Privacy Policy
Last updated: 10/5/2026
This policy explains how IdleRadar handles personal data under Brazil's General Data Protection Law (Law 13.709/2018, “LGPD”). In short: we collect the minimum needed for your account to work, we don't sell data, we don't use tracking cookies, and you can download or delete your data at any time in My account. This is a translation; the Portuguese version prevails.
1. Data controller
ROCKETAPPS TECNOLOGIA LTDA. Data Protection Officer (DPO): contact via noreplay@idleradar.com.
2. What data we process
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| When you create an account / sign in | Send the sign-in link, notices about your games and receipts | Performance of contract (V) | |
| Public name | On your first review or in My account | Identify your reviews. It is shown publicly; your email never is | Performance of contract (V) |
| Reviews and votes | When you review or vote | Build scores and rankings. Reviews are public; votes only appear as totals | Performance of contract (V) |
| Submitted game data (name, links, logo, status endpoint) | When you submit or configure a game | Publish the game and show its status | Performance of contract (V) |
| Orders (plan, amount, date, email) | When you buy a featured spot | Activate the placement, issue receipts, meet tax obligations | Performance of contract (V) and legal obligation (II) |
| IP address hash | When you review, vote, submit a game, sign in or check out | Limit abuse (multiple accounts, bots). We only keep an irreversible code with a secret salt, never the IP itself | Legitimate interest (IX): security and fraud prevention |
| Access logs (IP, date and time) | On every request, by the hosting infrastructure | Security and compliance with Brazil's Internet Civil Framework (art. 15) | Legal obligation (II) |
Card details are entered on Stripe's page and never pass through our servers. We do not collect sensitive data (art. 5, II) or make automated decisions about you.
3. Cookies
We only use essential cookies, without which sign-in doesn't work. That's why there is no consent banner:
idleradar_session: keeps you signed in for up to 30 days. It holds a random code; our database only stores its hash.idleradar_lang: remembers the language you chose (1 year).
We don't use Google Analytics, ad pixels or third-party cookies. Game logos are served from our own domain, so opening a page doesn't send your IP to developers. If we ever show third-party ads, this policy will be updated and we will ask for consent first.
4. Who we share data with
- Stripe (payment processing, USA), when you buy a featured spot.
- Resend (email delivery, USA): your email address and the message content.
- OVHcloud (server and database hosting, Europe).
These providers process data only to deliver the contracted service, under contractual safeguards. Since some are outside Brazil, this involves international transfer under LGPD art. 33. Game developers do not receive data about who reviews or votes: they only see totals. We may also provide data under a court order or a request from a competent authority.
5. How long we keep it
- Account, reviews and votes: for as long as the account exists.
- Sign-in links: expire in 15 minutes and are deleted within 1 day.
- Sessions: up to 30 days, or until you sign out.
- Admin panel sign-in attempts: 1 day.
- Hosting access logs: 6 months (Internet Civil Framework, art. 15).
- Paid orders: 5 years, for tax purposes. If you delete your account, the order is unlinked from it and only what accounting requires is kept.
6. Your rights
Under LGPD art. 18, you can at any time:
- Access and port your data: in My account → “Download my data” (JSON file).
- Correct your public name in My account.
- Delete your account: in My account → “Delete my account”. We erase your email, name, reviews, votes and sessions immediately. Games you submitted stay in the catalog, unlinked from you; ask us if you want them removed.
- Learn who we share data with, withdraw consent and object to processing, via the DPO contact.
- File a complaint with Brazil's National Data Protection Authority (ANPD).
Requests by email are answered within 15 days.
7. Security
Connections always over HTTPS; passwordless sign-in with single-use links; session and access codes stored only as hashes; limits against bots; servers with restricted access. No system is infallible: if an incident could pose a relevant risk, we will notify you and the ANPD (art. 48).
8. Children and teenagers
IdleRadar is not directed at children under 13. Teenagers should use the platform with permission from their parents or guardians. If you know of a child's account, let us know and we will remove it.
9. Changes to this policy
We will notify you by email or on the site before relevant changes. The version in force is always this page. See also the Terms of Use.