PRIVACYPOLICY

Last updated: October 25, 2026

This policy explains what personal data Greb Studios LTDA (CNPJ 44.716.317/0001-02, Brazil) — “we” — collects on grebstudios.com, why, and what you can do about it. We follow Brazil’s General Data Protection Law (LGPD, Law 13.709/2018) and, for visitors in Europe, the GDPR.

Who is responsible

Greb Studios LTDA is the data controller. For anything about your data, write to contact@grebstudios.com.

What we collect and why

Data	When	Why (legal basis)	How long
Email address and language	You subscribe to the newsletter	To send patch notes and news you asked for (consent — LGPD art. 7, I)	Until you unsubscribe; deleted 30 days after unsubscribing. Unconfirmed sign-ups are deleted after 30 days
Bug report: game, platform, version, description, steps, attachment	You send a bug report	To find and fix the bug (legitimate interest — art. 7, IX)	While the bug is being worked on; the attachment is deleted when the report is closed
Email on a bug report (optional)	You add it to a report	To tell you when it’s fixed or ask a follow-up question (consent)	Removed 90 days after the report is closed, and at the latest 12 months after you sent it
IP address and browser signals	You send a form	Spam and abuse protection (legitimate interest) — checked by Cloudflare Turnstile; we keep a temporary counter per IP for at most 20 minutes	Up to 20 minutes
Messages you send to contact@ or press@grebstudios.com, and our replies	You email us	To answer you (legitimate interest)	Up to 12 months
Record of the emails we send you (address, subject, date)	We email you	Proof of delivery and of your consent, support (legitimate interest)	12 months
Anonymous page statistics	You visit the site	Understanding which pages are useful (legitimate interest) — Cloudflare Web Analytics, which uses no cookies and does not identify you	Aggregated only

We don’t sell your data, don’t build advertising profiles and don’t use social-media trackers.

Cookies

The site sets one cookie, gs_lang, and only when you choose a language. It remembers that choice for one year. It is a preference cookie with no tracking purpose, so we don’t ask for consent with a banner. Our security check (Cloudflare Turnstile) and statistics (Cloudflare Web Analytics) do not set tracking cookies.

Who processes data for us

We use trusted providers who process data only on our instructions:

• Cloudflare, Inc. (USA) — hosting, security, anti-spam check, statistics and forwarding of emails sent to our addresses.
• Supabase, Inc. (USA) — database where sign-ups and bug reports are stored.
• Resend, Inc. (USA) — sending our emails.

Some of these providers are in the United States. Transfers rely on the safeguards in their data processing agreements (standard contractual clauses), as allowed by LGPD art. 33.

Your rights

Under LGPD art. 18 you can, at any time and free of charge: confirm whether we hold your data; get a copy; correct it; ask us to anonymise or delete it; ask to move it to another provider; know who we share it with; and withdraw consent. To unsubscribe from the newsletter, use the link at the bottom of any of our emails. For everything else, write to contact@grebstudios.com — we answer within 15 days. You can also complain to Brazil’s data protection authority (ANPD) at gov.br/anpd.

Children

Our games are for players of all ages, but our forms are not meant for children under 13. If you are under 18, ask a parent or guardian before signing up or leaving your email. If you believe a child sent us personal data, write to us and we’ll delete it.

Security

All traffic is encrypted (HTTPS). Access to stored data is limited to our team, protected by two-factor authentication and database-level access rules.

Changes

If we change this policy, we’ll update the date at the top. Significant changes will also be announced in the newsletter.