Initial version, in force from launch. We will keep improving it; each revision changes the version and effective date, and important changes are announced in the game firstVersion 1.0 · Effective from 29 October 2026
Privacy policy
In short
You can play without giving a name, email or phone number. Your account starts as a guest with only a random id. We collect anything else only when play, purchases or safety need it, and list all of it in the table below
We do not sell your data, show no ads, and share data only with the processors named here
No system is safe in every case. We store tokens and codes as hashes, use HTTPS and keep as little as we can. If a breach happens, we will report it as the law requires
Who is responsible
The data controller is the Plakat Legends team
For personal data questions and every right below: support@plakatlegends.app
The data we hold
| Data | Why | Legal basis | How long | Who processes it |
|---|---|---|---|---|
| Random account id | Identify your guest account without knowing who you are | Contract (running the game you asked for) | Kept after deletion as an anonymous record that purchase records point at | Plakat Legends |
| Display name and fish names | Shown in the game, on public fish pages and in contests | Contract (running the game you asked for) | Until you delete the account | Plakat Legends |
| Birth year and the parent-permission flag | Set a spending limit that fits your age. We keep only the year, never the date | Legitimate interest (security, anti-cheat) | Until you delete the account | Plakat Legends |
| Session token hashes and their times | Keep your device signed in. We never store the token itself | Contract (running the game you asked for) | Until you sign out or delete the account, then revoked | Plakat Legends |
| Recovery-code hash | Let you move the account to a new device | Contract (running the game you asked for) | Until you delete the account | Plakat Legends |
| Linked identities: email address, Google account id (sub), LINE user id | Sign in to the same account on any device. Only when you choose to link | Contract (running the game you asked for) | Until you delete the account | Plakat Legends, Google or LINE (only the one you link), the email provider |
| Email one-time-code hashes and OAuth state rows | Check that the email or Google/LINE account is yours while linking | Contract (running the game you asked for) | Email codes 15 minutes, OAuth state 10 minutes | Plakat Legends |
| Game data: fish, the ledger of in-game currencies (Pearl, Gem, egg tickets), matches, contest entries and votes, reports | Run the game, count rewards, catch cheating | Contract (running the game you asked for) | Fish and most data go when you delete the account; ledger lines tied to purchases stay with the anonymous record | Plakat Legends |
| Purchases: orders, payment-gateway references, receipts | Deliver what you bought, refund, keep tax records. We never see or store card numbers | Legal obligation (accounting and tax) | 5 years, or longer if accounting and tax law requires, even after deletion, as an anonymous record | Plakat Legends, Stripe or Beam |
| Notifications: browser web push subscriptions and LINE user id | Send only the notifications you turned on | Consent (withdraw at any time) | Until you turn notifications off or delete the account | Plakat Legends, your browser’s push service, LINE |
| Support messages | Answer questions and refund requests | Contract (running the game you asked for) | Until you delete the account | Plakat Legends, the email provider |
| Referrals: who invited whom and the code used | Give referral rewards and catch fake accounts | Contract (running the game you asked for) | Until you delete the account | Plakat Legends |
| Clubs: membership, role, club name | Run clubs and show the club name | Contract (running the game you asked for) | Until you delete the account | Plakat Legends |
| Anti-cheat signals: a salted hash of your IP network (/24 prefix) and of a random device id the game keeps in your browser, request-rate counters | Catch fake votes, fake accounts and request floods. We never keep your full IP | Legitimate interest (security, anti-cheat) | Hashes: until you delete the account. Rate counters: in memory only, gone on a server restart | Plakat Legends |
| News sign-up (plakatlegends.app web page): email or LINE ID, language, where you came from, the consent version and time, a salted hash of your IP network (/24 prefix) | Send game news, updates, new seasons and events, nothing else. Not tied to a game account. The network hash stops mass sign-ups | Consent (withdraw at any time) | Until you unsubscribe or we stop sending news (see "News sign-up" below) | Plakat Legends, the email provider, LINE |
| Usage events (telemetry), no personal data | Learn which parts of the game work and which do not | Legitimate interest (security, anti-cheat) | Until you delete the account | Plakat Legends |
| Play statistics through Google Analytics: screens opened, game events (battle start and end, gacha pulls, sign-in), device type, rough country and a random id in a Google cookie. No name, email or account id | Learn where players come from and how they use the game, to make it better | Consent (withdraw at any time) | 2 months (the shortest Google Analytics allows). Stop any time on the Account screen, Terms tab | Google (Google Analytics) |
Processors
- Stripe and Beam: payments (card and PromptPay). Card details stay with them
- Cloudflare: CDN and DNS, serving game files and passing requests to our server
- The VPS host: the machine that runs our server and database
- Cloudflare Email Sending: sends one-time codes, our replies and news to people who signed up for it
- Google and LINE: only when you link that account or turn on LINE notifications
- Google Analytics: play statistics, with its cookie only if you accept. Ads, ad personalisation and Google Signals are off
- Cloudflare Web Analytics: counts page visits in aggregate, without cookies
Some processors handle data outside Thailand. We pick only ones with data-protection safeguards
Your rights
- See and get a copy of your data
- Correct data that is wrong
- Have your data deleted (delete the account, see the next section)
- Withdraw consent at any time, for example by turning notifications off
- Object to or ask us to restrict some uses
- Complain to the Personal Data Protection Committee office (สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล, PDPC)
Send a request to support@plakatlegends.app with your account or fish code. We answer within 30 days
News sign-up
The plakatlegends.app web page has a box for an email or LINE ID to get game news, updates, new seasons and events. We keep it only when you tick the consent box, and we record the consent wording version and the time
It is kept in the game database on our server, apart from game accounts. Only the Plakat Legends team can read it. We never sell or share it, except with the email provider and LINE to deliver the news
Unsubscribe or ask us to delete it at any time: write to support@plakatlegends.app with the email or LINE ID you left. We delete it within 30 days and send nothing more. Deleting a game account does not remove it, as the two are kept apart
Delete your account and data
In the game: the Account screen (#account), then delete the account. Or through the API: DELETE /v1/me with the body {"confirm":"DELETE"}. Deletion cannot be undone
What is removed or revoked at once:
- Every session is revoked and the recovery code removed
- Linked identities (email, Google, LINE) are removed
- The display name and birth year are cleared
- Pending email codes and the device and network hashes are deleted (an invite still counts for the friend who invited you, without those hashes). Your invite code is turned off
- You leave your club; if you owned it, the longest-standing member takes over
- All fish, usage events, web push subscriptions, the in-game inbox and notification settings are deleted
What stays: the account row as an anonymous record (no name, no linked identity), because purchase records, receipts and the in-game ledger point at it and must be kept as tax records
Children
Before the first purchase we ask the birth year once. Players under 18 need a parent’s permission and get a lower limit.
Cookies and browser storage
The game keeps its sign-in token, your language, a random device id and your answer about play statistics in your browser so the game works. There are no ad cookies
The first time you open the game we ask whether we may use Google Analytics. If you accept, Google keeps a random-id cookie (_ga) to count play. If you decline there is no Google cookie, but the game still sends Google cookieless signals with no id so it can estimate player numbers. Change your answer any time on the Account screen, Terms tab
Changes to this policy
When we change this policy we update the version and date at the top, and tell you in the game first if the change matters