Privacy Policy

This Privacy Policy explains how Heistag handles personal data when you visit heistag.gg, authenticate, create or maintain a Heistag account, participate in Season Zero or the Closed Alpha, or contact us.

Heistag is currently an independent digital project operated in Brazil. This alpha policy will be updated as the product, company structure, features, and regulatory obligations evolve.

Depending on how you use Heistag, we may process information you provide directly, information received through authentication providers, and technical information necessary to operate and secure the service.

• Account and authentication data, such as email address, provider identifier, and basic profile information made available through Google authentication.
• Heistag profile data, such as display name, username, Genesis ID information, and onboarding status.
• Information you voluntarily provide when communicating with Heistag or participating in product features.
• Technical and security information that may include IP address, browser or device information, request logs, session data, and security events processed by Heistag or its infrastructure providers.
• Locale preference stored so Heistag can remember your selected language.

We process personal data only for legitimate and defined purposes connected to operating Heistag.

• Authenticate users and maintain secure sessions.
• Create and operate Heistag accounts and Genesis identities.
• Provide, maintain, debug, and improve the service.
• Protect Heistag, its users, and communities against abuse, fraud, unauthorized access, and security threats.
• Respond to support, privacy, legal, and account-related requests.
• Comply with applicable legal or regulatory obligations.

Where the Brazilian General Data Protection Law (LGPD) applies, Heistag may rely on legal bases including performance of a contract or preliminary procedures requested by the user, compliance with legal obligations, legitimate interests where appropriate and balanced against user rights, and consent when specifically requested.

The applicable legal basis depends on the context and purpose of each processing activity.

Heistag does not sell personal data. We may use specialized service providers to operate the platform and may share or make data available to them only as necessary for those services.

• Google, for authentication when you choose Google sign-in.
• Supabase, for authentication, database, and related backend infrastructure.
• Vercel, for application hosting and delivery infrastructure.
• Professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights, investigate abuse, or defend legal claims.

Some infrastructure or service providers may process information in countries outside Brazil. When international transfers occur, Heistag seeks to use providers and mechanisms compatible with applicable data-protection requirements.

Heistag uses cookies or similar browser mechanisms that are necessary for authentication, session continuity, security, and language preference.

At the publication of this version, Heistag does not intentionally use advertising cookies or third-party behavioral advertising trackers.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, to maintain the service, resolve disputes, protect security, and comply with applicable obligations.

When an account is deleted, personal data associated with the account will be deleted or anonymized when required and technically appropriate, subject to lawful retention requirements.

An activated Genesis identifier may be retired rather than reassigned to another person in order to protect identity integrity and prevent historical references from being attributed to a different user. Retirement of an identifier does not mean that Heistag will continue displaying the former user's personal profile.

Depending on applicable law, you may have rights concerning your personal data, including confirmation of processing, access, correction, deletion or anonymization where applicable, information about sharing, portability where applicable, withdrawal of consent, and objection to certain processing.

Requests can be sent to legal@heistag.gg. We may need to verify that the requester is authorized to act regarding the account or data involved.

Heistag uses technical and organizational safeguards intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. No internet service can guarantee absolute security.

The Heistag Closed Alpha is currently intended only for participants who are at least 18 years old.

Heistag does not currently intend to offer Closed Alpha accounts to children or adolescents. Age-assurance measures may evolve as the product and applicable regulatory requirements develop.

If we become aware that an ineligible person is participating in the Closed Alpha, we may suspend access and take appropriate steps regarding the account and associated personal data.

Heistag may update this Privacy Policy as the product evolves or when legal, security, operational, or regulatory requirements change.

Material updates will receive a new version and effective date. Where appropriate, we will provide additional notice before significant changes take effect.

For privacy questions, requests, or concerns, contact legal@heistag.gg.