Privacy Policy

This policy explains how the operator of Shadow Towers, identified at the bottom of this page and in the site footer ("we"), handles personal data when you use this website, the game and its online services. We are the controller of that data.

• Account data: your email address, your password (stored only as a secure hash by our authentication provider) and an optional display name.
• Game data linked to your account: progress such as level, experience and runs played, your Shadows balance and your purchase history.
• Support messages: the name, email address and message you send through the support form or by email.
• Payment metadata: when purchases open, the payment provider shares with us the transaction ID, amount, currency, status and country of a purchase. We never receive your full card number.
• Technical data: IP address, browser type and request logs kept by our hosting and authentication providers for security and reliability.

The game keeps its saves on your computer. They are not sent to us unless you link them to an account.

• To create and run your account and its online features (performance of a contract).
• To credit purchases, keep your balance and prevent fraud (performance of a contract, legal obligations and our legitimate interest in security).
• To answer support requests (performance of a contract or legitimate interest).
• To keep accounting and tax records (legal obligation).
• To keep the Service secure and working (legitimate interest).

We rely on the legal bases of Brazil's General Data Protection Law (LGPD) and, where it applies, the EU and UK General Data Protection Regulation (GDPR). We do not sell personal data, show advertising or use tracking cookies.

• Supabase: account authentication and database.
• Our hosting provider: serving this website and keeping its access logs.
• Payment providers, once purchases open: processing payments under their own privacy policies.
• An email provider: sending account and support emails.

These providers may process data outside your country. When they do, we rely on the safeguards the law requires, such as standard contractual clauses.

• Account and game data: while your account exists.
• Support messages: up to two years after the conversation ends.
• Payment and tax records: as long as tax and accounting law requires.
• Security logs: a short period, usually less than 90 days.

When you delete your account, we delete or anonymise its data, except what the law requires us to keep.

You can ask us to confirm whether we process your data and to access, correct, export or delete it, to restrict or object to its processing, and to withdraw consent where we rely on it. Under the LGPD you can also ask which third parties we share it with.

To exercise any of these rights, write to us through the support page or the email below; we may need to confirm your identity first. You can also complain to your data protection authority — in Brazil, the ANPD.

This site only uses cookies it needs to work:

• locale: remembers the language you chose, for one year.
• Supabase authentication cookies: keep you signed in after you log in, and are removed when you log out.

We use no analytics, advertising or third-party tracking cookies.

The Service is not directed at children under 13. If you are under the age at which your country lets you consent to data processing on your own, use the online features only with a parent's or guardian's permission. If we learn that we hold a child's data without that permission, we delete it.

Data travels over encrypted connections (HTTPS), passwords are hashed by our authentication provider and access to the database is restricted. No system is perfectly secure; if a breach puts you at risk, we will tell you and the authorities as the law requires.

We post updates here with a new date and announce material changes before they apply.

Privacy questions and requests: use the support page or the operator's contact details below.