Privacy Policy

PlunWorld ("the Game") is developed and operated by GameMax ("we", "us"). This Privacy Policy explains what information we collect when you play PlunWorld or visit this website, how we use it, and the rights and choices you have.

Privacy at a glance

• 🎮 Play without an identity — you only need a made-up username and a password. No real name, no phone number, no email required.
• 🚫 No ads, no trackers — the Game contains zero advertising, analytics or tracking SDKs, and does not track you across other apps or websites.
• 📵 No sensitive permissions — the Game does not request access to your location, camera, microphone, contacts or photos.
• 💳 We never see your payment details — all payments are handled by Apple and Google.
• 🗑️ Delete anytime — remove your account and all data in-game, or via our account deletion page.
• 🤝 We never sell your data — to anyone, for any reason.

1. Who we are

GameMax is the developer and data controller for PlunWorld. Contact for all privacy matters: support@plunworld.live

2. Information we collect

2.1 Summary table

Data	Examples	Required?	Why we collect it	Shared with third parties?
Account credentials	Username, password (stored as a bcrypt hash)	Yes	Sign-in, keeping your progress	No
Email address	Recovery email (verification codes stored as one-way hashes)	Optional	Account recovery, security alerts	Delivery only (Resend)
Purchase records	Store receipt, store transaction ID, product, status	Only if you buy	Crediting purchases, preventing fraud, refunds	Apple / Google (validation)
Gameplay data	Character stats, currencies, in-world position, inventory, mounts, quests, clan, market activity, combat logs	Yes (created by playing)	Running the Game, saving progress	No
Technical & security data	IP address and in-game actions in security logs, session identifiers	Yes	Security, anti-cheat, fraud prevention	No

2.2 What we do NOT collect

We do not collect your real name, phone number, physical address, GPS or precise location, contacts, photos, microphone or camera data, device fingerprints, or any advertising identifier (IDFA / GAID). Registration works without an email address.

Chat messages are not stored. Chat is relayed live to nearby players only and is never written to our database. Once the chat bubble fades, the message is gone.

2.3 Purchases

Payments are processed entirely by the Apple App Store or Google Play under their own terms. We never receive or store your card or bank details. To credit purchases and handle refunds we store the store receipt, transaction ID, product ID and purchase/refund status.

2.4 Technical and security data

• IP address — recorded in our security and anti-cheat logs together with significant in-game actions (logins, currency changes, trades), and included in the security alert emails we send you so you can recognise suspicious activity on your account.
• Session identifiers — keep you signed in; sessions expire after 24 hours.
• Website cookie — this website stores a single functional cookie (your language choice). No analytics or advertising cookies are used.

3. How we use information — and our legal bases

Purpose	Data used	Legal basis (GDPR Art. 6)
Operate the Game and save your progress	Account, gameplay data	Contract performance
Validate purchases and handle refunds	Purchase records	Contract performance, legal obligation
Detect cheating, fraud and account theft	Security logs, gameplay data	Legitimate interest (fair play & security)
Account recovery and security alerts	Email (if provided)	Consent
Comply with law (tax, consumer protection)	Purchase records	Legal obligation

We do not use your data for advertising, we do not build marketing profiles, and we do not sell or rent personal data to anyone.

4. Who we share data with

• Apple / Google — purchase receipts are validated with their servers; they already hold your payment relationship.
• Resend (email delivery provider) — receives your email address solely to deliver the transactional emails described above, and only if you added an email.
• Hosting infrastructure — our servers and encrypted backups run on infrastructure under our control; game asset files (images, sounds) are served from a CDN that holds no player data.
• Authorities — if required by law, or where necessary to protect our players and services.

We never sell personal data, and no third party receives your data for advertising or analytics.

Other players can naturally see your username, character appearance, clan, and your public actions in the world (including your market listings) — that is inherent to a multiplayer game.

5. Data security

• All traffic between the Game, this website and our servers is encrypted in transit (TLS/HTTPS).
• Passwords are hashed with bcrypt; recovery and verification codes are stored as one-way hashes and expire quickly.
• Access to production systems is restricted to authorised personnel, protected by two-factor authentication, and logged.
• Backups are rotated automatically and stored on infrastructure we control.
• If a data breach occurs that is likely to put your rights at risk, we will notify affected players and the competent authorities without undue delay, as required by applicable law.

6. Data retention

Data	Kept for
Account & gameplay data	As long as your account exists
Security & combat logs (incl. IP)	As long as needed for anti-cheat and security investigations, then removed in periodic cleanup
Purchase records	As long as required for accounting, refunds and store compliance
Rotating backups	Overwritten automatically on a fixed schedule

When you delete your account, all account and gameplay data is removed immediately and permanently; residual copies in rotating backups are overwritten within the normal backup cycle.

7. Your rights

Depending on where you live — including under the EU/UK GDPR, the California CCPA/CPRA, and Vietnam's Decree 13/2023/ND-CP on Personal Data Protection — you have the right to:

• Access the personal data we hold about you (most of it is visible in-game);
• Correct inaccurate data;
• Delete your data (see Section 8);
• Object to or restrict certain processing;
• Data portability — receive a copy of data you provided;
• Withdraw consent at any time (e.g. remove your recovery email);
• Complain to your local data protection authority.

We never discriminate against players for exercising their rights. To exercise any right, contact support@plunworld.live — we respond within 30 days.

8. Account and data deletion

You are always in control:

1. In the Game: open Settings → Delete Account. Deletion is immediate and permanent — your account and all associated gameplay data are removed.
2. On the web: if you can no longer access the Game, follow the steps on our Account Deletion page — no app installation required.

Records we are legally required to keep (e.g. purchase records for tax and refund compliance) are retained only for the mandated period, isolated from any further use.

9. Children

PlunWorld is not directed at children under 13, and in line with COPPA we do not knowingly collect personal information from children under 13. Because registration requires no name, email or other personal details, the data we hold about any player is minimal by design. If you believe a child under 13 has provided us personal information, contact us at support@plunworld.live and we will delete it promptly.

10. App permissions

The Game requests no sensitive device permissions: no location, no camera, no microphone, no contacts, no photo library, no external storage access. It only needs a network connection to play.

11. Automated decision-making

We do not make automated decisions that produce legal or similarly significant effects about you. Anti-cheat systems may flag suspicious activity automatically, but any sanction (lock or ban) is reviewed and decided by a human, and you can appeal via support.

12. International data transfers

Our servers may be located in different regions (for example Asia). Where data is transferred internationally, we protect it with the safeguards described in this policy and as required by applicable law.

13. Changes to this policy

We may update this policy as the Game evolves. Material changes will be announced in-game or on this website before they take effect, and the "Last updated" date above will be revised. Where required by law, we will ask for your consent.

14. Contact us

GameMax — PlunWorld team Email: support@plunworld.live Website: https://plunworld.live

We aim to answer every privacy request within 30 days.