Privacy Policy — COLOSSUMYY

Version 1.1 · Last updated: July 14, 2026

This policy explains what personal information is collected on the COLOSSUMYY site (the "Site"), what it is used for, to whom it is disclosed, and what your rights are — in accordance with the Israeli Protection of Privacy Law, 5741-1981, including Amendment No. 13 (in force from August 14, 2025), and the Protection of Privacy Regulations (Data Security), 5777-2017. Data controller: the site Operator. Contact: colossumyy@gmail.com.

1. What data we collect and why

Information	Source	Purpose
Email address, username	Provided at registration	Identification, account management, access recovery, prevention of duplicates and fraud
Password — encrypted (bcrypt) only; we cannot see it	Provided at registration	Account security
Game data (damage, diamonds, characters, ranking, achievements, friendships, groups)	Generated through use	Running the game, leaderboards, awarding prizes
Chat messages (private and group)	Provided through use	Providing the chat service, enforcing the code of conduct, handling complaints
Purchase data (transaction id, amount, pack type)	PayPal	Crediting the account, preventing double charges, accounting
Basic technical data (IP address, logs)	Automatic	Security, prevention of misuse, service integrity

Important: Your payment method details (card / PayPal account) are provided directly to PayPal and are never stored by us.

2. Providing information is voluntary

You are under no legal obligation to provide information; providing it depends on your will and consent. However, without the registration details you cannot open an account and take part in the Game.

3. Legal basis for processing

The information is collected and processed with your consent, given at registration (checking the consent box), and for the purpose of performing the engagement between you and the Operator (providing the game services). Processing for security and fraud-prevention purposes is done for the legitimate interest of protecting the service and its users.

4. To whom information is disclosed

PayPal — payment processing, and the payout channel for cash prizes (subject to PayPal's privacy policy; the information may be processed outside Israel, including in the United States).
Oracle Cloud — the hosting infrastructure on which the server runs.
International transfers: because these providers operate globally, your data may be transferred to and processed in countries outside your own, including outside the EU/EEA. Where such a transfer is subject to the GDPR, it is made under an appropriate safeguard (such as the European Commission's Standard Contractual Clauses or an adequacy decision) or on the basis of your consent and the necessity of performing your contract with us.
The information is not sold and is not transferred to third parties for marketing purposes. Disclosure will only be made if required by law, judicial order, or to protect the rights of the Operator and users.
Please note: your username, ranking, achievements and accumulated damage are displayed publicly in the Game by its very nature (leaderboard, public profile). Your email address is never shown to other users.

5. Cookies and local storage

The Site does not use advertising or tracking cookies. It uses the browser's localStorage to store a login token (JWT) only, so that you do not have to log in again on every visit. Clearing the Site's data in your browser will sign you out of your account.

6. Data security

We apply accepted security measures: traffic encryption (HTTPS/TLS), one-way password hashing (bcrypt), rate-limiting of login attempts, restricted access permissions and a secured server. That said, no system is entirely immune, and we cannot guarantee absolute protection against breaches.

7. Retention period

The information is kept for as long as your account is active. After an account is deleted, identifying details will be deleted or anonymized within a reasonable time, except for data that must be retained by law (e.g. transaction records for tax purposes) and operational logs kept for a limited period for security purposes.

8. Your rights

Access — you have the right to review the personal information stored about you (Section 13 of the Law).
Correction and deletion — you have the right to request correction of incorrect information or its deletion (Section 14 of the Law), including full deletion of your account.
To exercise your rights, contact colossumyy@gmail.com from the email address registered to your account. We will handle the request within a reasonable time and no later than required by law.
You also have the right to lodge a complaint with the Israeli Privacy Protection Authority.

9. Minors

The service is intended for those aged 18 and over only, and we do not knowingly collect information about minors. If you become aware that a minor has registered on the Site, please notify us and we will delete the account and the information.

10. Residents of the EU / EEA and the United Kingdom (GDPR)

If you are located in the European Union, the EEA or the United Kingdom, the General Data Protection Regulation (GDPR) / UK GDPR applies to our processing of your personal data. The data controller is the Operator (contact: colossumyy@gmail.com).

Legal bases. We process your data on the following bases: performance of a contract (running your account and the game, processing purchases, paying prizes); consent (registration, and the optional game-updates emails, which you may withdraw at any time); legitimate interests (security, fraud and cheat prevention, service integrity); and compliance with a legal obligation (e.g. retaining transaction records for tax).

Your GDPR rights. In addition to the rights in Section 8, you have the right to: access your data and receive a copy; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability (receive your data in a structured, machine-readable format); object to processing based on legitimate interests; and to withdraw consent at any time without affecting prior processing. Where required, decisions are not made solely by automated means with legal effect on you. To exercise any right, email us from your registered address; we will respond within one month. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

11. Residents of California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how it is used and disclosed (see Section 1), the right to request deletion or correction of your personal information, and the right to be free from discrimination for exercising these rights. We do not sell or "share" your personal information (as those terms are defined under the CCPA/CPRA) and we do not use it for cross-context behavioural advertising. To exercise your rights, contact colossumyy@gmail.com from your registered email.

12. Changes to this policy

This policy may be updated from time to time. The binding version is the one published on this page, with the update date noted. A material change will be accompanied by a notice on the Site.