AVARUNES Privacy Policy

Version 2026-10-16 · Last updated 16 October 2026

This English version is a translation provided for convenience. If it differs from the Thai version, the Thai version applies.

This policy explains what personal data the game AVARUNES (called "we") collects, what we use it for, who we disclose it to, how long we keep it, and what rights you have, under Thailand's Personal Data Protection Act 2019 (PDPA). This policy applies together with the Terms of Service, the Top-up and Payment Policy, and the Rules and Code of Conduct.

We collect only the data needed to provide the game. We do not ask for your real name, address, phone number or national ID card number to play the game.

1. Data controller

The operator of the AVARUNES game · Contact: [email protected]

2. Data we collect

Account data

• Your username, and your password converted with a one-way method (hash) — we do not store your actual password, and it cannot be turned back into the password.
• Guest accounts: a random key stored in a cookie in your browser; on our side we keep only its converted value.
• When you sign in with Google: we keep only your Google account ID (a reference number) — not your email, name or picture.
• The versions of the terms and policies you ticked to accept when you signed up, signed in or started playing as a Guest, and the time you accepted them.
• The time of your last sign-in, and your account status (e.g. suspended).

Gameplay data

• Characters, levels, items, in-game currencies, progress, and your in-game transaction history (e.g. Item Mall purchases, trades, the World Market).
• Chat messages, mail, friends, guilds, parties, and player reports.
• Staff notes about the account (e.g. penalties, help given).

Payment data

• Order number, package bought, amount, currency, status, time, your confirmation of the policy before buying, and Stripe's reference ID.
• The status of refund requests or payment disputes (chargebacks) that Stripe reports to us.
• We do not store your card details, bank account or payment details. You enter your payment details directly on Stripe's page, and they are covered by Stripe's privacy policy.

Technical data

• IP addresses: used to protect against attacks and to limit abnormal use. They may appear in server logs, but are not recorded with your account.
• Cookies needed to play: the sign-in cookie, the cookie that protects against forged requests (CSRF), and the Guest account cookie — we do not use advertising cookies or cookies that track you across websites.
• In-game settings (sound, graphics, server channel) are stored in your own browser.

3. What we use data for

• To provide the game under the Terms of Service: creating and looking after accounts, saving progress, delivering purchases (legal basis: contract)
• To keep the service secure, prevent cheating, fraud and misuse of the service, and review reports and penalise players who break the rules (legal basis: legitimate interests)
• To check and resolve payment problems, and to keep accounting and tax records (legal basis: contract and legal obligation)
• To improve and balance the game based on overall gameplay statistics
• To answer questions and help you when you contact us

We do not sell your personal data, and we do not use it for advertising by third parties.

4. Disclosure of data

We disclose only what is necessary, to:

• Stripe — the payment provider (order number, price, product name)
• Google — only when you choose to sign in with Google
• The server, database and network providers we use to run the game, which process data only on our instructions
• Government authorities, when the law requires it or there is a lawful order

Some providers may process data outside Thailand. We will choose providers whose data protection standards are adequate, as required by law.

5. How long we keep data

• Account and gameplay data: for as long as the account is in use; deleted or made anonymous within 90 days after you ask for your account to be deleted, or after the service ends.
• Payment data: kept for the period required by accounting and tax law (generally at least 5 years), even if the account has been deleted.
• Chat messages: normal chat is not saved to the database. Reported messages and megaphone messages are kept only as long as needed to look after the community and to serve as evidence.
• Server logs: kept for no longer than about 14 days, then deleted automatically.
• Data about penalties or fraud: kept as long as needed to prevent repeat offences and to serve as evidence.

6. Your rights

Under the PDPA, you have the right to:

• request access to your data and a copy of it
• request that inaccurate data be corrected
• request that your data be deleted or made anonymous
• request that the use of your data be restricted, or object to certain processing
• request that your data be transferred (data portability)
• withdraw your consent, where processing is based on consent
• complain to the Office of the Personal Data Protection Committee (PDPC)

Send requests to [email protected] with your account UID. We may ask you to confirm that you own the account, and we will reply within 30 days. Deleting your account permanently removes all your characters, items and currencies, and there is no refund.

7. Data security

We encrypt connections (HTTPS), convert passwords with a one-way method, limit access to data to the staff who need it, and log staff actions. If a data breach occurs that puts you at risk, we will notify the relevant authority and notify you, as required by law.

8. Minors

Anyone under 20 years of age should read this policy together with a parent or guardian, and must get a parent's or guardian's consent before signing up and before buying anything with real money. A parent or guardian may exercise the rights in section 6 on the minor's behalf.

9. Changes to this policy

When we change this policy, we will publish a new version with a version number, and show it to you to read and tick to accept the next time you sign in.

10. Contact about personal data

• Email: [email protected]

Please give your account UID when you contact us. Never send your password or card details to anyone.