Privacy Policy

Effective date: LEGAL-PLACEHOLDER — set on first publication.

This Privacy Policy describes what information the Abossi Online website and app ("the Service") collect, how it is used, and the choices you have. The Service is operated by LEGAL-PLACEHOLDER — set legal entity and country.

LEGAL-PLACEHOLDER — This document is a drafting template. Jurisdiction-specific rights (GDPR, UK GDPR, CCPA/CPRA, LGPD, PIPEDA, etc.) require legal review before publication.

1. Information we collect

Subscribe form: first name, email, and consent timestamp.
Support form: email, optional character ID, optional username, issue description, and optional image attachments.
Server logs: hashed IP address (HMAC-SHA256, salted), hashed user-agent, request id, timestamp, and HTTP status. Raw IP and user-agent are not retained on the website's storage layer.
Game account (app): account email, character data, gameplay state. Described separately when the app launches.

2. Cookies

The Abossi Online website sets exactly one first-party cookie:

Name	Purpose	Lifetime
cookie-consent	Stores your accept/reject decision so the banner is not shown again.	12 months

The forms on this site use Google reCAPTCHA Enterprise to filter automated abuse. Google may set its own cookies or use local storage on the form pages; see Google's Privacy Policy. We do not use any analytics, advertising, or third-party tracking cookies on this site.

3. How we use information

To send the update emails you opted in to.
To respond to support requests.
To detect and prevent abuse of the Service.
To operate, maintain, and improve the Service.

4. Where information is stored

Subscribe entries are stored in a private Google Sheet inside the operator's Google Workspace.
Support tickets are stored in a private Google Sheet; image attachments are stored in a private Google Cloud Storage bucket with public access prevention enforced.
Server logs are stored in Google Cloud Logging in the operator's Google Cloud project.

5. Retention

Subscribe entries: until you unsubscribe or request deletion.
Support tickets: row metadata kept indefinitely; image attachments are auto-deleted after 90 days by a Cloud Storage lifecycle policy.
Server logs: 30 days.

6. Sharing

We do not sell your information. We share information only with the service providers required to operate the Service (currently Google Cloud) and as required by law.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your information, and to object to certain processing. To exercise these rights, use the support form with the email associated with your data.

LEGAL-PLACEHOLDER — This section must enumerate jurisdiction-specific rights and complaint pathways (e.g., DPA contact in the EU/EEA) before publication.

8. Children

The Service is not directed to children under 13 (or the age required in your jurisdiction). We do not knowingly collect data from such children.

9. Security

We use service accounts with least-privilege IAM, enforce HTTPS in transit, and store attachments in a private bucket with public access prevention. No system is perfectly secure; please report concerns via support.

10. Changes

We may update this Privacy Policy. Material changes will be announced on the website.

11. Contact

Questions about this Privacy Policy? Use the support form or email LEGAL-PLACEHOLDER — set privacy email.