Privacy
What data we use, why, for how long — and how to ask for a copy or deletion.
Last updated: Sep 26, 2026
1. Who takes care of your data
Piphin Studio is the controller of the personal data processed on this site. For any privacy matter, contact our data protection officer at contact@piphin.com or use the form at the end of this page.
2. What we use, why, and for how long
| Data | Purpose | Legal basis (LGPD) | Retention |
|---|---|---|---|
| Account: name, email, password (stored only as an irreversible hash), language, optional photo and bio | Create and keep your account, sign in | Performance of contract (art. 7, V) | While the account exists |
| Newsletter: email and language | Send game news | Consent (art. 7, I) | Until you unsubscribe |
| Contact messages: name, email, message | Reply to you | Legitimate interest (art. 7, IX) | Up to 2 years, or until you ask us to delete |
| Coin purchases: amount, date, status and the payment id at the provider | Deliver the purchase, refunds, accounting | Contract and legal obligation (art. 7, II and V) | 5 years (tax law) |
| Content creators: channel, submitted videos, balance | Creator program | Performance of contract | While participating |
| In-game code redemption: player name and IP | Deliver the item and prevent abuse | Contract and legitimate interest | IP for 90 days |
| Security: IP, login attempts, account activity log | Protect accounts against intrusion and fraud | Legitimate interest (art. 7, IX) | Attempts: 30 days · IP: 180 days |
We do not sell data, do not use it for advertising and do not build behavioral profiles.
3. Who we share it with
- Payments: Mercado Pago and PayPal receive what they need to process the purchase. We never see or store card data.
- Hosting and email: Hostinger hosts the site and sends the emails.
- Roblox: to deliver a purchased or redeemed item we send the code to the game — never your email.
- Authorities: when required by law.
Some of these services store data outside Brazil; they follow protection standards compatible with the LGPD (art. 33).
4. Cookies
We only use cookies the site needs to work — none for advertising or tracking:
piphin_session— keeps you signed in while browsing (removed when the browser closes);piphin_remember— "stay signed in" (30 days, only if you tick it);lang— your language;piphin_2fa_trust— trusted browser for two-step verification (30 days, staff only);
5. Children and teenagers
Our games have a young audience. Anyone under 12 may only create an account, subscribe or buy with the consent of a parent or guardian (LGPD, art. 14). The guardian can ask for access or deletion at any time using the form below. If we find a child's account without that consent, it will be deleted.
6. Your rights
Under the LGPD (art. 18) you can: confirm whether we process your data; access it; correct incomplete or wrong data; ask for anonymization or deletion; get a copy (portability); know who we share it with; withdraw consent (for example, leave the newsletter); and object to processing. You may also complain to Brazil's data protection authority (ANPD).
How: if you have an account, My account → My data lets you download everything and delete the account right away. Without an account, or for other requests, use the form below — we answer within 15 days.
Deleting the account: your personal data is erased. Payment records are kept for the tax period, with nothing that identifies you.
7. Security
The site uses HTTPS, stores passwords only as irreversible hashes, blocks repeated login attempts, and restricts the admin panel, with two-step verification for staff. If an incident puts your data at risk, we will notify you and the ANPD.
8. Changes
When this policy changes, the date at the top changes too. Important changes will be announced on the site or by email.
Make a request about your data
We send a confirmation link to your email: that is how we know the request is yours. We answer within 15 days.