Privacy duties
Who answers for what, what the store page must say, and what the Arcade developer terms ask of you.
Controller to controller
You and uloggd each answer for your own processing, as independent controllers under Brazil's LGPD. With the player's consent, uloggd discloses to you only the per-game id and the nickname. Everything your site collects on its own (IP addresses, gameplay, analytics, whatever your third parties gather) is your processing, under your privacy policy. You are not uloggd's processor, and uloggd is not yours.
About you, the checks of the game's URL record your hosting and, when uloggd turns on network lookups, public facts about your domain and your network, never who registered the domain (see The domain and the network). Moderators see them, and your account's data export carries them.
What the player is told
Before the first play of a game, uloggd shows its own notice: the game is hosted on your host, outside uloggd; the player's browser connects directly to your servers, which receive the IP address and browser data, may use cookies and third-party services, and follow your privacy policy; and uloggd does not share the player's email or account.
When the game asks for identify, uloggd asks for consent in its own words:
your controller name and country, the game's name, that you will receive an id
unique to this game and the nickname the player chooses, to identify them in
the game, until they revoke it in Settings > Arcade, and that uloggd does not
send their email, account or age. uloggd stores the version and a hash of the
text the player saw, with the consent.
The store page's controller fields
| Field | |
|---|---|
controller_name | Who answers for the players' data: you, or your company. 2 to 120 characters. |
controller_country | Its country, as an ISO 3166-1 alpha-2 code such as BR, PT or US. |
privacy_contact | An email address or an https page where players reach you about their data. |
privacy_url | Your privacy policy, https. |
terms_url | Your terms, https. Optional. |
support_url | Where players get help, https. |
They appear on the store page and in the consent, and they are reviewed like every other field.
Outside Brazil
When controller_country is not BR, the consent adds that the data will be
processed outside Brazil (LGPD art. 33), and the Arcade developer terms carry
the ANPD's standard contractual clauses (Resolução CD/ANPD 19/2024) as an
annex.
The Arcade developer terms
You read and accept them in the portal when you enable Arcade on an app, and uloggd stores the version you accepted with a hash of its text. When a new version comes out, you accept it again on Overview before you submit or make anything live (see Who can publish), and uloggd stores each version you accept. They require:
- a privacy policy, and a lawful basis for what you process;
- answers to players' requests about their data within 15 days;
- acting on every data event within 15 days, and deleting players' data when your app is removed from Arcade;
- notice of a security incident to uloggd and to the ANPD within 3 working days (Resolução CD/ANPD 15/2024), and cooperation with the ANPD;
- every third party the game loads, declared in the release;
- no linking of player ids across apps or to uloggd accounts, and no sale of player data;
- the best interest of adolescents (LGPD art. 14);
- the content rules of the review policy.
Never ask for
- A password, of uloggd or anything else, a two-factor code, or payment details, inside the game.
- Anything that would tell you who a player is on uloggd. The
subis deliberately different in every game.