NANQUIM: Privacy Policy
FINAL DRAFT for legal review. Review by a qualified attorney is recommended before final publication.
Version: 1.0
Effective from: the release date of the Game in Early Access on Steam
Last updated: October 12, 2026
This document is available in English and Portuguese. The English version is the original and prevails in case of any discrepancy, except where the law of the user's country of residence requires the version in the user's language to prevail. For consumers residing in Brazil, the Portuguese version prevails.
1. Summary
- To play online, we use your Steam identifier (SteamID64) and your Steam display name. We do not ask for your email, password, real name, phone number, address, or payment details.
- We store your progress, matches, rating, and items so that the Game works.
- We keep match replays for 30 days to fight cheating and review reports.
- Anti-cheat runs only on the server. The Game does not install kernel-level anti-cheat and does not scan your computer.
- Voice chat is off by default. If you turn it on, it is transmitted in real time, relayed by our server only to the players in your room or match, and it is not recorded or stored.
- We do not store your IP address in clear text. We do not use advertising tools, third-party analytics, or tracking cookies. We do not sell personal data.
- You can request access to, correction of, a copy of, or deletion of your data by email at hi@alas.technology.
2. Who the controller is
2.1. The controller of the personal data processed by the game NANQUIM (the "Game") is ALAS TECHNOLOGY LLC, a limited liability company organized in the United States of America, D-U-N-S 109327849, with its address at 30 N Gould St Ste R, Sheridan, WY 82801, United States ("we" or "us").
2.2. Data protection officer (Brazilian LGPD, art. 41): this role is performed by ALAS TECHNOLOGY LLC through hi@alas.technology, which receives complaints and communications from data subjects and from the Brazilian National Data Protection Authority (ANPD).
2.3. Contact for the European Union and the United Kingdom. ALAS TECHNOLOGY LLC has no establishment in the European Union, in the European Economic Area (EEA) or in the United Kingdom and, on the date of this Policy, has not designated a representative under art. 27 of the GDPR or art. 27 of the UK GDPR. Data subjects in the EU, the EEA and the United Kingdom, as well as supervisory authorities, may contact us directly and free of charge by email at hi@alas.technology, with the subject "Privacy", or by post at the address in Section 2.1. You may write in English, in Portuguese or in your own language. Requests are handled as described in Section 10, within the deadlines of the GDPR and of the UK GDPR, and contacting us does not limit your right to lodge a complaint with a supervisory authority (Section 10.5). If we designate a representative, this Policy will be updated with its name and contact details before the designation takes effect.
2.4. Why these laws apply: the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") applies because the Game is offered in Brazil and processes data of individuals located in Brazil (art. 3). The EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR apply when the Game is offered to individuals in the European Union or the United Kingdom (art. 3(2)).
3. Relationship with Steam (Valve)
3.1. The Game is distributed through Steam. Your Steam account, purchase, payment, and refunds are handled by Valve Corporation, as an independent controller, under Valve's privacy policy. We do not receive payment data or your card details.
3.2. Steam features used or planned in the Game: achievements, stats, Rich Presence (game status visible to friends), Steam Cloud (only for local preferences such as controls, audio, and video), lobbies and invites, and the Steam overlay. Data from these features stays with Valve and is governed by Valve's policy.
4. How authentication works
When you go online, the Game asks Steam for an authentication ticket and sends it to our server. The server validates this ticket directly with Valve's Web API and receives your SteamID64. The server also uses your Steam display name (persona name). The ticket is not stored in any database or log.
5. What data we process, why, on what legal basis, and for how long
| Category | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account identification | SteamID64, Steam display name, profile creation and last access dates | Identify you in the service, authenticate you, and show your name to other players | Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) | While the profile exists; deleted after a deletion request, subject to Section 7 |
| Progress and economy | XP, coins, equipped and owned cosmetics and their source, login days, daily rewards, medals, challenges | Keep your progress and items | Performance of a contract | While the profile exists |
| Campaign (story mode) | Stages completed, difficulty, stars, score, time, number of attempts, world chests claimed; temporary verification code for each attempt | Save and validate your campaign progress and grant rewards | Performance of a contract | Progress: while the profile exists. Temporary code: deleted once used or expired |
| Competitive | Rating and MMR per queue (rating, deviation, volatility, number of matches, rank) | Create balanced matches and display rankings | Performance of a contract | While the profile exists |
| Statistics | Overall and per-class totals: XP, matches, wins, KOs, deaths, damage, parries, hits, best combo | Display stats and progress | Performance of a contract | While the profile exists |
| Match history | Match ID, date, mode, map, whether ranked or private, duration, winner, participating players (SteamID64), team, placement, KOs, deaths, damage, class used, XP and coins earned, rating change | Display history, calculate ratings, and resolve disputes | Performance of a contract | While the profile exists |
| Match replays | Match configuration, seed, each player's per-tick inputs, state hashes, SteamID64 | Detect cheating and review reports | Legitimate interest (fraud prevention and security; LGPD art. 7, IX and art. 10; GDPR art. 6(1)(f)) | 30 days, with automatic deletion (routine runs every hour). Exception in Section 7 |
| Security logs | Anti-cheat events per SteamID64 (protocol signals, rate limiting, tick window, speed, aim and macro statistics, physics), trust score (TrustScore), and decisions taken | Detect and sanction cheating and protect the network | Legitimate interest | 90 days. Exception in Section 7 |
| IP address | Connection IP, processed in memory only; in logs it appears only as an HMAC-SHA256 hash with a random salt that changes on every server restart | Maintain the connection, limit abuse, and protect against denial-of-service (DDoS) attacks | Legitimate interest | Clear-text IP: only during the connection, in memory. Hash: kept with the security log, irreversible after the server restarts |
| Room chat | Text messages | Relay in real time to players in the room, with profanity filtering, link blocking, and message rate limits | Performance of a contract | Not stored: they exist only while being relayed |
| Voice chat | Audio from your microphone, compressed (Opus) in 20 ms frames, only while you transmit (push to talk or open mic) | Relay in real time, through our server, to the players in your room or match who can hear you (for example, only your team in Teams mode) | Performance of a contract, at your request: voice chat is off by default and only works after you turn it on in the options and the system grants microphone access | Not recorded or stored: the server does not decode the audio and each frame exists only while being relayed. Preferences (voice on, muted players, and volumes) stay on your device |
| Voice reports | SteamID64 of the reporter and of the reported player, chosen reason, room or match, and date | Review voice abuse and enforce the Code of Conduct | Legitimate interest | Kept with the security log (90 days). Exception in Section 7. Audio is not attached to the report because it is not recorded |
| In-match chat | Text messages and quick (predefined) messages | Relay in real time to whoever may read them under the mode's rules (for example, only your team in Teams mode and only your side in Hide and Seek and Infection), with the same filters as room chat | Performance of a contract | Not stored. The short history lives only in your device's memory and is gone when you close the Game |
| Room presence (cursor) | Position of your pointer, touch or focused item on the room screen, as relative coordinates (0 to 1), with no data from your computer | Show the other players in the same room that you are there | Performance of a contract | Not stored: each position exists only while being relayed. You can turn off the display of cursors |
| Chat mutes and blocks | Accounts (SteamID64) you muted or blocked | Hide messages; when you block someone, the server also stops exchanging chat and cursors between the two of you | Performance of a contract, at your request | Mutes and blocks stay on your device; the server receives blocks only for the duration of the connection, in memory |
| Chat reports | SteamID64 of the reporter and of the reported player, chosen reason, room or match, date, and up to the last 3 messages the reported player sent on that connection | Review chat abuse and enforce the Code of Conduct | Legitimate interest | Kept with the security log (90 days). Exception in Section 7. Outside of a report, no message is stored |
| Operational metrics | Aggregated counts and latencies that do not identify any player | Operate and improve the service | Legitimate interest | Aggregated and anonymized data, no time limit |
| Communications with you | Email, SteamID64, and the content of messages you send us (support, privacy, appeal, report) | Respond and keep a record of the request | Performance of a contract; exercise of legal claims; compliance with a legal obligation | Up to 2 years after the request is closed, or for the period in Section 7 when linked to an enforcement action |
| Legal obligations | The data above, when required | Comply with the law, court orders, or requests from authorities | Compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)) | For the period required by law |
5.1. Legitimate interest. For processing based on legitimate interest, we keep a documented balancing test (LGPD art. 10; GDPR art. 6(1)(f)), which considers that preventing cheating protects all players, that the data is limited to what is necessary, and that the IP address is pseudonymized. You may object to this processing (Section 10), but cheat prevention is necessary for online play, and an objection may prevent you from using the online modes.
5.2. Microphone. The Game only asks for microphone access when you turn voice chat on in the options, after an on-screen explanation. The microphone stays open only while voice chat is on and is closed when you turn it off. You can mute any player, mute everyone, adjust each player's volume, and report voice abuse. In ranked matches, opponents start muted. The server does not relay the voice of players you mute.
5.3. Data on your device. Game settings (controls, audio, video, language) and local campaign progress are kept in the app's local storage on your device and may be synced through Steam Cloud. We do not receive this data, except for the campaign progress you submit when playing online.
5.4. Spectator mode. In custom rooms, people watching a match receive it with about a 5-second delay and only see what an observer without a role can see: no information hidden from the players (for example, who is disguised in Hide and Seek) is sent to spectators. Spectator voice chat is a separate channel: spectators speak with and hear only other spectators, never the players. Your name and your SteamID64 appear in the match's voice participant list. Nothing you watch is recorded for you.
5.5. Moderation queue. Voice and chat reports go into a queue for human review with minimal metadata: the SteamID64 of the reporter and of the reported person, the channel (voice or chat), the chosen reason, the room or match, and the date. The queue does not store audio or message text (the up to 3 last messages attached to a chat report stay only in the security log, as described in the table above). To prevent report abuse, each person may send at most 10 reports per hour, and the same report repeated within 10 minutes counts once. Reports stay in the queue for up to 90 days, or for the period in Section 7 when linked to a measure. Moderators may mute an account for a set time (up to 30 days), which blocks voice, chat, and the room cursor, or ban it; the sanction record follows Section 7.2.
6. What we do NOT collect or do
- The Game does not include advertising tools or third-party analytics and does not send usage telemetry from your device.
- The Game does not use cookies or similar technologies for tracking or advertising.
- Anti-cheat runs only on the server. The Game does not install drivers or kernel-level anti-cheat and does not collect hardware information, process lists, or files from your computer.
- We do not store chat messages.
- The server keeps, in memory only and only while you are connected, your last 5 chat messages, to contain flooding and to attach to a report if someone reports you. They are gone when you disconnect.
- We do not record voice. Audio passes through our server only to be relayed in real time; it is not decoded, stored, transcribed, or used to train any system.
- We do not receive payment data. In this phase, the Game does not sell anything for real money other than the license itself, which is sold by Steam.
- We do not sell, rent, or share personal data for behavioral advertising.
- We do not use personal data to build advertising profiles.
If we add in-app telemetry, in-game purchases, or third-party anti-cheat in the future, this Policy will be updated and you will be notified before such processing begins.
7. Retention of evidence
7.1. Replays, security logs, and data linked to an enforcement action or a pending appeal are retained beyond the periods in Section 5 until the end of the appeal period (30 days from notification) or the final appeal decision, and then for an additional 12 months for the exercise or defense of legal claims in administrative or judicial proceedings. If proceedings are ongoing, the data is kept until they conclude. After that, it is deleted or anonymized.
7.2. The record of a ban (SteamID64, type of action, violation category, and dates) is kept while the ban is in force and for 12 months after it ends, in order to enforce the action and identify repeat violations.
8. Who we share data with
| Recipient | What | Why |
|---|---|---|
| Valve (Steam) | Authentication ticket for validation; achievements, stats, and Rich Presence; Steam Game Ban request, when applied after human review | Authentication, platform features, ban enforcement |
| Cloud infrastructure providers, as processors | Data stored and processed on the servers | Host the Game servers and the database |
| Network protection provider, as processor | Connection traffic, including the IP address | Protect the service against denial-of-service (DDoS) attacks |
| Other players | Display name, rating and rank, public stats, room chat messages, replays shown in the Game | Operation of the multiplayer game |
| Authorities | Data required by law or court order; reports of sexual content involving minors | Legal obligation |
| Successor in a corporate transaction | Data needed for the continuity of the Game, under this Policy | Merger, acquisition, or transfer of the Game, with prior notice to you |
Processors handle data only on our instructions and under contracts with confidentiality and security obligations. The current list of processors can be requested at hi@alas.technology.
9. International data transfers
9.1. The Game servers are located in the São Paulo region (Brazil) and in North America. The controller is a United States company. Your data may therefore be transferred to the United States and to other countries where our infrastructure providers operate.
9.2. These transfers rely on the mechanisms in art. 33 of the LGPD (in particular, the standard contractual clauses approved by the ANPD) and in Chapter V of the GDPR (the European Commission's standard contractual clauses or, when the recipient is certified, the adequacy decision for the EU-U.S. Data Privacy Framework). You can request information about these safeguards at hi@alas.technology.
10. Your rights
10.1. You have the right to (LGPD art. 18 and art. 20; GDPR arts. 15 to 22):
a) confirmation that we process your data and access to it;
b) correction of incomplete, inaccurate, or outdated data;
c) anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully;
d) portability, in a structured and commonly used format;
e) deletion of your data;
f) information about whom we share your data with;
g) objection to processing based on legitimate interest;
h) review of decisions made solely on the basis of automated processing that affect your interests, including automated anti-cheat actions (the procedure is in the Code of Conduct);
i) restriction of processing, in the cases provided for in the GDPR;
j) information about the possibility of not giving consent and its consequences, when processing depends on consent.
10.2. Exception. Data retained as evidence of a violation of the terms, during the period in Section 7, may not be deleted immediately, because it is needed for the exercise or defense of legal claims (LGPD art. 16 and art. 7, VI; GDPR art. 17(3)(e)). In such cases, we will explain the reason and the period.
10.3. How to make a request. Send your request to hi@alas.technology with the subject "Privacy" and your SteamID64. To protect your account, we may ask you to prove control of the Steam account, for example by temporarily placing a code we send you in your Steam display name or profile summary. Requests are free of charge.
10.4. Deadlines. We respond within 15 days for the full statement under art. 19 of the LGPD and within 1 month for GDPR requests, extendable under art. 12(3) of the GDPR with notice to you.
10.5. Complaints. You may lodge a complaint with the ANPD in Brazil; in the EU or the EEA, with the supervisory authority of the country of your habitual residence, of your place of work or of the place of the alleged infringement (GDPR art. 77; the list of authorities is available on the website of the European Data Protection Board, edpb.europa.eu); or, in the United Kingdom, with the Information Commissioner's Office (ICO, ico.org.uk). You may also complain directly to us at hi@alas.technology, with the subject "Privacy complaint": we will acknowledge your complaint within 30 days, look into it without undue delay, and keep you informed of the outcome. Complaining to us first is optional and does not prevent you from going to the authority.
10.6. United States residents. We do not sell personal data or share it for cross-context behavioral advertising. Rights under applicable state privacy laws may be exercised through the same channel described in this Section.
11. Automated decisions
The anti-cheat system automatically analyzes match data and may take limited automated actions: logging, flagging for human review, disconnection, and automatic temporary bans of up to 24 hours for objective protocol violations. Statistical signals (aim, macro, physics) never lead to an automated sanction beyond flagging for human review. Longer and permanent bans, including the Steam Game Ban, only occur after human review. You may request review of any automated decision through the appeal channel described in the Code of Conduct.
12. Security
- Connection encrypted with TLS (wss://) and an end-to-end encrypted application channel, with the server key pinned in the app.
- The IP address is not stored in clear text; in logs it appears only as a hash with a salt discarded on every restart.
- Logs do not store authentication tickets or session keys.
- Replays are automatically deleted after the retention period.
- Voice travels over the same encrypted channel and leaves the server only to the recipients in the room or match. We do not use direct connections between players, so your IP address is not exposed to other players. The server limits the rate, size, and continuous duration of transmissions to contain abuse.
No system is completely secure. In the event of a security incident that may cause significant risk or harm, we will notify the ANPD, other competent authorities, and the affected data subjects within the legal deadlines (LGPD art. 48; GDPR arts. 33 and 34).
13. Children and teenagers
13.1. Under Valve's rules, a Steam account requires a minimum age of 13, or a higher age where required by the law of the country. The Game is not directed at children under 13. The Game's age rating is the one assigned through the IARC system and shown on the Game's Steam page.
13.2. When the Game is used by teenagers, we process their data in their best interest, in accordance with art. 14 of the LGPD and Brazilian Law No. 15,211/2025 (Digital Statute of Children and Adolescents), collecting only what is necessary. If processing the data of a child (under 12 in Brazil) depends on consent, it must be given by a parent or legal guardian. The Game does not sell loot boxes, does not sell items for real money in this phase, and does not use targeted advertising. Voice chat is off by default; when on, it only reaches players in the same room or match, can be muted per player or for everyone, and is not recorded.
13.3. If you are a parent or guardian and believe we have improperly processed a child's data, write to hi@alas.technology and we will delete the data.
14. Changes to this Policy
We may update this Policy. Material changes, especially any new data collection, will be announced in the Game and on the Game's Steam page at least 30 days before they take effect, unless a change is required by law on a shorter timeline.
15. Contact
ALAS TECHNOLOGY LLC
D-U-N-S 109327849
30 N Gould St Ste R, Sheridan, WY 82801, United States
Privacy, data protection officer, and general contact: hi@alas.technology