1. Data we process

Depending on how the service is used, we may process:

• account and identity data, such as email address, character name, and acceptance records;
• technical device identifier, sessions, and security information;
• game progress, equipment, resources, and persistent state;
• IP address, client version, technical logs, and events required for abuse prevention and diagnostics;
• messages and attachments voluntarily sent to support;
• delivery metadata for transactional verification and recovery emails.

Passwords are not stored in plain text. We never ask for your password or recovery token by email.

2. How we use data

Data is used to:

• create, authenticate, and recover accounts;
• operate sessions and preserve player progress;
• adjudicate results and protect game integrity;
• prevent fraud, abuse, and unauthorized access;
• send strictly transactional communications;
• respond to support and privacy requests;
• comply with applicable legal obligations.

The current alpha does not offer in-game purchases, behavioral advertising, or the sale of personal data. The website does not receive or store banking details or payment confirmations.

3. Sharing and service providers

Data may be processed by contracted service providers that are strictly necessary for ClickerOT's operation, security, communications, and distribution. These providers receive only the data compatible with their duties and are subject to confidentiality and data protection obligations.

When the client is obtained through an external distribution channel, that channel may process account, installation, and delivery data under its own terms. The data subject may request information about applicable sharing through this policy's contact channel, subject to legal and security requirements. We do not sell or rent personal information.

4. Retention and security

We keep data only for as long as required for operation, security, support, and applicable obligations. In the current alpha process:

• expired tokens are removed after a short security window;
• delivery and audit records have limited operational retention periods;
• accounts, progress, and acceptance records remain while the relationship is active or for the period required after a verified request;
• data that no longer needs to be retained is deleted or anonymized.

We apply access controls, credential protection, secure connections, and security logging. No system, however, is completely immune to risk.

5. Your rights

The data subject may request confirmation of processing, access, correction, information about sharing, objection, portability where applicable, anonymization, or deletion within the limits of the law.

During the alpha, these requests are handled manually and may require proportionate identity verification to protect the account.

6. Children and teenagers

ClickerOT is intended for people aged 13 or older. We do not knowingly collect data from children under that age. If such a situation is identified, a parent or guardian may request review and removal through the contact channel.

7. Contact

For questions or to exercise your rights, email [email protected]. You can also read our Terms of Service.