minutes.
- Temporary completed-registration records are scheduled for removal within seven days, and the email is erased from that temporary website record when the game account is created.
- Unused recovery-code digests are kept until use, code replacement or account deletion; plain codes are shown only once.
- Keyed registration rate-limit records are scheduled for removal after two days. The keyed values are not stored as raw email or IP text.
- Browser account sessions normally expire after eight hours and are currently held in process memory, so a service restart also ends them.
- Apache access logs, which may include IP address and user agent, are rotated daily with 14 retained rotations. Incident evidence may be retained longer when reasonably necessary to investigate abuse or establish legal claims.
- Core account records are kept while the account exists and afterward only where necessary for legal obligations, security, dispute resolution or suppression of repeated abuse. Support correspondence is kept only as long as needed for the request and related obligations.
8. Cookies and similar storage
We currently use only storage necessary for authentication, registration security, language/interface operation and administration. Account and registration cookies are HttpOnly and SameSite=Strict; production cookies are Secure. Cloudflare Turnstile may use technical signals or storage to distinguish legitimate users from bots.
Product analytics and advertising cookies are not currently enabled. This policy and any consent controls must be updated before non-essential tracking is introduced.
9. Security
We use access controls, transport encryption, Argon2id password hashing, restricted database identities, one-way token digests, rate limits and separation between website and game services. No system can guarantee absolute security. Please contact us promptly if you suspect account compromise.
10. Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction, portability or objection to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent; withdrawal does not affect earlier lawful processing.
Send requests to 1exodusgame@gmail.com. We may need proportionate information to verify that the request concerns your account. We normally respond within one month, subject to lawful extensions.
11. Complaints and automated decisions
You may complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or another competent EEA supervisory authority. Cloudflare Turnstile and automated rate limits may allow or reject a submission for security reasons, but we do not currently make solely automated decisions that produce legal or similarly significant effects about players.
12. Changes and contact
We may update this policy when processing, providers or law changes. Material changes will receive a new version and appropriate notice. Contact SIA Handly at 1exodusgame@gmail.com or the registered address shown on this page.