Privacy Policy

Last updated: October 8, 2026 • Versão em português

This is a translation provided for convenience; if the versions differ, the Portuguese version prevails.

Summary: Brasil TD is a free browser game. We collect only what is needed for your account to work, for matches, for Premium and for partner skins. We do not sell data. The game's ads are just brand images: we count views and clicks in total, without linking them to you. To measure whether Brasil TD's campaigns on Meta's networks bring in players, the site loads the Meta Pixel (details in section 8). You can request the deletion of your account at any time by email at [email protected].

Who we are
Data we collect
Sign-in with Google and Kick
Partner skins and Kick subs
What we use it for
Legal bases (LGPD)
Who we share it with
Cookies and local storage
How long we keep it
Security
Your rights
Children and teenagers
Changes to this policy

1. Who we are

Brasil TD (brasiltd.com) is a satirical, fictional tower defense game played in the browser. For the purposes of the Lei Geral de Proteção de Dados (Law No. 13,709/2018, “LGPD”, Brazil's General Data Protection Law), Brasil TD is the controller of the data described here. Contact of the data protection officer (DPO): [email protected].

2. Data we collect

Data	When	Notes
Email	When you create an account with a password or with Google	Used for sign-in, verification codes, password recovery and Premium receipts. Never shown to other players.
Nickname	When you create an account	Public: it appears in matches, in chat and in the ranking. Don't use your full name if you don't want to.
Guest nickname	When you play online without creating an account	Temporary cookie (about 7 days) for the queue and rooms. It is not included in the ranking. It disappears when you leave or create an account.
Referral and link source	If the address has `?ref=` or `utm` parameters	At sign-up we store who referred you and the campaign source. The referrer's reward is only a cosmetic title (Campaign Worker), with no advantage in matches.
Password	If you create an account with a password	We store only a cryptographic hash (salted scrypt). We cannot see your password.
Google or Kick account identifier	If you sign in with Google or with Kick	A numeric code for your account, used only to recognize your sign-in. See section 3.
Progress and statistics	While you play	Level, experience, MMR, rank, wins, losses and match history (mode, team, result, statistics and the match replay).
Profile photo (Premium)	If you upload one	The image is cropped and recompressed in your browser before it is uploaded, which removes metadata such as location (EXIF). It is public: it appears in the ranking and in matches.
Purchases (Premium, skins and ads)	If you buy something	Order reference, product, amount, status, generated Pix code and dates. We do not receive or store bank details, CPF (Brazilian taxpayer number) or card data: payment is processed by Woovi (OpenPix).
Partner skins	If you buy them, receive them or unlock them with a sub	Which skins you have, how each one was unlocked (Pix, Kick sub or gift) and which one is in use. The skin in use is visible to the other players in the match. See section 4.
Ads (advertisers)	If you register an ad	Brand name, link, uploaded image or video, and the contributions (boosts). The brand and the total amount appear in the public ranking; who owns the ad is never shown.
Session and security	When you sign in	We store a hash of the session token, the IP address and the creation and expiration dates, to keep you signed in and to detect abuse.
Technical logs	On every access	Our server logs the IP address, date, path accessed and response code (no headers and no URL parameters), for security and diagnostics.
Meta Pixel measurement	When you open the site	Events for visits, account creation, match start (online or via PLAY NOW) and viewing the exhibition match. We do not send email or nickname in these events. Meta may associate the browser with a Facebook or Instagram account through the cookies in section 8.
Chat messages	If you use the chat	They are not recorded in a database. The lobby chat keeps only the latest messages in the server's memory, and they are lost with every game update. Party chat goes straight to the party members and is not stored.
Friends and party	If you add friends or join a party	We store the friends list, friend requests and the party you are in. Your friends and the members of your party can see whether you are online and what you are doing in the game (lobby, queue, room or match, with the wave). You can unfriend someone or leave the party whenever you want; anyone who is offline for 10 minutes leaves the party automatically.

We do not collect sensitive data (art. 5, II, of the LGPD), location, contacts or data from other apps.

3. Sign-in with Google and with Kick

Google

If you choose “Continue with Google”, Google sends us, with your authorization, the information from the openid, email and profile scopes:

Google account identifier: stored, to recognize your future sign-ins.
Email and whether it was verified by Google: stored as your account's email. If a Brasil TD account with the same email already exists, the two are merged.
Name: used only once, to suggest a nickname that you can change before confirming. We do not store your Google name or photo.

We do not request access to Gmail, Drive, contacts, calendar or any other data in your Google account, and we do not post anything on your behalf. The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at myaccount.google.com/permissions.

Kick

If you choose “Sign in with Kick”, Kick sends us, with your authorization (user:read scope), your Kick account identifier, your username, your email and your profile photo:

Kick account identifier: stored, to recognize your future sign-ins or to link Kick to your Brasil TD account, if you ask.
Username: used only to suggest a nickname, which you can change before confirming.
Kick email and profile photo: not stored. That is why an account created through Kick does not receive emails from the game.

The access token that Kick gives us is used only once to read this data and is revoked right afterwards. We do not ask for permission to read your chat, post on your behalf or change your channel. You can remove Brasil TD's access in your Kick account settings.

Kick notifications (webhooks): the game receives notices from Kick about new subs on partner channels linked to Brasil TD. We verify the digital signature of each notice. What we store from each one is described in section 4; other event types are not stored.

4. Partner skins and Kick subs

Partner skins support streamers. They can be unlocked via Pix (the amount goes to the partner's Pix key, through a Woovi sub-account) or via a sub on the partner's Kick channel.

If you are a partner (streamer)

For your channel's subs to unlock skins, you link your Kick account on the game's home page and authorize the user:read, channel:read and events:subscribe scopes. With them, we read your channel's identifier and address (slug) and ask Kick to notify us of new subs, renewals and gifted subs. We do not read your chat, do not post anything and do not change anything on your channel.

We store the channel identifier and slug, the authorized scopes and the Kick access tokens. The tokens are encrypted (AES-256-GCM) and serve only to keep the sub notifications active.
We store the display name and the Pix key you gave us, in order to send you the payments for your skins, and the record of payouts.
You can unlink Kick whenever you want: the notifications stop and the tokens are deleted. You can also remove access in your Kick account settings.

If you gave (or received) a sub

When someone subscribes, renews or gifts a sub on a partner channel, Kick notifies us. For each person named in the notice we store: the Kick account identifier, the username, whether they subscribed, gifted or received the sub, the duration in months, the date and the result (skin unlocked or pending). Anyone who gifts anonymously is not identified.

This record lets us unlock the skin (and Premium, on partner channels where the sub also unlocks Premium) even if you sub before linking Kick in the game: when you link it, we look for your subs in this record and unlock whatever is yours. If a partner starts unlocking Premium with subs, we use this same record to unlock Premium for people who had already subbed to their channel. The game's team also consults this record to resolve questions about unlocks. The partner does not receive this data from us.

5. What we use your data for

Creating and maintaining your account, authenticating your access and recovering your password.
Making matches work: matchmaking, ranking, MMR, progress and history.
Processing and confirming purchases (Premium, partner skins and ads) and sending the receipt by email.
Unlocking partner skins for those who paid or subbed on the partner's Kick channel, and passing the amount paid on to the partner.
Sending transactional emails (verification codes, password recovery, payment confirmation). We do not send marketing.
Preventing fraud, cheating and abuse, moderating nicknames and photos, and complying with legal obligations.
Understanding, in aggregate, how the site performs, in order to fix problems.
Measuring visits, sign-ups and matches attributable to Brasil TD's campaigns on Meta's networks (Pixel).

6. Legal bases (LGPD, art. 7)

Performance of a contract (item V): account, matches, ranking, Premium, partner skins (including the record of subs that unlocks them), ads and transactional emails.
Legitimate interest (item IX): security, prevention of fraud and abuse, technical logs, aggregate metrics and measurement of the game's campaigns with the Meta Pixel.
Compliance with a legal obligation (item II): retention of access logs (Marco Civil da Internet, Brazil's Civil Rights Framework for the Internet, art. 15) and of payment records.
Consent (item I): sign-in with Google or Kick, linking a partner's Kick account and uploading a profile photo, which you can undo whenever you want.

7. Who we share it with

We do not sell or rent data. We use these providers (processors), each with only what is necessary to provide the service:

Provider	What for	Where
OVHcloud	Server where the game and the database run	Canada
Cloudflare	Content delivery network (CDN), protection against attacks, storage of profile photos (R2) and aggregate performance metrics (Web Analytics, without cookies)	Global network
Resend	Sending transactional emails	United States
Woovi (OpenPix)	Charging and confirming Pix payments (Premium, skins and ads) and passing the amount paid for skins on to the partner's Pix key	Brazil
Google	Sign-in with Google, only if you choose to use it	United States
Kick	Sign-in with Kick and sub notifications from linked partner channels	Outside Brazil
Meta Platforms (Pixel)	Measuring visits, sign-ups and matches for Brasil TD's campaigns on Meta's networks. We do not send email or nickname to Meta.	United States

Some of these providers process data outside Brazil. These international transfers comply with art. 33 of the LGPD, with providers that adopt contractual clauses and data protection safeguards. We may also provide data when required by law or by court order.

8. Cookies and local storage

btd_session (essential): keeps you signed in for up to 30 days. It is HttpOnly and cannot be read by scripts.
btd_g and btd_k (essential, temporary): exist for at most 10 minutes during sign-in with Google or with Kick, to protect the process against fraud.
Browser local storage: keeps game preferences (volume, open panels, tutorial completed). It stays only on your device.
Meta Pixel (_fbp and, if you arrived through a Meta ad, _fbc): this site's own cookies, set by Meta's script, to measure visits, sign-ups and matches. They are not needed to play. An ad blocker, or blocking these cookies in the browser, prevents them from being sent; the game works just the same.

The brand ads inside the game do not use cookies: we only count total views and clicks. The Meta Pixel is the only advertising measurement.

9. How long we keep it

Account, progress and history: for as long as the account exists. When you request deletion, we delete the account, the profile photo and the sessions. In matches already played, your nickname may remain in the other participants' history, unlinked from the account.
Sessions: up to 30 days, or until you sign out.
Verification codes: expire in 30 minutes.
Access logs: the web server's logs are rotated within 7 days. Minimal connection records may be kept for up to 6 months, as required by the Marco Civil da Internet.
Orders (Premium, skins and ads) and payouts to partners: for the period required by tax and consumer protection law.
Kick sub records: for as long as the partner's skin exists, so that it can be unlocked for whoever links Kick later. When you request the deletion of your account, we unlink these records from it.
Partners' Kick access tokens: until the partner unlinks Kick or stops being a partner.
Server diagnostic logs: up to 14 days.

10. Security

All traffic uses HTTPS. Passwords are stored with scrypt. Session tokens are stored only as a cryptographic hash, and partners' Kick access tokens are encrypted. Access to the server is restricted and service credentials are kept out of the code. No system is 100% secure: if an incident occurs that may cause significant risk, we will notify you and the ANPD (Brazil's National Data Protection Authority), as the LGPD requires.

11. Your rights

Under art. 18 of the LGPD, you can request, at any time:

confirmation that we process your data, and access to it;
correction of incomplete or inaccurate data;
anonymization, blocking or deletion of unnecessary data;
portability of your data;
deletion of data processed on the basis of consent, and withdrawal of that consent;
information about whom we share your data with;
deletion of your account.

Send the request to [email protected] from the account's email address. We reply within 15 days. If you are not satisfied, you can also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

12. Children and teenagers

Brasil TD is intended for people aged 13 or over. Minors under 18 must use the game and make purchases with the knowledge and authorization of their parents or legal guardians. We do not knowingly collect data from children under 13. If you are a parent or guardian and believe this has happened, write to [email protected] and we will delete the account.

13. Changes to this policy

We may update this policy when the game changes. The date at the top shows the latest version. Relevant changes will be announced in the game or by email.