Version 2026-11-06 · effective November 6, 2026

Privacy Policy

This is a translation. The Brazilian Portuguese version prevails; if in doubt, the reading most favorable to the consumer applies.

1. Who processes your data

1.1. The controller of the personal data processed in Arvorn — the game and the website at playarvorn.com — is ARVORN DESENVOLVIMENTO DE SOFTWARE NÃO CUSTOMIZÁVEL LTDA, trade name Arvorn Studios, CNPJ 69.843.521/0001-07, with its head office at Rua Visconde do Rio Branco, 1488, conjunto 909, 9º andar, Condomínio Universe Life Square, Bloco Comercial, Centro, Curitiba/PR, CEP 80420-210. In this policy, it is referred to as “Arvorn Studios” or “we”. Words such as Account, Character, coins, gold and Premium have the meaning defined in the Terms of Service (item 2.9).

1.2. Privacy channel: suporte@playarvorn.com, preferably with “Privacy” in the subject. This is the channel through which you and the Agência Nacional de Proteção de Dados (ANPD) talk to us about personal data protection: we receive requests and complaints, provide clarifications and receive communications from the ANPD (LGPD, art. 41, §2).

1.3. For questions about the game, your account, purchases and moderation, contact support: suporte@playarvorn.com. The official Discord is an additional channel, never the only one.

1.4. This policy explains what personal data we process, for what purposes, with whom we share it, how long we keep it and how you exercise your rights, in accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD, Law 13,709/2018), the Marco Civil da Internet (Law 12,965/2014) and the ECA Digital (Law 15,211/2025, Brazil’s Digital Statute of Children and Adolescents). The rules for using the service are in the Terms of Service, the Game Rules and Purchases and Refunds.

2. Who this policy applies to

2.1. This policy applies to:

• players who have an Arvorn account;
• anyone who pays for a coin order for an account, even if they are not its holder;
• visitors to the website and the wiki, even without an account;
• anyone who contacts our support, by email, through the game’s tools (such as reports and purchase withdrawal) or on Discord;
• content creators and partners.

2.2. If you only visit the website or the wiki, without an account, we process technical connection data, such as your IP address, to deliver the pages and protect the service against abuse. On your first visit, your browser may query Country.is to choose the language and, if you allow it, ad measurement also works for visitors (section 11). The referral code and how you reached the website are stored in your browser and only reach us when you create an account or sign in to one.

2.3. If you are a content creator or partner, we also process the contact and partnership data you give us — such as your name or stage name, channel, agreed terms and payments — to perform the agreement and comply with tax obligations. This data is kept for as long as the partnership lasts and, afterwards, for the legal retention periods for tax and contractual records.

2.4. When you use third-party services connected to Arvorn — such as Google sign-in, Pix through Mercado Pago or Discord — these services also process your data, under their own policies. This policy does not cover what they do on their own.

2.5. Arvorn is offered from Brazil, to audiences in Brazil and Latin America, and is not directed at residents of the European Economic Area. This policy follows Brazilian law.

3. Data we process

3.1. The table summarizes the personal data we process and where it comes from.

3.2. To play and to buy, we do not ask for your name, CPF, phone number or address, and we do not store your date of birth. For card purchases, the cardholder’s name and CPF are typed on Mercado Pago’s own page, without passing through our systems (item 9.1). In the age declaration, you provide only the month and year you were born; we use this only to check the minimum age, at the time of submission, and we keep only the fact that you declared you are 18 or older and the date of the declaration. If you declare that you are under 18, we do not keep that answer.

3.3. Avoid sending us data we have not asked for, such as documents, in the chat, to support or on Discord.

4. What we use data for and on what legal basis

4.1. Each use has a defined purpose and a legal basis under art. 7 of the LGPD:

4.2. Legitimate interest. We use this basis when the processing is necessary to protect the game, the economy and the players, or for features you can expect from an online game, such as rankings and profiles. Beforehand, we assess whether our interest is legitimate, whether the data is really necessary and whether your rights should prevail (balancing test), and we record that assessment. As safeguards, we use only the necessary data, with restricted access and short retention periods.

4.3. Objection. You may object to processing based on legitimate interest, at suporte@playarvorn.com. We will review your case and reply with the decision and the reason. Processing related to security, fraud prevention and moderation protects all players and may need to continue; other processing, such as the public profile, you can turn off yourself.

4.4. Consent. Ad measurement and browser notifications depend on your consent. You may decline or revoke it at any time, free of charge and without losing anything in the game: for measurement, through the Change measurement preference link (item 10.3); for notifications, in Notifications, in the game menu, or in your browser’s permissions. Revocation applies from then on. Click identifiers already linked to your account’s registration source are not deleted automatically; if you wish, ask for their deletion at suporte@playarvorn.com.

4.5. Sensitive data. We do not ask for or intentionally process sensitive data, such as racial origin, religion, health or sex life. If a reported message, or one removed by the filter, reveals any such data, we process only what is necessary to comply with legal obligations, such as the obligation to preserve and report content of abuse against children and adolescents (LGPD, art. 11, II, “a”), and to exercise rights, including those under the contract (Terms of Service and Game Rules) and in legal proceedings (art. 11, II, “d”). If sensitive data appears in the identification or authentication of an account, we also process it to prevent fraud (art. 11, II, “g”).

4.6. Marketing. We do not currently send marketing emails. If we start sending them, we will ask for your consent beforehand, and you will be able to cancel whenever you want.

4.7. We do not use your data for purposes incompatible with those described here. If a new purpose arises, we will let you know in advance (section 22).

5. What is essential and what is optional

6. Chat and messages

6.1. We store messages to show their history:

• Global chat: public, seen by all players. We keep the last 50 messages for up to 30 days.
• Guild chat: only current members can read it. We keep the last 50 messages of each guild for up to 30 days.
• Private messages: only the participants in the conversation can read them. We keep the last 200 messages of each conversation for up to 30 days.
• Group board: a post stays visible to other players for up to 2 hours and is then deleted. Group requests sent by private message follow the retention period for private messages.

6.2. An automatic filter checks messages in all channels for external links, profanity, sexual content and hate speech, such as racism, xenophobia, Nazism and LGBTphobia. The check is done by machine: no one reads the messages for the filter to work.

• In global chat, a flagged message is replaced for everyone with “[Removed by the automatic filter]”, and the removed text is stored with the alert, for review by moderation.
• In guild chat and private messages, the message is delivered normally. The alert records the channel, the category, the severity, the author and the time, plus an internal code that does not identify the message or the guild and serves only to avoid recording the same alert twice. The alert does not store the text, the terms found or the recipient.

Alerts are kept in our panel for 90 days, and only the administrators can see them; the most serious ones also notify the team through the messaging service described in item 7.9. In guild chat and private messages, these alerts serve only to track how often abuse occurs and to prioritize the review of reports. On their own, they never lead to a mute or any other sanction: a sanction for a private or guild message only happens after a team member sees the message, in the cases in item 6.3, such as a report from a participant. The filter can make mistakes: if a message of yours was removed by mistake, ask for a review at suporte@playarvorn.com.

6.4. Reports. You can report private messages you received and messages in global chat or in your guild’s chat, up to 20 per day. A report stores a copy of the reported message, who reported it, who was reported and the reason, for review by moderation. See how to report in the Game Rules.

6.5. Moderation. Moderators may delete global chat messages: the text is replaced for everyone with a notice that it was deleted, and we keep a copy, with the reason and who deleted it, as a record of the decision. Moderators may also mute characters and suspend accounts, under the Game Rules. The retention periods are in section 16.

6.6. Be careful about what you share. Do not send personal data about yourself or other people in the chat, such as full name, CPF, phone number, address, passwords or receipts. You can ignore players and restrict private messages to friends. To prevent spam, there are limits of 20 private messages per minute and 30 new conversations per day.

7. Security, anti-cheat and moderation

7.1. To protect the game, the economy and the players, our systems automatically record signs of abuse: excessive requests, password-guessing attempts, access through programs other than the official game, malformed messages sent to the server, signs of automation in reflex minigames such as manual fishing (response time, rhythm and how long each key or tap is held, measured in the server's memory during the connection; only the figures of an alert are kept), failed economy checks and payment refunds or disputes requested from the bank or from Mercado Pago. Each record includes the IP address, the account or character, the browser identification (User-Agent), times and counts. These records are kept for about 90 days after the last occurrence, or for the retention period for sanctions if they become evidence, and only the administrators can see them. Withdrawal requests and the refunds we make also generate an internal notice, only so that the team can process the refund; they are not treated as a sign of abuse.

7.2. When someone tries to sign in with an email that has no account, we do not store the email typed: we store only a pseudonymized identifier (a cryptographic digest of it), within the security alert. This identifier is still personal data and follows the same retention period.

7.3. Some automatic and temporary measures protect the service:

• blocking new login attempts for 10 minutes after many failed attempts (30 from the same IP address or 20 on the same account);
• request limits, with temporary refusal when the pace goes above normal;
• refusal of commands sent faster than is possible in the game;
• closing the connection when there are too many messages.

No ban is automatic. Suspensions, bans and IP blocks are decided by people (section 18).

7.4. At registration, at login, at Google sign-in, when the confirmation email is resent and when a new password is requested, we use Cloudflare’s anti-bot check (Turnstile). Cloudflare receives technical data from your browser; then our server sends it the code generated by the check and the IP address of the person signing in, and Cloudflare answers whether the check passed.

7.5. Economy checks. We record gold, coin and item movements to detect errors, duplications and fraud. The detailed record of item movements is kept for about 24 hours (at most 42 hours); the game’s operation history is kept for as long as the account exists.

7.6. Live monitoring. To check for exploits, prohibited programs and other violations, for support and moderation and to fix failures, the administrators may watch live, without prior notice, a mirror of the state of your character on the game server: map, nearby creatures and characters, appearance, level, health, mana, equipment, actions and effects, with about one second of delay. This does not capture your screen, what you type or the windows open in your game. The monitoring is not recorded automatically; when it serves as evidence in an investigation, we keep screenshots or recordings of it with the case, for the periods in section 16.

7.7. Investigations. To investigate abuse, fraud or an attempt to evade a sanction, the administrators may look up the email and characters of the account under investigation and see which other accounts accessed the game from the same IP address. Having more than one account is allowed, and sharing an internet connection with other people is not, by itself, grounds for a sanction: other accounts are only affected with proof of participation or benefit (Game Rules).

7.8. Mutes, suspensions and blocks. When moderation mutes a character, suspends or bans an account or blocks an IP address (the latter being an exceptional measure provided for in the Game Rules), we record the character, the account or the address, the reason, the duration, who applied the measure and when, as well as the evidence used in the decision. While an IP address is blocked, the game refuses access from it, from any account. If you were affected by mistake, for example because you share an internet connection with someone who was blocked, ask to be unblocked at suporte@playarvorn.com. The retention periods are in section 16.

7.9. Internal alerts. Some security and moderation alerts reach the team through a messaging service located outside Brazil, with character names, the type of event (such as the category of a filter alert, including in guild chat and private messages, or the reason for a report) and administrative actions, without emails or passwords.

7.10. Technical logs. Running the server generates technical logs, which are overwritten according to volume, usually within a few days. They may contain the IP address or the email when an error occurs. Access to them is restricted.

8. Access logs

8.1. As an internet application provider set up as a company, we comply with art. 15 of the Marco Civil da Internet. We keep the logs of access to Arvorn: IP address, logical source port (when available), date and time in UTC (Coordinated Universal Time), the account and the type of event (registration, login, Google sign-in, password reset and connection to the game). The connection to the game is recorded at most once every 5 minutes per account and IP address.

8.3. We also store the login IP address together with the session, for the security of your account. The session lasts up to 30 days or until you sign out; the IP address is kept for up to 6 months after the session ends and is deleted within 190 days.

8.4. Access logs serve to comply with the law and with court orders. They and the IP address stored with the session also serve the security of your account and the investigations described in section 7, such as checking who accessed the account when there are signs it was hacked (Game Rules, item 9.9).

9. Payments

9.1. Coins are paid for with Pix, processed by Mercado Pago. To generate the Pix charge, we send Mercado Pago only your account email, the amount, the order number and the title “Arvorn Coins · N”, where N is the number of coins. Premium, Farm land and outfits can also be paid for by credit card. In that case, we send Mercado Pago only your account email, the amount, the order number and the item’s title (for example, “Arvorn Premium · 30 dias”), and the payment is made on Mercado Pago’s own page (mercadopago.com.br), opened in a new tab: that is where you type the card number, expiry date and security code and the cardholder’s name and CPF. We do not receive the card number or the CPF, and this data is not saved in your browser. Mercado Pago’s page follows Mercado Pago’s privacy and cookie policies.

9.3. From each order, we keep: number, account, package, coins or Premium days, payment method, amount, status, dates (creation, payment and chargeback), Mercado Pago order code, referral commission, unrecovered amount from chargebacks and the version of the documents you accepted. We keep these records for up to 10 years from payment, with only the minimum data, to comply with tax law and to exercise or defend rights in any disputes.

9.4. When Mercado Pago informs us that a payment was refunded or disputed, we record the event on the order, along with an internal alert (section 7). The effects on coins are described in Purchases and Refunds. The refunds we make, such as on withdrawal, are also recorded on the order and in the support case.

9.5. Invoice (nota fiscal). We issue the tax document in accordance with applicable law, and you can request it at suporte@playarvorn.com (Purchases and Refunds). If tax law comes to require the buyer’s identification on the invoice, we will collect only what is necessary for that, with prior notice.

9.6. If a refund through the original Pix is not possible, we will ask for a Pix key for an account held by the same person who made the payment or, in the event of their death, by whoever is entitled to receive the refund. We use this key only for the refund and delete it within 30 days after the proof of transfer.

9.7. To resolve payment problems, the order number is usually enough. If you need to send a receipt, send it only to suporte@playarvorn.com and, if you wish, cover the CPF. Do not send documents or receipts through the game chat or on Discord.

9.8. Sales. To know whether your Account can receive a sale’s first-purchase gift (Purchases and Refunds, item 11.6), the game checks the order record of item 9.3 for a payment of at least the minimum. The check happens only in the game, while the sale runs, and is not used for advertising outside it or for profiling. We keep which sale applied to each purchase and each gift granted, for the same period as the orders.

10. Cookies and browser storage

10.1. We use cookies and browser storage (localStorage and sessionStorage) to make login work, remember your choices and, only if you allow it, measure ads. We do not use cookies to personalize ads.

10.2. Your choice. On your first visit, the “Measurement cookies” notice offers “Decline” and “Allow measurement”, with the same prominence and nothing preselected. Declining changes nothing in the game. Your choice is stored for 180 days; after that, we ask again.

10.3. Changing your mind. You can change your choice at any time: Change measurement preference. If you decline after having allowed it, we stop sending new events and delete the measurement cookies accessible on our domain. This does not delete data that Google has already received; for that data, Google’s tools and policy apply. Nor does it delete the click identifiers already linked to your account, which you can ask us to delete (item 4.4).

10.4. You can also block or delete cookies and site data in your browser settings. If you block the necessary cookies, login stops working; if you clear the storage, the game forgets your preferences.

11. Ad measurement, registration source and external services

11.1. Ad measurement (optional). If you allow it, we use the Google Ads tag and cookies to find out which ads bring new registrations. With your permission, the tag loads on the website and game pages in this browser, and Google receives your IP address, browser data, the address of the page visited (without personal parameters) and ad click identifiers.

11.2. When you create an account with measurement allowed, we send Google a registration event with a random code, so that Google can match the registration to a possible ad click. This event does not include email, password, account identifier or character data.

11.3. Measurement without profiling. If you allow it, the tag may load on the website and game pages before any registration or age declaration. For this reason, the integration keeps ad personalization and Google signals turned off, and we use measurement only to find out which ads bring new registrations. The registration event is only sent when an account is created, and only if you have allowed measurement. We do not use Arvorn data to build advertising profiles of anyone, including children and adolescents, nor do we use your age declaration for that purpose.

11.4. Google processes this data as an independent controller, under the Google Privacy Policy. Measurement involves a transfer of data to the United States, made with your consent; the cookie notice informs you of this destination before you choose (section 15).

11.5. Registration source. On your first visit, the browser stores, for up to 90 days, how you arrived: the link’s campaign parameters (utm), the domain of the website you came from, the landing page, the date and whether you arrived through an ad (only the type of click). Ad click identifiers, such as gclid, are only stored if you allow measurement. When you create the account, this information is associated with it and is used only for marketing statistics: it does not affect rewards, referrals or moderation. The legal basis is legitimate interest; for click identifiers, consent.

11.6. Initial language. If the browser does not yet have a saved language, it queries the Country.is service once; the service receives your IP address and indicates the country, so that we can choose the initial language. This query does not send cookies, account details or the page visited. If it fails, we use English. When you choose a language, the choice is saved in your browser.

11.7. Videos and images in system messages. Some system messages in the game may include YouTube videos, in no-cookie mode, and images hosted on other websites. They load when the message is displayed, and these services receive your IP address and browser data, under their own policies.

12. Browser notifications

12.1. Browser notifications start turned off, and each type is turned on separately: end of the offline hunt and arrival of Mail shipments; and guild war.

12.2. When you turn on a notification, we store, linked to your account, the address of your browser’s notification service, the encryption keys it creates, the language and the types of notification chosen. When you leave a hunt, we record the expected time of the notification and delete it when you return or after it is sent.

12.3. Messages are encrypted and carry only what is necessary: the hunt notification, the names of the character and the hunt; the Mail notification, the names of the character and the sender; the guild war notification carries no names. They are delivered by your browser’s notification service, such as those of Google, Mozilla, Apple and Microsoft.

12.4. To turn them off, use Notifications, in the game menu, or your browser’s permissions. We delete addresses that the service reports as expired. The legal basis is your consent, which you can withdraw at any time.

13. Public profiles and in-game visibility

13.1. Public profile. Each character has a public profile, turned on by default, that shows name, vocation, level, magic level, power, guild, equipment, bestiary, aura, achievements and creation date. The profile is on the website and may appear in search engines. To turn it off, use Settings → Public profile. Search engines may take some time to update their results.

13.2. Rankings and events. The rankings, the Hall of Fame and the world boss show character names and results to other players, in the game and on the website.

13.3. Arena replays. They are visible to signed-in accounts for 8 hours and are then deleted.

13.4. Fishing tournament. Entry is free. To apply the rule of one podium spot per IP address, we keep the entry IP address for 30 days after the round. In manual fishing, the characters fishing from the same connection (the same IP address; for IPv6, the same /64 network) share the daily limit of fish at the manual pace. To do this, the server counts the fish of each address only in memory, until the day turns, without recording the address; the character keeps only the day's fish count. The Gem Mine follows the same rule for the day's 40 walls: the characters on the same connection share the limit, counted only in the server's memory until the day turns, without recording the address; the character keeps only the day's wall count.

13.5. Promotion. We use images of the game in videos and promotional materials. Player names are changed or omitted, unless you give specific authorization.

13.6. Showing profiles, rankings and results is based on our legitimate interest in displaying what happens in the game. You can turn off the public profile in Settings → Public profile. Showing your name and results in rankings and events is part of the game (section 5); even so, you can object at suporte@playarvorn.com, and we will review your case as explained in item 4.3. Replays are part of the arena service.

14. Who we share data with

14.1. We do not sell your personal data. We share only what is necessary, with the providers and partners below, and with authorities, when the law requires it.

14.2. Processors process data on our behalf, following our instructions, with a duty of security and confidentiality:

14.3. Independent controllers make their own decisions about the data they receive, under their own policies:

• Mercado Pago (Brazil): processes Pix and card payments; receives from us the account email, the amount and the order number and processes the payer’s data, including the card number and the cardholder’s CPF, typed on its page;
• Google (United States): Google sign-in, if you choose it; ad measurement, if you allow it; YouTube videos in system messages;
• Discord (United States): community and optional support, if you use it;
• TopIdle: voting website; when you vote, we send it only a vote code, which does not reveal your email or your account, and your visit to its website is governed by TopIdle’s own policy;
• Country.is (outside Brazil): choice of the initial language, with your IP address;
• websites that host images displayed in system messages, which receive your IP address and browser data;
• authorities, when the law requires it (section 21).

14.4. Other players see what is public in the game: characters’ names and progress data, global chat messages, the public profile and rankings. Whoever referred you sees how many accounts they referred and the total coins they received in commission, without your email or your characters. If you are the only account referred by that person, this total may reveal how many coins you bought.

14.5. You can request the complete, up-to-date list of providers, with names and countries, at suporte@playarvorn.com.

14.6. In the event of a corporate reorganization of Arvorn Studios, the data may pass to the successor company, which will remain bound by this policy. We will notify you beforehand.

15. International transfer

15.2. We transfer data outside Brazil to host and operate the game, keep backups, protect the service against bots and abuse, send emails and notifications, alert the team and, with your consent, measure ads.

15.3. These transfers rely on art. 33 of the LGPD:

• necessity for performing the contract with you (art. 33, IX, combined with art. 7, V), for hosting and for the services essential to the game;
• your specific and prominently highlighted consent (art. 33, VIII), for ad measurement;
• an adequacy decision by the ANPD (art. 33, I), when the destination is a country recognized as adequate, such as the European Union (Resolution CD/ANPD No. 32/2026).

15.4. As safeguards, we require security and confidentiality from providers, share only the necessary data, encrypt the backups sent to the cloud and limit access. Your rights (section 17) also apply to transferred data, and you can file a petition with the ANPD.

16. How long we keep data

16.1. We keep data only for as long as necessary for each purpose. The table shows the maximum periods.

16.2. At the end of the period, we delete the data or anonymize it, so that it no longer identifies you. We only keep it longer to comply with a legal obligation, to exercise rights in judicial, administrative or arbitration proceedings, or when there is a preservation request from an authority or a court order.

16.4. Shutdown of the service. If Arvorn is shut down, we will give advance notice, as explained in the Terms of Service. Until the service ends, and for as long as we keep your data, you can exercise your rights, including requesting a copy of your data (item 17.6). After the shutdown, we delete or anonymize the data, except the data that the table in item 16.1 requires us to keep, for the periods stated there, including the data necessary for the shutdown refunds.

17. Your rights

17.1. Under the LGPD (art. 18), you may, at any time:

• confirm whether we process your data;
• access your data;
• correct incomplete, inaccurate or outdated data, such as your account email;
• request the anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;
• request the portability of your data to another provider;
• request the deletion of data processed with your consent;
• know with whom we share your data;
• know that you may refuse consent and what happens if you refuse;
• revoke your consent;
• object to processing (item 17.7);
• request a review of decisions made solely by automated means (section 18).

17.2. How to make a request. Write to suporte@playarvorn.com from the email registered to your account. If you cannot use that email, we will ask for another way to confirm that the account is yours, using only the information necessary for that. You may also make the request through a legal representative, with a power of attorney or a document proving the representation. We will never ask for your password.

17.3. Free requests and response times. Requests are free of charge. We acknowledge receipt of each request automatically or on the same business day and reply within 5 days. Confirmation that we process your data and access in simplified form are provided immediately, as soon as we confirm that the request comes from you. Requests that need more time, such as the complete statement (with the origin of the data, the criteria used and the purposes), portability, account deletion, correction, deletion of data, objection and review, are completed within 15 days of the request; in these cases, the reply within 5 days says what has already been done. If we cannot fulfill a request, we will explain why or tell you who processes the data.

17.4. Account deletion. There is no account deletion button in the game: request it at suporte@playarvorn.com. Within 15 days, we delete or anonymize the account’s data and, with it, the characters’ data. Deleting a character in the game is different: the character is archived and the name is released, but its data remains linked to the account until the account is deleted.

17.6. Access and portability. On request, we provide a copy of your data in a commonly used electronic format, until the ANPD regulates portability otherwise. In access and portability responses, we protect trade and industrial secrets and other people’s data: for example, we do not reveal who made a report against you, except under a court order or legal obligation (Game Rules).

17.7. Objection. You may object to processing based on legitimate interest, as set out in item 4.3, and to any processing carried out without your consent that does not comply with the law.

17.8. Revoking consent. For ad measurement, use Change measurement preference; for notifications, use Notifications, in the game menu. Revocation applies from then on.

17.9. A suspended or banned account does not prevent you from exercising these rights. Even without access to the game, you can make your requests at suporte@playarvorn.com and withdraw from a purchase within the legal period (Purchases and Refunds).

17.10. Complaints. You can file a petition with the Agência Nacional de Proteção de Dados (ANPD), through the gov.br/anpd website, and turn to consumer protection bodies, such as Procon (Brazil’s state consumer protection agencies) and the consumidor.gov.br platform.

18. Automated decisions and human review

18.1. Some decisions that may affect you are made by automated systems, without a person involved:

• the removal of global chat messages by the automatic filter and the recording of filter alerts;
• temporary security blocks: login blocked for 10 minutes after many failed attempts, request limits, refusal of commands above the possible pace and closing the connection due to too many messages;
• the result of the anti-bot check at registration, at login, at Google sign-in, when the confirmation email is resent and when a new password is requested;
• preventing registration, or entry into the game with an existing account, by anyone who declares they are under 18;
• when Mercado Pago informs us that a payment was refunded or disputed: the removal of a number of coins equal to that of the purchase, up to the available balance, the removal of the corresponding commission from whoever referred the account and, while any amount remains unrecovered, the blocking of new coin purchases (Purchases and Refunds);
• in the fishing tournament, applying the rule of one podium spot per IP address;
• in manual fishing, sharing the daily fish limit among the characters on the same connection (same IP address);
• in the Gem Mine, sharing the daily wall limit among the characters on the same connection (same IP address).

18.2. Sanctions are decided by people. Automated systems only make the decisions in the list above. Mutes, suspensions, bans, IP blocks and the removal of items or benefits for violations always go through human review (Game Rules); after a payment is refunded or disputed, the account is only suspended after human review. You can request a review of any automated decision (item 18.4).

18.4. Human review. To ask a person to review an automated decision, write to suporte@playarvorn.com, with the character, the approximate date and what happened. We will reply with the result of the review and the reason. Defenses and appeals against sanctions follow the Game Rules.

19. Children and adolescents

19.2. Age declaration. In email registration, and on the “Before you continue” screen, shown to older accounts and to people who register through Google, you provide your month and year of birth. We use this only to check the minimum age, at the time of submission, and we keep only the fact that you declared you are 18 or older and the date of the declaration, never your date of birth or CPF. Anyone who declares they are under 18 cannot continue: in email registration, the account is not even created; in Google registration and for older accounts, the account is barred from entering the game. We do not keep that answer. If the account belongs to a minor, the parents or guardians may request its deletion and a refund of the purchases (item 19.4).

19.3. Proof of age. If there are reasonable grounds to believe that an account is used by a minor, we may ask for proof of age proportionate to the risk, always through suporte@playarvorn.com. We ask only for the minimum necessary to check the age, and you may cover on the documents any data we do not need. This data serves only for this check. We do not use facial recognition or process biometric data. Right after the check, we permanently delete the documents and images received, including the message and the attachments, and we keep only the result (18 or older: yes or no) and the date. If we start requiring proof of age from all accounts before they buy coins, use coins on the market or use random-outcome mechanics (Terms of Service, item 3.3), we will announce in advance, in the game and on the website, which means will be used and, if applicable, which provider will carry out the check, as a processor, under the same rules of minimum necessary data and deletion; if the means requires other data, this policy will be updated beforehand. You may contest the result at suporte@playarvorn.com. We do this to comply with the ECA Digital (Law 15,211/2025, art. 13; Decree 12,880/2026, arts. 24 and 27). The proof-of-age data is not used for any other purpose, not even to build profiles; the result and the date are kept only as proof that the check was carried out (section 16).

19.5. No profiling. We do not carry out profiling for advertising aimed at children and adolescents, and age data is not used to create profiles or for advertising.

19.6. Protection. Exploitation, sexual abuse and grooming of children and adolescents are treated with zero tolerance: the content is removed, preserved and reported to the competent authorities, including the Polícia Federal (Brazil’s Federal Police). Reports made by victims, guardians, the Ministério Público or protection organizations take priority. See the Game Rules and the Terms of Service.

20. Information security and incidents

20.1. We adopt technical and administrative measures to protect your data, including:

• encrypted connections (HTTPS), with the browser instructed to always use the encrypted connection (HSTS);
• passwords stored only as a cryptographic digest (bcrypt), never in plain text;
• session codes stored only as a cryptographic digest, and email confirmation links (valid for 24 hours) and password reset links (valid for 1 hour) that work only once;
• session cookies that page scripts cannot access (HttpOnly);
• anti-bot checks, attempt limits and monitoring of abuse signals;
• database on an internal network, with no direct access from the internet;
• restricted administrative access, through a private, encrypted channel, with authentication of each request;
• backups encrypted before being sent to cloud storage.

20.3. Incidents. If a security incident occurs that may pose a significant risk or harm to you, we will notify the ANPD and the affected people in the manner and within the deadlines set by Resolution CD/ANPD No. 15/2024. The notice, in plain language, will say what happened, which data was affected, the risks, the measures taken and what you can do. If it is not possible to notify each person, we will publish the notice on our official channels.

21. Requests from authorities

21.1. Access logs are only handed over to third parties under a court order, in all cases (Marco Civil da Internet, art. 15, §3). Data that identifies you and the content of private messages are only handed over to authorities or to other people under a court order (arts. 10 and 22), except for: the sharing with providers and partners described in section 14, limited to what is necessary for each service; the registration data in item 21.2; the mandatory reporting in item 21.4; and what is necessary for us to respond to complaints and inspections, such as those of Procon, consumidor.gov.br and the ANPD, and to exercise our rights in legal proceedings and in payment disputes. You can request your own data at any time (section 17).

21.2. Registration data (dados cadastrais), that is, personal details, parentage and address, may be requested by an administrative authority with legal competence, in a reasoned and specific request. As a rule, we do not collect this data; when applicable, we inform the authority of this.

21.3. The police or an administrative authority and the Ministério Público may ask us to preserve access logs for more than 6 months. We keep the request confidential and store the logs while it remains valid. If the authority does not apply for judicial authorization within 60 days of the request, or if the judge denies it, the preservation lapses and the logs return to the normal period (Marco Civil da Internet, art. 13, §§3 and 4, and art. 15, §2). We only hand over the logs under a court order.

21.4. Content involving the sexual exploitation or abuse, kidnapping or grooming of children and adolescents is removed, preserved and reported to the competent authorities, including the Polícia Federal, and the related data is kept for the legal period (ECA Digital, art. 27).

21.5. We review each request. We refuse those that have no legal basis and challenge, through the appropriate means, generic or disproportionate orders; valid orders are complied with within the limits of what was ordered. When the law allows it and doing so does not harm an investigation, we notify the user of the request.

22. Changes to this policy

22.1. We may update this policy when the service or the law changes. Each version is dated and recorded in the version history.

22.2. Material changes will be announced at least 15 days in advance, in the game, on the website and by email. Changes that only reduce risks for you or that the law requires may take effect sooner. If a change affects processing that depends on your consent, we will ask for your consent again. If you do not agree with a change, you may exercise your rights (section 17) or close your account.

22.3. The Brazilian Portuguese version of this policy prevails. The English and Spanish versions are translations; in case of doubt, the interpretation most favorable to you applies.

23. Contact

• Support and privacy: suporte@playarvorn.com, for data subject requests, questions about this policy, communications from the ANPD, your account, purchases, withdrawal, moderation and reports. We acknowledge receipt automatically or on the same business day and reply within 5 days.
• Address: Rua Visconde do Rio Branco, 1488, conjunto 909, 9º andar, Condomínio Universe Life Square, Bloco Comercial, Centro, Curitiba/PR, CEP 80420-210.
• Official Discord: discord.gg/jeb4VVBZGT, an additional community and support channel, never the only one. Conversations there follow Discord’s rules; do not send personal data or documents there.
• Agência Nacional de Proteção de Dados (ANPD): gov.br/anpd.

24. Version history

• 2026-11-06 — Gem Mine: daily wall limit shared among the characters on the same connection, counted only in the server's memory (items 4, 13.4, 16 and 18.1).
• 2026-11-06 — Shop sales: the order record is checked to know whether the Account can receive the first-purchase gift, and we keep which sale applied to each purchase (item 9.8).
• 2026-11-05 — Signs of automation in reflex minigames such as manual fishing (item 7.1). Manual fishing stamina shared among the characters on the same connection, counted only in the server's memory (items 4, 13.4, 16 and 18.1).
• 2026-11-04 — Credit card purchases (Premium, Farm land and outfits): the payment is made on Mercado Pago’s own page, which receives the card data and the cardholder’s CPF without passing through our systems or staying in the browser; what we send Mercado Pago and what we keep from the order (items 3.2 and 9.1 to 9.3, suppliers and retention periods).
• 2026-10-30 — New version, with the identification of Arvorn Studios (CNPJ 69.843.521/0001-07), the privacy channel, tables of data, purposes, legal bases and retention periods, the access logs required by the Marco Civil da Internet, the confidentiality of private messages and guild chat, the 18+ rule, international transfer and data subject rights. Effective October 30, 2026.
• 2026-10-27 — Alpha Privacy Policy (previous version).