This is a translation provided for convenience. If there is any difference between versions, the Portuguese version prevails.
Privacy policy
Updated on October 3, 2026.
Eclipsefall Defense is a free browser game. It has no ads, does not sell data and does not use third-party tracking tools. We store only what the game needs to work, to keep the leaderboard fair and to improve the balance of the waves.
Who looks after your data
The data controller is QUIMERA VENTURES LTDA (Quimera), CNPJ 32.263.586/0001-73, Belo Horizonte/MG, Brazil. The contact is at the end of this page.
What stays on your device
- Game progress: heroes, items, gold, waves, achievements and preferences (music, effects, automatic wave calling).
- Player code and token: a random code and a secret that identify this browser to the server. They contain no name or email.
- Sending queue: the summary of the latest waves and events, which waits for the internet to come back before going to the server.
- Account session, if you sign in to an account: an access token. With "keep me signed in" it stays stored in the browser; without it, only until you close the tab.
This is kept in the browser's local storage (localStorage). We do not use cookies.
What stays on the server
| Data | What for |
|---|---|
| Anonymous player: random code, the hash (scrambled version) of the token, when it was created and last seen. | Knowing whose progress is whose without asking for a name or email. |
| Progress: the same save as on the device, plus one copy per day. | Recovering the game if the browser data is deleted and fixing a broken save. |
| Wave history: for each wave played, the result, the duration, the heroes (name, vocation, level, items, spells, damage, kills), the monsters, the actions between waves, the game version, the screen size and whether the device is a touch device. | Balancing the game's difficulty and calculating the leaderboard. |
| Usage events: session start, tutorial steps, chests, achievements, loading time, connection type and device memory reported by the browser, and game errors. | Understanding where players get stuck or give up and fixing errors. |
| Account (optional): email, nickname, the hash of the password (never the password), the date you accepted these terms, the access dates and the hash of each open session. | Signing in on any device, saving progress and putting the nickname on the leaderboard. |
| New password request: a single-use code (only the hash), which expires in 1 hour. | Changing the password by email. |
| Leaderboard: numbers calculated from the wave history (campaigns won, defeats, time, monsters defeated, biggest hit, waves of the week). | Building the leaderboards. Only the nickname and the hero's name appear on them. The email never appears. |
IP address. The server uses the IP of each request to limit attempts (for example, many wrong passwords in a row). This count stays only in the server's memory for a few minutes and does not go to the database. The hosting provider's technical logs may keep the IP for a few days, for security and to investigate failures.
Legal basis
Under the LGPD (Brazilian Law 13.709/2018), we use progress, the account and the leaderboard to do what you ask for when you play and when you create the account (performance of the service). The wave history, usage events and IP serve our legitimate interest in keeping the game safe, fair and balanced, always with the minimum data and without identifying you outside the game.
Who else receives data
- Netlify: hosts the site and forwards requests to the server.
- Railway: runs the server and the database.
- Resend: sends the new password email, only when you ask for it.
These services may be located outside Brazil. They process the data only to provide the service. We do not sell or rent data to anyone.
For how long
- Progress, wave history, events and account: while the player or the account exists, or until you delete them.
- Account sessions: until you sign out, or until they expire (180 days with "keep me signed in", 1 day without it).
- New password request: expires in 1 hour.
- Database backups: the latest 14 (one per day). After you delete your data, it may remain in these copies for up to 14 days, until they are replaced.
How to delete
- Without an account: in the game, open Settings (the gear at the top) and tap Delete my data. We delete the progress, the wave history and the events of this device, here and on the server.
- With an account: open Settings, then Account, and tap Delete my account and my data. We delete the account, the sessions, the progress of all devices linked to it, the wave history, the events and the leaderboard positions.
You can also ask by email to see, correct or delete your data, or ask questions about your rights under the LGPD.
Children
The game can be played without an account and without any personal data. Children under 12 should only create an account with the consent of a parent or guardian.
Security
Passwords are stored only as a hash (scrypt, with salt). Tokens and sessions too. The server only accepts requests that go through the site, and the database is not open to the internet.
Changes
If this policy changes, the date at the top changes too. Important changes appear in the game.
Contact
Write to hello@donnu.ai.