Privacy Policy | Nikas Play

01Who looks after your data

Nikas Play is my personal website: I'm Nikas, from the Nikas Play channel on YouTube. I'm responsible for the personal data handled on this site (the controller, in data protection terms). For anything about your data, including the requests the law allows, reach me through the contact form.

02What data is handled

Contact form: your name, your email, the subject, the game (if you add one) and the message you write.
Submission record: the IP address, the date and time the form was sent and a submission code. For the form's security only, the email I receive also includes the approximate location Cloudflare estimates from the IP (city and country; on mobile, it's usually the carrier's city) and the device type (phone, tablet or computer, and the system).
Bot check: the form uses Cloudflare Turnstile, which looks at technical signals from your browser and device (such as the IP and browser features) to confirm a person is sending it. It only loads when you start filling in the form.
Videos: the YouTube player only loads when you click to watch a video, in privacy-enhanced mode (youtube-nocookie.com). From then on, YouTube receives technical data, such as your IP, under its own policy.
Technical access data: to deliver the site and protect it from attacks, the server and Cloudflare automatically log data such as the IP address, date and time, the page visited and the browser type.
Site easter eggs: the count of flying saucers shot down and cows saved on the error page is stored only in your browser. It's never sent to me or anyone else.

The site uses no advertising tools, no analytics (such as Google Analytics) and no social media buttons that track visitors: fonts, images and game covers are served by the site itself, and Steam prices are fetched by the server, with no data about who is visiting.

03What the data is used for, and the legal basis

Each use has a legal basis under the LGPD:

Replying to your message (and continuing the conversation by email, about a suggestion, a guide request, a key or a partnership): your consent, given when you tick the box on the form (article 7, item I), and, for a partnership proposal, steps prior to a contract at your request (article 7, item V).
Protecting the site and the form against fraud, spam and bots (the submission record, Turnstile, the sending limit and technical data): legitimate interest, for your security and the site's (article 7, item IX).
Keeping the access record (IP, date and time): legal obligation and legitimate interest, as required by Brazil's Internet Civil Framework (Law No. 12,965/2014).

Your data is not used for advertising, doesn't go on any mailing list unless you ask, and is not sold.

04Who the data is shared with

Your data is never sold or rented. It only goes through:

Providers that keep the site running: the site's hosting, the email service where messages arrive and Cloudflare (site delivery, security, Turnstile, sending the form messages and estimating the approximate location), which handle the data only to provide their service, under their own policies: Cloudflare and Cloudflare Turnstile.
YouTube (Google), when you play a video, under the Google privacy policy.
Public authorities, when the law or a court order requires it.

Links to Steam, YouTube, social media, LivePix and Ko-fi lead to sites with their own policies. Support (tips, subscriptions and channel memberships) is paid on LivePix, Ko-fi or YouTube: the site never receives your card or payment details. Supporters show up on the supporters wall with the name they used to support (on LivePix, Ko-fi or YouTube), and only the name, unless they ask to stay anonymous; you can ask to have your name removed at any time through the contact form.

05Cookies and what stays in your browser

Cookies are small files stored by your browser. This site uses no advertising or analytics cookies. Here's what may show up:

Sent notice: after you send a message, a session cookie (contato_aviso) shows the confirmation once. It only applies to the Contact page and is deleted when you close your browser. Just opening the page doesn't set it.
Security: Cloudflare may set security cookies and technical data, such as those of the bot check, to protect the site.
Videos: when you play a video, YouTube may store data in your browser, under its own policy.
Easter eggs: the flying saucer and saved cows scores stay in your browser's storage and never leave it.

The first two are needed for the site to work securely. You can delete or block cookies in your browser settings; blocking all of them may stop the form from working.

06International transfers

Some providers, such as Cloudflare and Google, may process data on servers outside Brazil. In those cases, the transfer follows article 33 of the LGPD, with companies that adopt adequate data protection safeguards.

07How long data is kept

Form messages: only in my inbox, for as long as needed to reply and continue the conversation. You can ask for deletion at any time.
Submission record (date, time, IP and a code): 6 to 7 months. Each month's records are deleted automatically, all together, 6 months after the end of that month.
Abuse control (to block excessive sending): counts the messages of the last hour, and anything older is deleted. The IP itself isn't stored: only a code derived from it with a secret site key.
Session cookie: until you close your browser.
Easter egg scores: until you clear your browser data.
Server and Cloudflare technical data: for as long as needed for the site's security and operation.

After these periods, the data is deleted or anonymized, unless the law allows or requires keeping it.

08Your rights

The LGPD (article 18) gives you the right to:

confirm whether your data is handled and access it;
correct incomplete, inaccurate or outdated data;
ask for unnecessary or excessive data, or data handled against the law, to be anonymized, blocked or deleted;
ask for your data to be ported to another provider;
ask for the deletion of data handled with your consent;
know who your data is shared with;
know that you can refuse consent and what happens if you do (without it, I can't reply through the form);
withdraw your consent at any time;
file a complaint with Brazil's National Data Protection Authority (ANPD).

To use any of them, reach me through the contact form. To protect your data, I may ask for information that confirms it's really you before handling the request. Replies follow the LGPD deadlines. If you live outside Brazil, you can use the same channel for the equivalent rights under your local law (such as the GDPR in the European Union).

09Security

The site uses technical measures to protect your data from unauthorized access, loss and changes: secure connection (HTTPS), strict content security policies, bot checks, sending limits and no messages stored on the site. For your safety, don't send documents, passwords or banking details through the form. No system is fully immune to failure; if an incident could bring you relevant risk, you and the ANPD will be notified, as the LGPD requires.

10Children and teenagers

This is a gaming site for a general audience. If you're under 18, please send messages with a parent or guardian's knowledge; if you're under 12, only with their permission, as the LGPD requires (article 14). If a child's data arrives without that permission, it's deleted as soon as this is noticed.

11Changes to this policy

This policy may be updated to keep up with changes to the site, the tools it uses or the law. The version in force is always the one published on this page, with the date of the last update. Using the site is also subject to the Terms of Use.

12Contact

Questions about this policy or your data? Reach me through the contact form.