Privacy policy
Last updated: 22 October 2026
This policy explains how your personal data is handled when you use a Rox account and Paper Tower Defense, including its online leaderboards. You can play Paper Tower Defense without a Rox account; in that case your records stay on your device. This policy follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
1. Who is responsible (controller)
The controller is Matheus Costa, an individual responsible for the Rox brand. Rox does not have a company registration yet. Contact for anything about your data, including the data protection officer role: privacy@somosrox.com.
2. Data we collect
| Data | When | Who can see it |
|---|---|---|
| Display name | When you choose one | Public on leaderboards |
| Login ID from your sign-in provider (for example Google, Apple or a random ID for a guest session) | When you sign in | Not public |
| Email address | Only if you sign in with email | Never shown publicly |
| Scores and run data: wave reached, kills, lives lost, run duration and a per-wave log | When you submit a run | Wave, kills and lives lost appear on leaderboards with your display name |
| Device integrity verdict (for example from Google Play Integrity or Apple App Attest) | Planned for a later version | Not public |
We do not collect your precise location, contacts, photos or advertising ID. There are no ads yet.
3. Why we use it and the legal basis
- Running the service you ask for — creating your account, signing you in, saving your scores and showing leaderboards. Legal basis: performance of a contract or preliminary procedures at your request (LGPD art. 7, V).
- Anti-cheat and security — checking that submitted runs are plausible, detecting cheating and abuse, and keeping leaderboards fair. Legal basis: legitimate interest (LGPD art. 7, IX), limited to what is needed.
- Marketing messages — only if you opt in. This is off by default and you can turn it off at any time. Legal basis: consent (LGPD art. 7, I).
- Legal obligations — keeping records when a law requires it (LGPD art. 7, II).
We do not sell your personal data and we do not use it for automated decisions with legal effects on you. Anti-cheat checks may hide a score; you can ask for a review by email.
4. Who processes it for us
- Supabase — database, authentication and server hosting. The São Paulo (Brazil) region is planned.
- Sign-in providers — if you choose Google or Apple sign-in, that provider handles the login under its own privacy policy.
- Advertising — none yet. If ads are added, this policy will be updated before they start.
5. International transfer
Our providers may process or support data from servers outside Brazil (for example in the United States). When that happens, the transfer relies on the mechanisms allowed by LGPD art. 33, such as standard contractual clauses offered by the provider. Even with Brazilian hosting, provider staff or sub-processors abroad may access data to run the service.
6. How long we keep it
- Account, profile, scores and run data: until you delete your account.
- Anti-cheat and security logs: up to 90 days, and deleted with your account if you delete it sooner.
- Records a law requires us to keep: only for the period that law requires.
7. Your rights (LGPD art. 18)
You can ask us to:
- confirm whether we process your data, and give you access to it;
- correct incomplete, inaccurate or outdated data;
- anonymize, block or delete unnecessary or excessive data, or data processed against the law;
- port your data to another provider;
- delete data processed with your consent;
- tell you with whom we share your data;
- tell you about the option of not giving consent and what happens if you refuse;
- withdraw your consent;
- review decisions made only by automated processing.
How to exercise them: you can change your display name and delete your account in the app (Settings → Rox account). For anything else, email privacy@somosrox.com from the address linked to your account, or include your display name. We may ask for information to confirm it is you. We reply within 15 days.
To delete your account, see somosrox.com/roxgaming/delete-account.
If you are not satisfied with our answer, you can complain to the Brazilian data protection authority, ANPD (Autoridade Nacional de Proteção de Dados), at gov.br/anpd.
8. Age
Rox accounts are for players 13+ (13 years or older). If you are under 13, please play without an account. If we learn that an account belongs to someone under 13, we will delete it. Parents can contact us at privacy@somosrox.com.
9. Security
Data is sent over encrypted connections, access is restricted by database rules, and only the data needed for each feature is stored. No system is perfectly secure; if a breach could cause you relevant risk or harm, we will notify you and the ANPD as required by law.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version. For important changes we will tell you in the app before they take effect, and ask for consent again when the law requires it.