Privacy Policy

Last updated: September 30, 2026

Ninja Idle is a free game, played in your browser. This page says exactly what the game keeps about you, why, and what other players can see. No fine print: if anything here is unclear, ask on Discord.

Contact

Anything to do with this policy — a question, a correction or a deletion request — is handled on the game's Discord server. It is the official channel, and the only one.

What the game collects

If you create an account with a username and password

• Username — only used to sign in. It is not shown to other players.
• Nickname — the name other players see. It can be changed on the account screen.
• Email — only used to recover your password. We do not send news, promotions or any other kind of email.
• Password — stored only as a hash, an irreversible scramble. The password itself is not recorded anywhere, and not even the owner of the game can read it.

If you sign in with your Google account

The game asks Google for three things only: who you are (openid), your email address and the basic data from your profile. We do not ask for access to Gmail, Drive, Calendar, your contacts or any other Google service.

Out of what Google returns, the game stores two things:

• Your Google account identifier — an internal code, which is what lets us recognize you the next time you sign in.
• Your email address, and only if Google itself confirms it is verified.

Google also sends your name along with it. The game reads it and discards it — it is not stored, is not shown to anyone and is not used for anything. The name other players see is the nickname you choose when you create the account, and nothing else.

Signing in with Google gives the game no ongoing access to your Google account: what happens is a single check, at the moment you click the button.

While you play

• Your progress — ninja, items, missions, village, rank and everything else that makes up the game.
• What you send to other players — private messages, items and notes sent through the Mail, and the history of Arena, Raid and War fights.

If you support the game

Anyone who wants to support the project does so via Pix — Brazil's instant payment system — and receives Diamonds as a thank you. Payments are processed by Mercado Pago. To generate the Pix code, the game sends them one thing only: your email — along with the amount and an internal code identifying that contribution. Your nickname, your username, your password and what you do in the game are not sent. We do not ask for a tax ID, and no card or bank data passes through the game: you pay inside your own bank's app, and the game never sees that data.

On this side, what is recorded is what the contribution was: how many Diamonds, how much it cost, when it was paid and the code Mercado Pago gave that payment. That is what makes it possible to credit the Diamonds exactly once and to find the transaction if something goes wrong.

What Mercado Pago does with your email is governed by their privacy policy.

Two details that come from Pix, not from the game: the payment code shows the full name of whoever receives it (the owner of the game), and the Pix receipt shows the owner who paid. That is how it works for any Pix payment, anywhere.

Technical data

• A session cookie, so the game remembers it is you between one screen and the next. It is essential: without it there is no way to stay signed in.
• Your IP address, used only to limit login attempts and mass account creation. It stays only in the server's memory, for at most one hour, and is not written to a database or tied to your account.
• Device preferences — things like light mode and the collapsed interface are kept in your own browser and never reach the server.

What the game does NOT do

• No ads.
• No Google Analytics, no social network pixel, no tracker of any kind. The site's pages load no third-party script at all.
• It does not sell, rent or trade data with anyone.
• It does not use advertising or tracking cookies — only the session cookie described above.
• It does not ask for card, account or bank data. The only payment that exists is support via Pix, made in your own bank's app — none of it is typed in here.

What other players can see

The game is multiplayer, so part of what is yours appears to others. Specifically:

• Your nickname, your village, your rank and the power of your strongest ninja (in the ranking, the Arena, the Mail, the Friends list and the War).
• An indicator of when you were last active.
• Rare achievements, which become an announcement to the whole server the moment they happen.

Never shown to other players: your login username, your email, your password and your Google account identifier.

Where the data lives and who it is shared with

The data lives on an Amazon Web Services server, and a backup is taken once a day. Besides AWS, three services take part:

• Amazon SES — only to deliver the "forgot my password" email, when you ask for it.
• Google — only at the moment you choose to sign in with a Google account.
• Mercado Pago — only when you support the game, and only with your email, as described above.

Beyond that, the data does not leave here. It can be accessed by the owner of the game for operation and support, and it can be disclosed if the law requires it.

How long it is kept

• Account and progress — for as long as the account exists.
• Private messages — 10 days, then they disappear on their own.
• Mail — 30 days, then it goes along with whatever is attached to it.
• Password reset link — 1 hour, and it works once.
• Record of contributions — for as long as the account exists. It is the proof that the payment was credited.
• Backups — taken daily; deleted data may survive in them for some time before being overwritten.

Your rights

Under Brazil's General Data Protection Law (LGPD), you can ask to see, correct or delete your data, and you can withdraw consent at any time.

Being honest about how this works today: there is still no delete-account button inside the game. The request is handled by hand. Ask on Discord and the account and progress are deleted — the nickname also stops appearing in the rankings. Some records of matches between players may remain, with no link to you.

If you signed in with Google, you can also cut off access from their side, under Connections to apps and services in your Google Account. That stops new sign-ins, but it does not delete your game account — for that, make the request on Discord.

Minimum age

The game is not intended for anyone under 13, and we do not knowingly collect data from anyone in that age range. If you are under 18, play with the knowledge of whoever is responsible for you. If you know of an account belonging to a child below that age, say so on Discord and it gets removed.

Security

Access to the site is encrypted (HTTPS), passwords are stored only as hashes, the session cookie is not readable by scripts on the page, and the number of login attempts is limited. None of this is an absolute guarantee: no system is immune. Use a password you do not use anywhere else.

Changes to this policy

If something changes, the date at the top changes with it and notice goes to Discord. A significant change is announced before it takes effect.

Question about anything here? Ask on Discord.