QuestAway Privacy Policy
1. Who looks after your data
The controller of the personal data processed in QuestAway (the Game) is ART X GAMES TECNOLOGIA LTDA (ART X, we, us), CNPJ 68.279.774/0001-37, with its head office at Rua Amazonas, 83, Letra C, Boa Vista 2, Santa Rita do Sapucaí, Minas Gerais, Brazil, ZIP 37538-640. The company is managed by its partners Juliano Costa Silva and Pablo Luis da Mota Nora.
Data protection officer (encarregado): Pablo Luis da Mota Nora, at contact@artxgames.com. This is the channel for exercising your rights and asking questions about this Policy.
This Policy explains what personal data we process when you use the Game, its online services and the pages of this site, what we use it for, who we share it with, how long we keep it and what your rights are. It follows the Brazilian General Data Protection Law (Law 13,709/2018, LGPD), the Brazilian Internet Civil Framework (Law 12,965/2014) and, for people who live in other countries, the laws described in section 12.
Your Steam account and purchases made on Steam are handled by Valve Corporation under Valve's privacy policy. ART X does not control that processing.
2. What data we process
Data that comes from Steam
- SteamID: the number that identifies your Steam account. It links you to your Game account.
- Public Steam name (the profile name everyone sees on Steam). We do not collect your Steam avatar, email or payment details. As for country, we keep only what Steam reports with each Crystal purchase (below, under "Purchases and items").
- Ownership of the Game, checked on Steam.
- Steam friends list: the Game reads your friends' SteamIDs on your computer. To show their houses, these SteamIDs are sent to the server only to find out which friends have a house in the Game, and are not stored. In the Social tab, the Game sends the list again and the server stores the last list received (up to 2,000 SteamIDs, together with yours), to link in the Game, as friends, people who have each other as friends on Steam. Each upload replaces the previous one. The list may contain SteamIDs of people who do not play the Game: for them we store only the number.
Data from your game
- The game state: heroes, items, gold, progress, achievements, house and game settings.
- The history of game actions sent to the server and the random numbers used in them, which allow us to check your progress.
- The version of the Game you use.
- Dates and times of use: account creation, login, last progress sent and a presence signal sent every few minutes while the Game is open in online mode.
- Preferences: language, volumes, window layout and a random device code that keeps each computer's preferences separate.
Social feature data (section 4)
- What appears in the ranking and in announcements, and the language you play in, for the flag next to your name in the rankings.
- Your house: the decoration, a picture of the house generated by the Game itself, your computer's time zone (used to paint the house's sky) and your hero party.
- The visits, stamps and likes you give and receive, in houses and in clan halls.
- The Arena: the hero formation that defends your account (the heroes, their levels, items and appearance), the fights you have made and received, the points, the league in each season and the prizes.
- Colossus: the hunts your account takes part in: the damage your group dealt, the fight time, the level, the medal and the prize of each hunt, the snapshot of the group of heroes that joins the fight (the heroes, their levels and appearance) and the balloon you chose. While your group travels to the room, the trip is kept for 1 minute.
- Friends: the friend requests you send and receive, your friendships (with whom, since when and on how many days you visited or stamped each other's house), the people you blocked and your privacy choices (who can send you a friend request, who can see the items of your heroes and whether friends can see that you are playing).
- Reports: when you report someone, we store who reported, who was reported, the reason (chosen from a list: name, harassment, cheating or other), the text the reporter writes (up to 300 characters, required for "other" and optional for the rest), the day, the time and a protocol number.
- Clan: the clan you are in, your rank and when you joined; when you left your last clan; your requests and invitations to join; the ready-made notes you post on the clan wall and the reactions you give; the milestones about you that the clan diary records (joining, leaving, changing rank and game achievements, such as an Eternal item); your damage and your hunts of the week against the clan's Beast; the Seals you earn and spend and what you buy with them (such as frames and titles); and, if the leader places a hero of yours in the clan hall, that hero's model and level.
Purchases and items
- Your Crystal balance and history: purchases, spending, receipts, the identifiers of your Steam purchases and the country Steam reports with each purchase (used to track the unspent balance of Crystals bought in Japan, which Japanese payment law requires us to measure, and to prevent fraud).
- Trades, sales and Crystal transfers between players inside the Game, when it offers them: what was traded or sent, with whom, for how much and when.
- We do not receive your card or payment details: payment is made on Steam.
Security and rules
- Progress rejected by the server and the reason for the rejection.
- Measures applied to the account (such as suspension or ban) and the reason.
- Alerts of unusual activity in the Game's economy (such as the amount of Crystals moved or the number of trades in a period, and accounts that always trade with each other), what Steam reports about purchases charged back or disputed and about accounts locked by Steam, and the measures taken, with a record of which team member took them.
- Computer code: on Windows, the Game computes on your computer a code from the system's identifier, transformed in a way that cannot be undone; the original identifier never leaves your computer. If the system has no such identifier, the Game creates a random code and keeps it in its data folder. The code is sent when you log in to the online services and when you open the Crystal shop, and is linked to your account, to find several accounts used on the same computer.
- Play pattern: from the actions the Game already sends to check your progress, the server stores, per account and per day, how many gestures you made, the time between them, the hours of the day with activity and a fingerprint (a summary that cannot be read) of the sequences of actions that repeat.
- App signals: with your progress, the Game sends how many clicks or key presses were generated by a program instead of a person, whether the Game was opened with debugging or remote-control tools, and the Game version.
- Steam account standing: when you log in to the online services, the server asks Steam whether your Steam account has a community, VAC, game or trade ban and, if your profile is public, when it was created.
- Chest luck: for each block of about 10 hours of play, how many chests you opened and how many Mythic, Legendary and Eternal items came out of them, compared with what luck allows.
- Replaced session: the cryptographic summary of the previous session key, so the Game can tell you that the account was opened elsewhere.
- Evidence: images that a team member attaches to the account when reviewing a report or an alert.
- Rift Seal: the challenge to enter the Colossus room keeps, for each hunt, whether you passed, how many of the 3 chances you used and a score from 0 to 100 on the timing of the answers, which points to automated answers. For each attempt we keep for 30 days the result (and, if it failed, the reason), the time, the moment of each click and how close each one was to the target (as a fraction of its size); never the position on the screen.
- Access records: the IP address, date and time of each login and session opening in the online services. The IP is also used to find several accounts that log in from the same network.
Acceptances
- The record of your acceptance of the Terms of Use and acknowledgment of this Policy: the document, the version, the date, the language in which you read it and the Game version.
Support
- If you write to us, your email address and the content of the conversation.
What stays only on your computer
The offline save, the Game's operating log (kept for 7 days, without your SteamID and without passwords) and crash reports stay on your computer and are not sent to us. We only receive them if you send them to support yourself.
What we do not process: your legal name, documents, address, phone number, precise location, sensitive data (such as health, religion or biometrics), contacts outside your Steam friends list and the content of other programs on your computer. To detect automation, we do not record what you type, your screen or the position of your mouse. The Game has no chat of its own (the clan wall uses only ready-made phrases), shows no advertising and uses no third-party analytics or tracking tools. The Chat button opens Steam's own chat, between Steam friends; we have no access to it.
3. What we use the data for and the legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Identify you and keep your account and online progress | SteamID, Steam name, game data, preferences | Performance of a contract (art. 7, V) |
| Check progress and prevent cheating, fraud, multiple accounts and automation | Game data, action history, play pattern, app signals, computer code, IP, Steam account standing, chest luck, Rift Seal, security records and evidence | Legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI) |
| Show the ranking, announcements, houses, stamps and the Arena | Steam name and social feature data | Legitimate interest (art. 7, IX; art. 10). You may object by hiding your name (section 4; art. 18, § 2) |
| Run the Colossus hunts, give the medals and prizes and show the hunters | SteamID, Steam name, Colossus data | Performance of a contract (art. 7, V) |
| Show the Social tab: friends, clan, Hunt and Seals | SteamID, Steam friends list, requests, friendships, blocks, clan data, Hunt damage, Seals | Performance of a contract (art. 7, V) |
| Receive reports and protect players from abuse | Reports, blocks, SteamID | Legitimate interest (art. 7, IX), regular exercise of rights (art. 7, VI) and legal obligation, where applicable (art. 7, II) |
| Sell and deliver Crystals and content, and handle refunds | Purchases, Crystals, purchase country | Performance of a contract (art. 7, V) and legal obligation (art. 7, II) |
| Track the unspent balance of Crystals bought in Japan, which Japanese payment law requires us to measure | Purchases, Crystals, purchase country | Legitimate interest (art. 7, IX) and legal obligation, where applicable (art. 7, II) |
| Prevent fraud, chargebacks and money laundering in the Game's economy, and respond to authorities | Crystal purchases, purchase country, trades, unusual-activity alerts, and chargebacks and locked accounts reported by Steam | Legitimate interest (art. 7, IX), regular exercise of rights (art. 7, VI) and legal obligation, where applicable (art. 7, II) |
| Carry out trades between players in the Game | Trades, SteamID | Performance of a contract (art. 7, V) and legitimate interest, to prevent fraud (art. 7, IX) |
| Keep access records for the period required by law | IP, date and time | Legal obligation (art. 7, II; Internet Civil Framework, art. 15) |
| Prove acceptance of the Terms and acknowledgment of this Policy | Acceptance record | Regular exercise of rights (art. 7, VI) |
| Answer you and provide support | Email and conversation | Performance of a contract (art. 7, V) and legitimate interest (art. 7, IX) |
| Give out the prizes of the Game's competitions, such as the Arena seasons | SteamID, results, points and league | Performance of a contract (art. 7, V) |
| Send notices about the Game inside it (Mail and messages) | SteamID, language | Performance of a contract (art. 7, V) |
When we rely on legitimate interest, we first assess that it does not override your rights, and you may object to that use (section 9).
Required data. The SteamID and game data are needed for the online services: without them, the Game only works in offline mode.
Automated decisions. The server automatically checks all progress sent and rejects anything that does not follow the Game's rules; the Game then returns to the last valid state. Penalties such as suspension and bans are decided by a team member. You may ask for a review of any automated decision at the email in section 1, and we will explain the criteria used, keeping back only what is needed so as not to teach cheating. Alerts of unusual activity and of cheating and automation (Terms of Use, section 10) apply no measure on their own: they only bring the case to a team member, who decides. The one exception is the market: if Steam reports that your Steam account has a community or trade ban, the Game does not let the account use the players' market or send items to Steam while the ban lasts (and, if we turn it on, the same applies to Steam accounts created very recently). Reports about players (section 4) also punish no one on their own: a team member reads them and decides. In the Colossus the rule is also automatic: whoever uses up the 3 chances of the Rift Seal cannot enter that hunt. If you cannot solve the challenge, or think you failed by mistake, write to the email in section 1 and we will let you in by hand.
4. What other players see
- Ranking: your Steam name, whether you played in the last few minutes, your furthest stage, level, party classes and levels, playtime, gold, power and your house code. Next to the name appears the flag of the language you play in. On your own Ranking row, the eye button hides your name: the numbers still appear, without the name and without the flag. That choice applies everywhere in the Game where another player would see your name (rankings, announcements, Arena, Colossus, houses and guestbooks, friends and requests, clans, market and hunts): there you appear as anonymous (for example, "Anonymous player"). You keep seeing your own name.
- Announcements: when you get a very rare item or reach a world milestone, the Game may announce it to everyone. In the Social tab, under Privacy, you can turn off "Show my name in announcements"; hiding your name in the Ranking also removes it from announcements.
- House: visitors to your house see the decoration, your hero party and its items, the sky in your time zone and your Steam name, if you have not hidden it in the ranking. The house picture appears in the house ranking and can be seen by anyone who has its address.
- Arena: whoever attacks your defense sees the formation of heroes defending it (the heroes, levels, items and appearance), your league and your Steam name, if you have not hidden it in the ranking. The Arena ranking shows, with the same care for the name, the league, points, wins and losses and whether you are online. Whoever's defense you attack, or whoever receives a challenge from you, sees your Steam name and the fight.
- Colossus: the list of top hunters of each hunt shows your Steam name (or "anonymous player", if you hid it in the ranking), the damage, your group of heroes (the class, level and appearance of each) and your balloon. Your balloon also appears, with the same care for the name, on other players' maps while you travel to the room, and your heroes fight on the screen of whoever is in the same hunt. With your name visible, other players can open your profile card: the balloon, the group of heroes, the companion and, if your Social tab privacy allows it, the items the heroes wear.
- Trades between players: when the Game offers them, the other party to a trade or transfer sees your Steam name, if you have not hidden it in the ranking, and what was traded or sent.
- Visits, stamps and likes: when you stamp or like someone's house, the house owner sees your Steam name in the guestbook, if you have not hidden it in the ranking; if you did, they see only "An adventurer". The owner also sees who is visiting the house at that moment, with the same rule for the name.
- Friends: whoever is your friend in the Game sees your Steam name, if you have not hidden it in the ranking, your level, your clan tag, where you are in the Game (the difficulty, act and stage), the model and level of the hero leading your party and whether you are playing now or when you were last seen. Whoever receives a request from you sees your name, if you have not hidden it in the ranking, and your level. If you and another person have each other as friends on Steam and both use the Social tab, you become friends in the Game without a request. Your Steam friends list is not shown to anyone. In the Social tab you choose who can send you friend requests and who can see the items of your heroes (for each one: everyone, clan and friends, friends only or nobody; "friends" are your friends in the Game and on Steam), you can turn off "playing now" and you can block someone, which also ends the friendship and the requests between you. By default, everyone can send you friend requests and see the items of your heroes, and your friends see when you are playing. Whoever hides their name appears as anonymous to friends and on the profile card, which does not show the balloon, the group of heroes, the companion or the items.
- Clan: any player can see a clan's page: the name, tag, crest, labels, languages, level and the list of members, with each member's Steam name (if they have not hidden it in the ranking), rank, level, the hero leading their party, join date and whether they are playing now. Members also see the clan wall, the clan diary, the reactions and each member's damage in the week's Hunt. Any player can visit the clan hall, where the leader can place members' heroes, with the photos of the members' houses and the guestbook, which shows the Steam name of whoever stamped it (if they have not hidden it in the ranking).
- Seals: the frame and the title you wear appear next to your name in the Game's lists.
- Reports: only the team sees reports. Whoever is reported does not see who reported them.
5. Who we share data with
We do not sell, rent or give away personal data for advertising. We only share data with:
- Valve Corporation (Steam), in the United States, to confirm your identity and your ownership of the Game, read your public name, deliver Crystals and check for purchases that were charged back or disputed and whether your account is locked by Steam and, each time you log in to the online services, whether your Steam account has bans and, when your profile is public, the date it was created. Valve processes this data as an independent controller under its own privacy policy.
- Infrastructure providers, hired for that purpose and bound to protect the data. They act on our instructions: Petaflop, the owner of the VPS that hosts our servers and backups (a VPS rented from Hostinger, in São Paulo); Cloudflare, which handles the DNS of our domain; and Hostinger, which also handles the support email, where the messages you write to us are kept.
- Other players, in the social features described in section 4.
- Authorities, when required by law or a court order, or to defend the rights of ART X and of players.
- A company that takes over the Game, in a corporate reorganization or sale, which will be bound by this Policy.
6. Where the data is kept and international transfers
Our servers and backups are in Brazil. Data sent to Steam goes to Valve's servers in the United States. This transfer is necessary to perform the contract you have with us and with Valve (LGPD, art. 33, IX), and Valve applies the safeguards described in its privacy policy.
If you live outside Brazil, your data is processed in Brazil. Brazil has a general data protection law (the LGPD) and an independent national authority, the ANPD, and the European Union recognizes it as a country with an adequate level of protection.
7. How long we keep data
| Data | Period |
|---|---|
| Account, game data, social features and preferences | While the account exists. After a deletion request, we delete or anonymize it within 30 days |
| Steam friends list | While the account exists. Each upload replaces the previous one |
| Friend requests | Answered or cancelled ones are deleted within 2 days; unanswered ones, after 30 days |
| Friendships, blocks and privacy choices | While the account exists. Undoing a friendship or a block deletes the record immediately |
| Clan wall notes and clan diary milestones | They stay in the clan, even after you leave, until newer ones replace them (we keep each clan's latest 100 notes and 200 milestones). If the clan ends, they are deleted |
| Reports | 5 years after the report, to protect other players |
| Access records (IP, date and time) | 6 months, as required by the Brazilian Internet Civil Framework, or longer if an authority requests it. The IP is used to find several accounts on the same network only within that period |
| Computer code | 6 months after it was last used |
| Play pattern, sequence fingerprints and app signals | 30 days |
| Steam account standing | 6 months after the last check |
| Chest luck | Roughly the last 1,000 hours of play |
| Replaced session | 30 days |
| Colossus hunts and the Rift Seal score of each hunt | While the account exists |
| Rift Seal attempts (result, time and clicks) | 30 days |
| Purchases, Crystals and receipts | 5 years after the purchase, under tax and consumer protection deadlines |
| Trades between players | While the account exists and 5 years after, to prevent fraud |
| Cheating records, fraud alerts, evidence and penalties | While the measure lasts and 5 years after |
| Acceptance records | While the account exists and 5 years after the relationship ends |
| Support conversations | 5 years after the last message |
| Backups | Replaced within 14 days |
Aggregated and anonymous data that does not identify anyone (such as how many players reached a stage) may be kept longer.
8. How we protect the data
We use encrypted connections (HTTPS) between the Game and the servers, store session keys only as a cryptographic hash, limit access to data to the team members who need it, each with their own login, and keep backups. No system is completely immune to failure; if a security incident occurs that may cause you relevant risk or harm, we will notify you and the ANPD within the deadlines set by law.
9. Your rights
Under the LGPD (art. 18), you may ask at any time for:
- confirmation that we process your data;
- access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- portability of your data to another provider;
- deletion of data processed with your consent;
- information about who we share your data with;
- information about the possibility of not giving consent and its consequences;
- withdrawal of consent.
You may also object to processing based on legitimate interest and ask for a review of automated decisions (art. 20).
How to ask. Write to contact@artxgames.com with your Steam name and SteamID. To confirm that the account is yours, we may ask for a simple proof, such as showing a code on your Steam profile. We reply within 15 days. Requests are free of charge.
Deleting the account erases your online progress, unused Crystals and access to content bought with Crystals, and cannot be undone. It also erases the Social tab data tied to your account (the Steam friends list, friendships, requests, blocks, clan membership, Seals and the notes you left in the clan); reports follow the period in section 7. Without asking for deletion, you can, inside the Game, undo friendships, cancel requests, unblock people, leave the clan and turn off "playing now". Data the law requires us to keep (section 7) is kept only for the legal period.
If you are not satisfied with our answer, you can complain to the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd, or to the data protection authority of the country where you live. You may also petition consumer protection bodies (LGPD, art. 18, § 8).
10. Children and teenagers
The Game is not directed at children under 14 and should not be used by them. Teenagers may only play with the permission and supervision of their parents or guardians (Terms of Use, section 3). We always process teenagers' data in their best interest: we collect only what the Game needs to work, we do not build profiles for advertising, we show no ads and the Game has no chat of its own between players.
Anyone under 18 may only buy and sell on the Game's market with their guardian's consent (Terms of Use, sections 3 and 9.1). If Steam or another store starts to provide the age range of the account (such as the age signal that Brazilian law requires app stores to provide), we may use it only to limit or block these features on minors' accounts; if that happens, this Policy will be updated.
If you are a parent or guardian and believe we have processed a child's data without permission, write to the email in section 1 and we will delete the data.
11. Cookies and data on your computer
The Game stores on your computer the data it needs to work: the save, your preferences and the keys used to access the servers. The pages of these documents do not use cookies. We do not use cookies or tracking technologies for advertising, and the Game uses no third-party analytics tools. The artxgames.com website counts visits with a tool of its own, without cookies and without storing the IP.
12. If you live in another country
European Union, European Economic Area and United Kingdom. The legal bases in section 3 correspond, under the General Data Protection Regulation (GDPR) and the UK GDPR, to the performance of a contract (art. 6(1)(b)), compliance with a legal obligation (art. 6(1)(c)) and legitimate interests (art. 6(1)(f)). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to a decision based solely on automated processing with significant effects without human review. You may complain to the data protection authority of your country. We acknowledge complaints within 30 days.
United States. We do not sell or share personal data for behavioral advertising. The Game is not directed at children under 14, and we do not knowingly collect their data; if we learn that this has happened, we will delete the data.
Japan. We process data for the purposes in section 3. The data is kept in Brazil, a country with the data protection law described in section 6; data sent to Steam goes to Valve in the United States. Our security measures are described in section 8. To request disclosure, correction, suspension of use or deletion of your data, use the email in section 1. The business operator responsible is ART X GAMES TECNOLOGIA LTDA, at the address in section 1, represented by its managing partners.
13. Changes to this Policy
We may update this Policy. Relevant changes will be announced in the Game, which will ask you to acknowledge the new version. All versions, with the effective date of each, are available on this page.
14. Contact
Questions, requests and complaints about privacy: contact@artxgames.com. ART X GAMES TECNOLOGIA LTDA, Rua Amazonas, 83, Letra C, Boa Vista 2, Santa Rita do Sapucaí, MG, Brazil, ZIP 37538-640.
This Policy is written in Portuguese and translated into English, Japanese, Russian, Spanish, Simplified Chinese, Traditional Chinese, Thai, Turkish, Korean, German, French, Italian and Polish. The Portuguese version prevails if the versions differ, unless the law of your country requires otherwise.