Privacy Policy

1. Introduction

Welcome to Arcane Angler. This Privacy Policy explains how Prajjidna Daliman ("we," "us," "our," or "Owner"), located in Tanjungpinang, Riau Islands, Indonesia, collects, uses, discloses, and protects your personal information when you use our fishing MMORPG game and related services (the "Service").

We are committed to protecting your privacy and complying with applicable data protection laws, including:

• The General Data Protection Regulation (GDPR) for users in the European Union
• The California Consumer Privacy Act (CCPA) for users in California, USA
• The Personal Data Protection Law of the Republic of Indonesia (UU PDP)

2. Information We Collect

2.1 Information You Provide Directly

Data Type	Purpose	Legal Basis (GDPR)
Account Information Email address, username, profile username, password (hashed)	Account creation, authentication, communication	Contract performance, Legitimate interest
Profile Information Profile bio, selected avatar	Personalization, social features	Contract performance, Consent
Communications Chat messages, profile comments	Social interaction, community features	Contract performance
Support Inquiries Email correspondence, support tickets	Customer support, issue resolution	Legitimate interest

2.2 Gameplay Data We Collect Automatically

Data Type	Purpose	Legal Basis (GDPR)
Game Progress Level, XP, gold, relics, current biome	Game functionality, progress tracking	Contract performance
Inventory Data Fish collection, equipment owned, booster inventory	Game functionality, inventory management	Contract performance
Achievements Unlocked achievements, discovered fish	Game functionality, player engagement	Contract performance
Social Data Friend relationships, leaderboard rankings	Social features, competitive rankings	Contract performance
Subscription Status Active subscriptions, supporter tier, benefits	Subscription management, benefit delivery	Contract performance

2.3 Technical Information

Data Type	Purpose	Legal Basis (GDPR)
IP Address (Collected by our server infrastructure)	Security, fraud prevention; active IP address and device fingerprinting used for multi-account detection	Legitimate interest
Browser Information Browser type, device type, screen resolution	Compatibility, user experience optimization	Legitimate interest
Session Information Login timestamps, last activity	Security, session management	Legitimate interest

2.4 Payment Information

We do not collect or store payment information. All payment transactions are processed by a third-party payment processor depending on your platform: PayPal for web purchases, or Google Play Billing for Android purchases. These processors collect and process payment information such as credit card details, billing addresses, and transaction data in accordance with their respective privacy policies.

We receive only:

• Confirmation of successful payments
• Transaction IDs for record-keeping
• Information about what was purchased (subscription tier or booster bundle)

For more information, please review PayPal's Privacy Policy or Google's Privacy Policy.

2.5 Cookies and Similar Technologies

We use minimal cookies and similar technologies:

• Session Cookies: Essential for authentication and maintaining your logged-in state
• Security Cookies: Used to detect and prevent fraudulent activity
• Cloudflare Cookies: Our website uses Cloudflare's free plan for security and performance. Cloudflare may set cookies for DDoS protection, bot detection, and performance optimization. For details, see Cloudflare's Privacy Policy.

We do not use:

• Third-party advertising cookies
• Analytics cookies (e.g., Google Analytics)
• Tracking pixels or web beacons

2.6 Information We Do NOT Collect

We explicitly do NOT collect:

• Precise geolocation data
• Biometric data
• Government identification numbers
• Financial account information (handled by PayPal or Google Play Billing)
• Detailed browsing history or activity outside our Service
• Information from third-party social media profiles (unless you choose to contact us via those channels)

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Improving the Service

• Creating and managing your account
• Enabling gameplay, saving progress, and syncing data across sessions
• Delivering purchased items (subscriptions, boosters)
• Enabling social features (friends, chat, leaderboards, profile comments)
• Improving game balance, features, and user experience
• Fixing bugs and technical issues

3.2 Communication

• Sending account-related emails (email verification, password reset)
• Responding to your support requests and inquiries
• Sending important service announcements (e.g., Terms of Service changes, maintenance notices)
• Notifying you of subscription renewals or payment issues

We do not send promotional emails or marketing communications unless you explicitly opt in.

3.3 Security and Fraud Prevention

• Detecting and preventing cheating, botting, or exploitation
• Preventing fraud, unauthorized access, and payment abuse
• Enforcing our Terms of Service
• Detecting and preventing multi-account abuse using IP address tracking and device fingerprinting

3.4 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Responding to lawful requests from law enforcement or government authorities
• Protecting our rights, property, and safety, as well as those of our users and the public

4. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

4.1 Third-Party Service Providers

Service Provider	Purpose	Data Shared
PayPal (Payment Processor — Web)	Process payments, subscriptions, refunds for web purchases	Email, username, purchase information
Google Play Billing (Payment Processor — Android)	Process payments, subscriptions, refunds for Android purchases	Google account information, purchase information (as per Google's privacy policy)
Email Service Provider (Self-hosted)	Send verification emails, password resets, support communications	Email address, username
Cloudflare (Security & Performance)	DDoS protection, CDN, security services	IP address, browser information (automatically collected by Cloudflare)
Database Hosting (Self-hosted)	Data storage and retrieval	All account and gameplay data

All third-party service providers are contractually required to protect your data and use it only for the purposes we specify.

4.2 Public Information

The following information is publicly visible to other players:

• Profile username (display name)
• Level, total fish caught, total gold, and relics (on leaderboards)
• Profile bio (if you choose to add one)
• Selected avatar and supporter badge (if applicable)
• Chat messages in public chat
• Profile comments you post on other players' profiles

Your login username and email address are never publicly visible.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)
• Lawful requests from government or law enforcement authorities
• Situations where disclosure is necessary to protect the rights, property, or safety of Prajjidna Daliman, our users, or the public

4.4 Business Transfers

If Prajjidna Daliman (operating Arcane Angler) is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our Service before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Data Retention

5.1 Active Accounts

We retain your account information and gameplay data for as long as your account is active and you continue to use the Service.

5.2 Account Deletion

If you request account deletion by emailing [email protected]:

• Your account and all associated personal data will be deleted from active systems within 24 hours
• Any backup copies of your data will be purged within 30 days
• Deletion is irreversible and cannot be undone

5.3 Legal Obligations

In some cases, we may be required to retain certain information for legal compliance purposes, such as:

• Financial records for tax purposes (typically 7 years in Indonesia)
• Records related to legal disputes or investigations
• Data required to comply with data protection regulations

In these cases, we will retain only the minimum data necessary and will securely delete it once the legal obligation expires.

5.4 Anonymized Data

We may retain anonymized or aggregated data (which cannot identify you personally) indefinitely for analytical and statistical purposes.

6. Data Security

We take the security of your personal information seriously and implement reasonable technical and organizational measures to protect it, including:

• Encryption: Passwords are hashed using bcrypt before storage. HTTPS/TLS encryption protects data in transit.
• Access Controls: Database access is restricted to authorized personnel only.
• Authentication: JWT (JSON Web Token) authentication for secure API access.
• Rate Limiting: Protection against brute-force attacks and abuse.
• Cloudflare Protection: DDoS protection and web application firewall.
• Profanity Filter: Content moderation to prevent abuse and maintain community standards.

7. Your Privacy Rights

7.1 General Rights (All Users)

Regardless of your location, you have the following rights:

• Access: You can request a copy of your personal data by emailing [email protected]
• Correction: You can update your profile username, bio, and avatar through your account settings. For other corrections, contact us.
• Deletion: You can request permanent account deletion by emailing [email protected]
• Withdraw Consent: Where we rely on consent, you can withdraw it at any time by deleting your account

7.2 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have additional rights under the GDPR:

• Right to Access: You can request access to your personal data and receive information about how it's processed.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal data in certain circumstances.
• Right to Restriction of Processing: You can request that we limit how we use your data in certain situations.
• Right to Data Portability: You can request a copy of your data in a structured, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests or direct marketing.
• Right to Lodge a Complaint: You can file a complaint with your local data protection authority (e.g., ICO in the UK, CNIL in France).

7.3 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request disclosure of the personal information we collect, use, disclose, and sell (we do not sell personal information).
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: While we do not sell personal information, you can opt out of any future sales.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights.

California "Shine the Light" Law: We do not share personal information with third parties for their direct marketing purposes.

7.4 Indonesian Privacy Rights

Under Indonesian law (UU PDP), you have rights including:

• Right to access and obtain copies of your personal data
• Right to request correction of inaccurate data
• Right to request deletion of data (subject to legal obligations)
• Right to withdraw consent for data processing
• Right to file complaints with the Indonesian data protection authority

7.5 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] with:

• Your username and email address
• A clear description of your request
• Verification of your identity (for security purposes)

We will respond to your request within:

• 30 days for general requests
• 1 month for GDPR requests (extendable by 2 months for complex requests)
• 45 days for CCPA requests (extendable by 45 days with notice)

8. Children's Privacy

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13 years of age.

8.1 COPPA Compliance (USA)

In compliance with the Children's Online Privacy Protection Act (COPPA), we:

• Require users to be at least 13 years old
• Do not knowingly collect personal information from children under 13
• Will promptly delete any data if we discover it belongs to a child under 13

8.2 GDPR Compliance (EU)

For users in the EU, our minimum age of 13 complies with most EU member states' age requirements for consent to data processing (typically 13-16 years, depending on the country).

8.3 Parental Notification

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at [email protected], and we will delete the account and associated data.

9. International Data Transfers

Arcane Angler is operated from Indonesia, but we serve users worldwide. Your personal information may be transferred to and processed in countries other than your country of residence.

9.1 Transfers to Third Parties

Our third-party service providers may be located in different countries:

• PayPal: Headquartered in the United States with global operations
• Google (Google Play Billing): Headquartered in the United States with global operations
• Cloudflare: Operates globally with data centers worldwide

9.2 GDPR Safeguards (EU Users)

For users in the European Union, we ensure adequate protection for international data transfers through:

• Standard Contractual Clauses (SCCs): Our third-party providers use EU-approved SCCs for data transfers
• Adequacy Decisions: We may transfer data to countries recognized by the EU as providing adequate protection

9.3 Your Consent

By using the Service, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.

10. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no common understanding of how to interpret DNT signals, we do not currently respond to DNT signals on our Service.

However, we do not track your activities across third-party websites or services. We do not use third-party advertising or behavioral tracking technologies.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email or an in-game announcement for material changes
• Provide at least 30 days' notice for significant changes

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you may request account deletion.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Response Times

We will respond to privacy-related inquiries within:

• General inquiries: 7 business days
• GDPR requests: 1 month (extendable by 2 months for complex requests)
• CCPA requests: 45 days (extendable by 45 days with notice)
• Account deletion requests: Immediate (processed within 2 hours)

13. Supervisory Authorities

13.1 For EU/EEA Users

If you are located in the EU/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

13.2 For Indonesian Users

Indonesian users may contact the Indonesian Ministry of Communication and Information Technology (Kominfo) regarding data protection concerns.

13.3 For California Residents

California residents may contact the California Attorney General's Office regarding CCPA concerns: https://oag.ca.gov/contact