Privacy Policy

Effective October 13, 2026.

This policy explains what data DeathMatcHeroes (the game at deathmatcheroes.com.br and deathmatcheroes.com, the desktop app and the game's pages on game portals) collects from players, what it is used for, who it is shared with, how long it is kept and how you exercise your rights under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). This English version is a translation; if the versions differ, the Portuguese one prevails.

In short: we keep only what the game needs to work (your account, your progress and your purchases). We don't sell data, don't show ads and don't use advertising trackers. Your e-mail and date of birth are never shown to other players. You can delete your account at any time from your Profile.

1. Who is responsible

The data controller is DeathMatcHeroes. For anything about privacy, including requests about your data, write to admin@deathmatcheroes.com.

2. What data we collect

When you create an account

Player name: public; shown in matches, on your profile and to your friends.
E-mail (optional): to sign in, confirm the account, recover your password and confirm account deletion.
Date of birth: to check the minimum age of 13. Never shown to other players.
Password: stored only as a cryptographic digest (salted scrypt hash); nobody can read it, not even us.
Language of the page at sign-up, so e-mails reach you in your language.
Acceptance of this policy: the accepted version and when you accepted it.

Without an account (guest)

Guests don't create an account: the name you type is shown to the other players during the match and is not stored in the database.

While you play

Progress and gameplay: trophies, wins and losses, statistics, the history of your last 30 matches (with the name, hero and performance of everyone who played in them), heroes, items, gold, diamonds, proficiency, pets, campaign, tutorial, daily reward and sound settings.
Friends: your friend code, friend list, requests and blocks. Your friends see whether you are online or in a match and can watch your matches live; anyone with a room's code can also watch that room's match.
Arena chat: messages go to whoever is in the Arena at that moment, pass through a profanity filter and are not stored.
Last access: the day and hour (no minutes) you last signed in.

Purchases

Payments (diamonds and subscription) are made through Mercado Pago. Card, Pix or boleto details stay with Mercado Pago; we never receive them.
We keep each payment's identifier, the package, the number of diamonds or subscription days and the date, to credit the purchase, handle chargebacks and prevent fraud.

Technical data

IP address: used only in the server's memory, for a short time, to limit sign-in and sign-up attempts, count visits without repeats, check the sign-up captcha and keep accounts from the same network from facing each other in matches. It is not written to the database.
Approximate country and browser language: to open the game in your language on your first visit.
Visit source: the promotion channel of the link that brought you (for example, a video or a game portal) or the site the click came from. It is kept on your device and, if you create an account, on the account too. We count visits per day and per channel with nothing that identifies you.
Device type: whether you arrived on a phone, tablet or computer, whether the screen was upright or sideways, and how many seconds the game took to load. It only goes into the per-day, per-channel counts (pages served, visits, matches played without an account and sign-ups) and is not kept on your account.
Server technical records (logs), which may include the player name in some events (for example, entering the Arena or deleting the account).

On your device

The game does not use its own cookies. It keeps in the browser's local storage: your account session, your preferences (language, volumes, keys, zoom, chosen hero and mode), the visit source and whether you have visited the site before. You can erase all of it by clearing the site's data in your browser. Cloudflare's captcha, shown only at sign-up, may use its own cookies.

3. What we use it for and on what legal basis

Purpose	Legal basis (LGPD, art. 7)
Create and maintain your account, run matches, keep your progress, friends and spectators	Performance of a contract (the service you request by creating an account and playing)
Account e-mails: confirmation, up to two reminders to confirm, new password and deletion confirmation. We don't send marketing e-mails.	Performance of a contract
Sell diamonds and the subscription, handle chargebacks	Performance of a contract and compliance with legal obligations
Security: limit attempts, captcha, prevent cheating and match fixing, block an account when a purchase of already-spent diamonds is charged back	Legitimate interest and regular exercise of rights
Learn, in aggregate, which promotion channels bring players	Legitimate interest
Check the minimum age	Performance of a contract and legitimate interest (protection of children)

4. Who we share it with

We don't sell or rent your data. It only goes through the providers that make the game work, each with only what it needs:

Fly.io — hosting of the server and database, in São Paulo (Brazil).
Cloudflare — network and DNS for one of the domains and the sign-up captcha (Turnstile); receives your IP and technical browser data.
Resend — sends the account e-mails; receives the e-mail address, player name and message text.
Mercado Pago — processes payments, as an independent controller of payment data, under its own policy.
Google Fonts — the page fonts are downloaded from Google's servers, which receive your IP.
GitHub — when you download the Windows app, the download comes from GitHub.
Game portals (itch.io, Newgrounds, Game Jolt) — if you open the game through them, the portal's page follows its own policy.
Other players — see your player name, hero, match performance, public profile and what you write in the Arena chat.
Authorities — when required by law or a court order.

Some of these providers process data outside Brazil, mainly in the United States. These transfers follow the safeguards set out in the LGPD (art. 33), such as the data protection clauses in the providers' contracts.

5. How long we keep it

Account and progress: while the account exists.
Unconfirmed account: deleted automatically after 7 days.
Session: 30 days. E-mailed links: confirmation 24 hours, new password 1 hour, deletion 1 hour.
History: only each account's last 30 matches.
Visit counts per channel and per device: 6 months.
After account deletion: the account leaves the database immediately, along with its sessions and friend links. The server's backup copies are replaced within a few days. Your player name may still appear in the recent match history of people who played with you, until those matches drop out of their history. Payment records remain with Mercado Pago, under its rules.

6. Your rights

Under the LGPD (art. 18) you may request: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share it with, withdrawal of consent where consent is the basis, and review of automated decisions. You may also object to processing based on legitimate interest.

In the game: on your Profile you see your data, add an e-mail and delete the account.
By e-mail: write to admin@deathmatcheroes.com from the account's e-mail (or include your player name). We reply within 15 days.
You may also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd, or with the data protection authority where you live.

7. How to delete your account

In the game, open Profile → Delete account and type your password. If the account has an e-mail, we send a confirmation link and the account is deleted when you open it; without an e-mail, it is deleted right away. If you can't sign in, request deletion at the e-mail above.

8. Children and teenagers

You must be at least 13 years old to create an account. Players under 18 should play with the knowledge of their parents or guardians, and purchases should be made by them or with their permission. If we learn that an account belongs to someone under 13, it will be deleted. Parents and guardians can request deletion at the e-mail above.

9. Security

The site and the game's connections are encrypted (HTTPS and WSS), passwords are stored only as hashes, access to the server is restricted and sign-up has a captcha and attempt limits. No system is completely secure: if an incident could bring you relevant risk or harm, we will notify you and the ANPD, as the law requires.

10. Changes to this policy

When this policy changes, the date at the top of the page changes too. If the change is important, we will announce it on the site and, when needed, ask for your acceptance again.

11. Contact

DeathMatcHeroes · admin@deathmatcheroes.com