Privacy Policy

Last updated: September 19, 2026

Short version: we collect what's needed to run your pilot account and matches (OAuth profile info, gameplay data), never sell your data, and you can request deletion at any time.

1. Information We Collect

Account & authentication data — depending on how you sign in:

Guest play: no account data is collected; progress is stored locally in your browser only and is not linked to an identity.
Google sign-in: your name, email address, and profile picture, as provided by Google's Identity Services after you approve the sign-in. We do not receive your Google password.
Discord sign-in: your Discord user ID, username, avatar, and (if granted) email address, as provided by Discord's OAuth authorization. We do not receive your Discord password.
Direct account creation: the username, email address, date of birth (used only to confirm you meet the age requirement in Section 2 of our Terms), and password you provide. Passwords are stored as salted cryptographic hashes — we cannot see or recover your actual password.

Gameplay data — your pilot level, XP, gold, match history, win/loss record, MMR, card/loadout inventory, and quest progress, generated as you play.

Technical data — a session cookie (signed, used only to keep you logged in), and standard request metadata (IP address, timestamps) used for security, abuse prevention, and diagnosing server issues. We do not use tracking pixels or third-party advertising cookies.

2. How We Use Your Information

To create and maintain your pilot account and save your progress across sessions and devices;
To operate matchmaking, live matches, private session codes, and the leaderboard;
To secure accounts, prevent cheating/abuse, and enforce our Terms of Service;
To communicate with you about your account (e.g., in response to a support request);
To diagnose and fix bugs affecting the service.

We do not use your data for targeted advertising, and we do not sell your personal information to data brokers or third parties.

3. Cookies & Local Storage

We use one functional session cookie to keep you signed in — no third-party advertising or analytics cookies. Guest-mode progress is stored in your browser's local/session storage and never leaves your device unless you create an account.

4. Third-Party Services

We share data only with the providers necessary to operate the Game:

Google Identity Services and Discord — used solely for sign-in authentication, per your choice. Signing in with either service is governed by that provider's own privacy policy as well.
Railway (our cloud hosting provider) — hosts our application server, MySQL database, and Redis matchmaking cache. Railway processes data on our behalf and does not use it for its own purposes.

We do not share your data with advertisers, data brokers, or analytics networks. We may disclose information if required by law or to protect the rights, safety, or property of Repository Holdings Group, LLC or our players.

5. Data Storage & Security

Account and gameplay data is stored in a MySQL database on our hosting provider's infrastructure, accessed only over encrypted connections. All traffic to the Game is served over HTTPS. While we take reasonable measures to protect your data, no system is perfectly secure, and we cannot guarantee absolute security.

6. Data Retention

We retain account and gameplay data for as long as your account is active. If you request deletion (Section 8), we delete your account data within a reasonable time, except where we're required to retain limited records for legal or security purposes.

7. Children's Privacy

Mecha Lotería is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we've collected personal information from a child under 13 without verified parental consent, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact us at contact@mechaloteria.com.

8. Your Rights & Choices

Access & correction: you can update your username, avatar, and password from your in-game profile at any time.
Deletion: email contact@mechaloteria.com to request deletion of your account and associated data.
Revoking OAuth access: you can disconnect Mecha Lotería's access to your Google or Discord account at any time from that provider's own account security settings (Google Account → Security → Third-party apps; Discord → User Settings → Authorized Apps). This stops future sign-ins but does not automatically delete data already stored with us — use the deletion request above for that.
Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA/CPRA, including the right to request a copy of your data. Contact us to exercise these rights.

9. International Data Transfers

Our infrastructure may process and store data in countries other than your own. By using the Game, you consent to your information being transferred to and processed in those countries, which may have different data protection laws than your jurisdiction.

10. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above. Continued use of the Game after changes take effect constitutes acceptance of the revised policy.

11. Contact

Questions about this Privacy Policy or your data: contact@mechaloteria.com.