Privacy Policy

1. Who controls your data

BREAK™ (“BREAK™”, “we”) is an independent studio project under development and determines the purposes and means of the processing described here. Formal identification of the person responsible for the project will be published before commercial launch.

This Policy covers brkhq.com, RIFT, RIFT accounts, social features, game libraries and transactional communications. External services reached through links have their own policies.

2. Data we process

Account and authentication data includes email, username, public identifier, account status and creation date. Passwords are transmitted securely and stored as hashes, never as readable passwords. Verification, reset and session tokens are also protected.

Profile and community data may include display name, bio, avatar, friendships, requests, blocks, presence, last seen time, current game and session invitations, depending on the features used and visibility choices.

RIFT and game usage may include the library and licenses linked to the account, versions and builds, downloads, installations, temporary game-access tickets and multiplayer session information.

Device, security and diagnostic data may include device name and platform, device identifier, IP address, timestamps, request logs, failures and security events. The website and infrastructure providers may also log browser, operating system, requested pages and network data.

The current website does not intentionally collect sensitive personal data, payment information or support messages.

3. How we collect data

We receive data directly when you create an account, sign in, verify your email, edit your profile, use social features and install or play games. Other data is generated automatically as the website, RIFT, API and security infrastructure operate.

Website login uses strictly necessary first-party cookies, protected from JavaScript access, to maintain and renew the session. The site uses no advertising cookies or first-party behavioral analytics. Infrastructure providers may use technologies necessary for delivery, operation and security. If optional analytics, advertising or cookies are introduced, we will update this Policy and request a choice where required.

4. Purposes and legal bases

Contract performance and pre-contract steps: create and manage accounts, authenticate users, provide RIFT, maintain libraries, deliver games and updates, enable social features and provide requested support.

Legitimate interests: secure accounts and services, prevent fraud and abuse, diagnose failures, maintain availability, measure technical performance and improve features, subject to necessity, proportionality and user rights.

Legal obligations and legal claims: retain required information, respond to competent authorities, and establish, exercise or defend rights. Consent is used where required, including for specific optional features. For EEA/UK users, these purposes correspond to contract, legitimate interests, legal obligations and consent under applicable law.

5. Sharing and service providers

We share only what is necessary with providers supporting operations: Cloudflare for DNS, proxying, delivery and security; Render for website and API hosting; Supabase and its infrastructure providers for database and storage; a transactional email provider for account verification and recovery; and GitHub for public installer and update distribution.

Providers process data under their terms and, when acting for us, applicable instructions and agreements. We may also disclose data to comply with law or valid authority requests, protect rights and safety, or support a corporate transaction with suitable safeguards.

Discord, X, YouTube and other external destinations receive data only when you choose to visit or interact with them. We do not sell personal data or share it for third-party behavioral advertising.

6. International transfers

Providers may process or store data outside Brazil and your country, including in the United States and other infrastructure locations. We seek recognized transfer mechanisms, appropriate contractual and technical safeguards, and data minimization under the LGPD, ANPD rules and other applicable laws.

Additional information about destinations, providers and applicable safeguards will be available through the future privacy channel.

7. Retention and deletion

Account and profile data is retained while the account remains active. Tokens remain only until use, replacement or expiry; session and security records are retained as needed for authentication, abuse prevention, diagnostics and legal claims.

After deletion or closure, we erase or anonymize data that no longer needs to be retained. Limited records may remain to meet legal duties, prevent fraud, resolve disputes, protect rights or in backups until secure rotation. Account relationships are removed or disassociated as technically and legally appropriate.

8. Security

We use risk-appropriate safeguards including encrypted connections, password hashing, expiring tokens, access controls, request rate limits and separation of the website, API and database. No system is completely immune; we monitor and improve safeguards and address incidents under applicable law.

Use a unique password, protect your device and notify us if you suspect unauthorized access. Never send your password by email or support channels.

9. Your rights

Depending on applicable law, you may request confirmation and access; correction; deletion, anonymization or restriction; portability where regulated; information about sharing; withdrawal of consent; objection to unlawful or legitimate-interest processing; and review of solely automated decisions where applicable.

A free electronic channel for these requests will be published before commercial launch. We may request reasonable information to verify identity and protect the account. Brazilian users may also petition the ANPD and consumer protection bodies; EEA/UK users may complain to their local supervisory authority.

10. Children and teenagers

RIFT is not directed to children under 13. Users under 18 must use the services with a parent or legal guardian’s knowledge and assistance where applicable. Processing involving minors must prioritize their best interests.

If we learn that a child created an account without legally required authorization, we may restrict it and delete the data, retaining only what is necessary for protection, law or contacting the guardian. The future privacy channel will also assist legal guardians.

11. Changes and privacy channel

We may update this Policy to reflect service, provider or legal changes. The date above identifies the current version; material changes may be communicated on the site, in RIFT or by email.

BREAK™ does not yet have a public contact channel. Before commercial launch, this page will be updated with a free electronic channel for questions, complaints, data subject rights and incidents, together with the applicable identification of the person responsible for processing.