Português
English
EspañolPrivacy Policy
This policy explains what personal data the game Estelar Online (“we”, “us”) processes, why, for how long, who we share it with and how you can exercise your rights, under the LGPD, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018). It applies to the website estelaronline.com (also reachable at the previous address, estelar-online.web.app), the game at /jogar and the game server at servidor.estelaronline.com.
1. Who the controller is
The data controller is Luis Miguel Massih Pereira Desenvolvimento de Software Ltda (trade name Mape Labs), CNPJ 64.711.308/0001-28, headquartered at Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo/SP, CEP 05424-150, Brazil, which is responsible for Estelar Online. Contact: hello@mapelabs.io. This is also the channel of our data protection officer (DPO) for any request, question or complaint about this policy.
2. What data we process and why
| Data | Source | Purpose | Legal basis (art. 7) |
|---|---|---|---|
| Email and password (the password never reaches us: it stays with Firebase, hashed) | You, when you create your account | Identifying and authenticating you | Performance of a contract (item V) |
| Google account identifier (if you sign in with Google) and the associated email | Google, when you authorize the sign-in | Authentication | Performance of a contract |
| Pilot name | You, when you choose it | Identifying you to other players (it is public within the game) | Performance of a contract |
| Game profile: position, credits, ore, upgrades, missions, discoveries, colonies, chat messages | Generated as you play | Saving your progress and running the multiplayer game (chat is seen by every connected pilot) | Performance of a contract |
| IP address, connection times, browser (user agent) and technical error messages | Connection to the server | Security (preventing cheating, abuse and attacks) and troubleshooting | Legitimate interest (item IX) |
| Shop purchases: what you bought, the amount, the date, the payment status and its Mercado Pago payment number (never your card, Pix or CPF details: you provide those directly to Mercado Pago) | You, when you buy; Mercado Pago, when it confirms the payment | Delivering the item and keeping proof of the sale | Performance of a contract; compliance with a legal obligation (item II) |
| Refund requests: the purchase, the reason you chose, the message you wrote and our reply | You, in the game’s SUPORTE (Support) or by email | Reviewing and answering the request, and issuing the refund through Mercado Pago when approved | Performance of a contract; compliance with a legal obligation (item II) |
| Messages sent to support by email | You | Replying and resolving what you asked | Performance of a contract; legitimate interest |
| Voice, camera image and shared screen, only when you turn on your microphone, camera or screen sharing | You | Talking with pilots on the same planet, in the same bar or in the same comms channel. It goes through our media server only to be delivered; we don’t record anything | Consent (item I): it only turns on when you press the button, and you can turn it off whenever you want |
| Jukebox music: what you search for and the track you add to the queue | You, in a kiosk bar | Finding and playing the music; the track shows up in the queue with your pilot name while you are in the bar | Performance of a contract |
| Local preferences: HUD layout, login session, last pilot name; and the photos you take in the game (the album) | Your browser (localStorage and browser storage) | Remembering your choices and keeping your album on this device | Legitimate interest |
| Album photos in the cloud (the image, the caption, where and when it was taken) | You, when you take photos in the game | Saving the album to your profile so you can open it on any device; showing it in your ship’s frames, in the gallery and in the contest, if you choose to | Performance of a contract |
| Social: photos you post to the feed, captions, likes, comments, reposts, who you follow and who follows you | You, in the game’s SOCIAL tab | Building the feed and your profile. What you post is public: it is shown to every pilot and on your public page (estelaronline.com/@your-name), which anyone can open, even without an account, along with your follower count, the planets you discovered and your colonies | Performance of a contract; you decide what you post and can delete it at any time |
| Corporations: the one you found or join (name, motto, description, flag), your rank, invitations and applications (with the message you wrote) | You, in the CORPORAÇÃO (Corporation) tab of SOCIAL | Running the corporation. The corporation’s name and flag appear next to your name for every pilot and on your public page, along with the motto and your rank; anyone browsing corporations sees the description and the member list with their ranks | Performance of a contract |
| Ship radio: the playlists you create (name, Audius tracks, whether it is public) and the ones from other pilots that you save; the queue and the station stay only in your browser | You, in the game’s RÁDIO (Radio) | Saving your playlists; public ones are shown to other pilots, in the feed if you share them and on your public page (estelaronline.com/@your-name) | Performance of a contract; you decide what is public |
| Reports: who reported, who was reported, the reason, the text and the reported content (post, comment or conversation) | You, when you file a report | Reviewing the case and enforcing the code of conduct | Legitimate interest; compliance with a legal obligation |
We don’t collect sensitive data, we don’t profile you for advertising, we don’t sell data and we don’t use tracking or advertising tools. We don’t use third-party cookies; login uses your browser’s local storage (the equivalent of a strictly necessary cookie) to keep you signed in.
3. Who we share data with
- Google Firebase (Authentication, Firestore and Hosting) and Google Cloud (the virtual machine that runs the game server, region us-central1, United States): they are our infrastructure processors. This constitutes an international data transfer (art. 33), made to a country under the contractual clauses and adequate data protection certifications offered by Google.
- Google Fonts: the website’s fonts are loaded from Google’s servers, which receive your IP address in order to deliver them.
- Mercado Pago: processes shop payments. Payment takes place on Mercado Pago’s own screen, and Mercado Pago handles your payment data under its own privacy policy; we only receive the confirmation and the payment number.
- Audius: the music in the kiosks and on the ship radio comes from Audius. When you search for or listen to a track on the jukebox, the radio or a pilot’s public page, your browser connects to Audius’s servers, which receive your IP address and what you searched for. The game server also queries Audius to check the selected track, without sending any of your data.
- Other players: they see your pilot name, the position of your ship and your astronaut, your chat messages, the name on your colonies’ flags, the music you queued in the bar and what you post, like and comment on in SOCIAL. Your public page (estelaronline.com/@your-name) can be seen by anyone on the internet: it shows your pilot name, posted photos, followers, following, discovered planets and colonies; never your email. In voice and video conversations, they hear and see whatever you turn on. Audio and video go through our media server, which only relays them without recording; that’s why other pilots don’t receive your IP address. They never see your email.
Other than that, we only share data when required by law or by order of a competent authority.
4. How long we keep it
- Account and game profile: for as long as the account exists. When you delete your account, we erase the profile and authentication immediately; accounts with no access at all for 24 months may be deleted.
- Connection logs (IP, time, errors): up to 90 days, with automatic rotation.
- Chat messages: not stored; they only exist while they are on the screens of connected players.
- Radio playlists: until you delete them or delete your account (deleting the account erases your playlists).
- Corporation: while you are a member. When you leave, are removed or delete your account, you are taken off the member list (if you were the founder, leadership passes to the next member; if you were the only member, the corporation is deleted).
- Posts, comments and likes in SOCIAL: until you delete them (the post or the comment) or delete your account. When you delete your account, we erase your posts and reposts and remove your comments and likes from other people’s posts. The feed keeps the most recent posts; very old ones may drop out of it.
- Voice, video and shared screen: never recorded or stored; the media server only relays them while the conversation is happening.
- Jukebox queue: not stored; you leave it when you leave the bar.
- Purchases and refund requests: we keep the record of each purchase, request and decision for the period required by law to prove the sale and the refund, even after the account is deleted.
- Support emails: up to 2 years after the matter is resolved.
- Colonies and flags: they show your pilot name for as long as they exist; they disappear when you delete your account.
5. Your rights (art. 18)
At any time, you can: confirm whether we process your data, access it, correct it, request anonymization, blocking or deletion, request portability, find out who we share it with, and withdraw consent. Here’s how:
- Delete your account: on the game screen, after signing in, use the “excluir conta” (delete account) link. Deletion erases your profile and authentication immediately and cannot be undone.
- Correct your email or password: through the login itself (password reset by email).
- Any other request (access, portability, questions): write to hello@mapelabs.io. We reply within 15 days.
If you believe your rights have not been respected, you can file a complaint with Brazil’s National Data Protection Authority (ANPD).
6. Children and teenagers
Estelar is not directed at children under 13 and does not knowingly collect their data. Users under 18 must use the game with the consent of a parent or guardian. If we learn that an account was created by a child without consent, we will delete the data.
7. Security
All communication is encrypted (HTTPS and WSS). We never store passwords. The database does not accept direct access from clients: only the game server, authenticated with its own credentials, reads and writes profiles. The server validates every action to prevent cheating and limits collection to what is necessary.
8. Changes to this policy
When this policy changes, we update the date at the top and, if the change is significant, we let you know on the game’s entry screen. The version in effect is always the one published in Portuguese at /privacidade, which this page translates.
Estelar Online is a Mape Labs product (mapelabs.io). Astronomical data: HYG v4.1 (CC BY-SA 4.0) and NASA Exoplanet Archive. Models: NASA 3D Resources (public domain, without the insignia) and Kenney (CC0). Textures: Solar System Scope (CC BY 4.0). Kiosk music: Audius (Audius Open Music License).