CMD HACKER / LEGAL DOCUMENTS
Privacy Policy
How we handle real data behind a fictional universe.
Last updated: October 28, 2026 · Version 1.2
1. Controller and scope
This policy applies to the CMD Hacker website and game. Data controller: the CMD Hacker team (independent operator of the game). Privacy and account deletion contact: [email protected].
2. Fictional gameplay, real account data
Target IPs, scans, attacks (ATK), devices, city locations, operations, credits and balances are simulation elements. They do not represent access to external networks, bank accounts or real assets. This does not make your account data fictional: email addresses, identifiers and connection logs may be personal data. The real IP used to connect to the service is different from an IP represented in the game universe.
3. Data processed
Current functionality includes account ID, nickname, device or installation identifier, creation and access dates and, when provided, email address and verification status. We process progress, virtual resources, operations, Clan interactions and moderation records. Technical logs include the real connection IP, client information (user agent), requested route, time, response status and request duration. Communications sent to support may also contain personal data. The app sends crash reports (device model, OS and app version, state at the time of the crash) and aggregated usage events to Firebase Crashlytics and Firebase Analytics. Do not include passwords, banking information or sensitive information in names or messages.
4. Purposes and legal bases
We use necessary data to create and authenticate accounts, save progress and provide requested features on the basis of contract performance. Security, fraud and cheating prevention and diagnostics may rely on legitimate interests, subject to necessity assessments and respect for individual rights. Legal obligations and the establishment, exercise or defense of legal claims support the corresponding processing. Where consent is required, it will be requested separately and may be withdrawn; this policy is not blanket consent.
5. Visibility and sharing
Your nickname, actions and gameplay information may be visible to other players depending on the feature; Clan messages are intended for channel participants. Hosting, infrastructure and email service providers may process data necessary to operate the service, subject to data protection obligations. Data may also be disclosed to comply with valid legal requirements or exercise legal rights. App stores process data under their own policies. Our providers are: cloud hosting for the backend; Amazon SES (Amazon Web Services) to send the verification code email; Firebase Crashlytics and Firebase Analytics (Google) for crash reports and aggregated usage metrics. We do not show advertising or share data for ads. Data is processed in Brazil and the United States; international transfers follow the safeguards required by applicable law.
6. Local storage and website
The app uses local storage for preferences and information needed for sessions. The website does not include advertising cookies, a registration form or third-party analytics. The account deletion page sends only the email address and code you enter to our API, in order to process the request. Hosting may generate technical access logs. Changes introducing tracking or new purposes must be reflected in this policy and, where required, accompanied by a choice or consent.
7. Retention and security
We retain data for as long as necessary for the stated purposes and applicable legal obligations. Account deletion does not immediately erase data whose retention is necessary and lawful for security, legal obligations or legal claims. Access logs are kept for 90 days. Authentication records (sign-up, sign-in, session renewal and code requests) remain linked to the account, including the IP address, device identifier and client information (user agent), for account security and to prevent fraud and multiple accounts. Account data is kept for as long as the account exists. After a deletion request, the account is deactivated for 30 days; during this period you can reactivate it by signing in to the app again with the same email. From the request onward, the account's messages are no longer shown to other players (Clan chat, Global chat and private conversations) and the account is removed from rankings; the same applies to suspended accounts. After the 30 days, deletion is final: the email is erased from the account and from authentication records, and the account can no longer be reactivated. The nickname, game history, technical records and sent messages remain linked to the deactivated account, without an email and without being shown to other players, based on legitimate interest (security and fraud and cheating prevention) and the exercise of legal rights. On request, by email to support, this step can be brought forward. If the account was suspended for breaking the game rules, we keep only a cryptographic code (HMAC) of the email for 12 months, which does not allow the address to be recovered, to prevent it from being used for a new account. Backups have restricted access and expire within 30 days. We apply technical and organizational measures proportionate to risk; no system offers absolute security.
8. Your rights and deletion
Depending on applicable law, you may request confirmation of processing, access, correction, anonymization, restriction or deletion of unnecessary or unlawfully processed data, portability where applicable, information about sharing, withdrawal of consent and review of automated decisions affecting your interests. You may also contact the Brazilian ANPD or another competent authority. You can delete your account in three ways: in the app (Settings → Account → Delete account); on the public page https://cmdhacker.net/delete-account, by entering the linked email and the confirmation code sent to it; or by email to [email protected]. Accounts without a linked email must use the in-app option or the contact email. We may verify your identity proportionately. We will explain any required retention and its grounds. Uninstalling the app does not delete your account.
9. Children and teenagers
Processing children’s and teenagers’ data must respect their best interests, the age rating and applicable legal requirements, including guardian involvement when required. The game is rated 12+: its content is fictional “hacking” with no graphic violence. It is not intended for children under 12; teenagers should use it with the knowledge and authorization of a guardian where required by law. If you suspect improper processing of a minor’s data, use the privacy contact to request review and appropriate action.
10. Updates
We may update this policy to reflect service and legal changes. The date and version will appear on this page; material changes will be communicated appropriately. New purposes still require a lawful basis or consent where required.