Privacy Policy
Last updated: 7 October 2026
Introduction
Effective date: 1 September 2026
Version: privacy-2026-10-07
This policy explains how Reveflo Technologies Limited, a company incorporated in Hong Kong, handles personal data for Loki. We are a data user under the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”).
This policy covers lokiplay.cc, app.lokiplay.cc, play.lokiplay.cc, docs.lokiplay.cc, api.lokiplay.cc, and per-game hosts.
Privacy requests: contact@lokiplay.cc
1. What we collect
Data you give us
| Category | Examples | Who |
|---|---|---|
| Account | Email address, password held by our authentication provider, authentication subject | Creators |
| Sign-in providers | If you choose Google or GitHub, the identity details that provider shares for sign-in, typically an email address and a provider subject | Creators |
| Workspace | Organisation name, project name, slug, role | Creators |
| Legal acceptance | Document, version, time accepted | Creators |
| Billing | Plan, status, period end, Stripe customer id, Stripe subscription id. Card numbers stay with Stripe | Creators who subscribe |
| GitHub, if connected for deploy | Repository owner and name, installation and repository ids, branch, workflow path, webhook metadata | Creators |
| Leaderboards | Display name (up to 32 characters) and score | Players |
| Reports and support | Category, summary, messages you send to contact@lokiplay.cc | Anyone who writes to us |
Data created by use
| Category | Examples |
|---|---|
| Sessions | Project-scoped player or guest id, expiry, guest flag |
| Guest cookie | loki_guest_{projectId}, HttpOnly, up to 30 days, used to recognise a returning guest in that project |
| Play | Room membership, presence, matchmaking, host election, reconnects, public-room listing inside that game |
| Server authority | Prior state, tick inputs, and next state processed by the step module in Singapore |
| Chat | Lobby or match messages and room ids |
| Invites | Hashed invite tokens, expiry, issuing Creator |
| Deployments | Content hash, file list, scan findings, quarantine state, step-module hash |
| Command-line login | Hashed device and user codes, approval time, encrypted short-lived tokens |
| Usage | Game, link, room, session, and rate-limit counters |
| Runtime reports | Project id, failure kind, SDK compatibility and version. These are written to hosting logs and are not stored as account records |
| Audit | Actor, organisation, action, limited detail |
| Technical logs | Request id, IP address, user agent, timestamps, kept in hosting logs. We aim to keep tokens, chat bodies, secrets, and archives out of application logs |
A verified email address and acceptance of the current legal versions are required for a Creator Account. You can sign in with email and password, Google, or GitHub. Guest play does not require an email address. A GitHub repository connection and a paid Plan are optional.
2. Why we use it
We use personal data to:
1. Create and run Accounts, organisations, and projects.
2. Authenticate users and issue or revoke sessions, invites, cookies, and credentials.
3. Host, scan, sandbox, and deliver games, including the hosted SDK file.
4. Run rooms, matchmaking, presence, chat, leaderboards, and step modules.
5. Bill subscriptions and prevent payment fraud.
6. Enforce Plan limits, rate limits, and the Acceptable Use Policy.
7. Handle reports, quarantine, suspensions, and appeals.
8. Operate the command-line tool, API, and GitHub connection.
9. Send service, security, billing, and legal messages that you initiate or that the Service requires for the Account.
10. Measure aggregate capacity and reliability.
11. Comply with law and respond to the Privacy Commissioner for Personal Data.
12. Establish or defend legal claims.
We do not sell personal data. We do not use personal data for direct marketing. We do not use personal data for a new, unrelated purpose without your prescribed consent, unless a PDPO exemption applies.
3. Who receives it
| Recipient | Role | Typical location |
|---|---|---|
| Supabase, platform project | Authentication, including email-and-password, Google, and GitHub sign-in, and the control-plane database | Singapore |
| Supabase, multiplayer project | Multiplayer persistence | Singapore |
| Railway | API, web, workers, step-module compute, multiplayer compute, and service logs | Singapore |
| Cloudflare | DNS, CDN, object storage, marketing site, and edge proxy | Global edge |
| Stripe | Subscription checkout, customer portal, card processing, and webhooks | United States and Stripe’s other locations |
| Sign-in, if you choose Google | Google’s operating locations | |
| GitHub | Sign-in, if you choose GitHub, and optional repository connection | United States and GitHub’s other locations |
| Advisers | Legal, accounting, and insurance | Hong Kong and where engaged |
| Authorities | Where the law requires or allows disclosure | Hong Kong and other competent jurisdictions |
| A successor | Merger, sale, or reorganisation | As applicable, under this policy |
Other Players in the same game can see presence, chat, display names, scores, and public-room listings for that game. An invite link lets the holder open that project.
We do not use Cloudflare Turnstile or Sentry on the Service as of this version.
4. Transfers outside Hong Kong
Account and multiplayer data is stored in Singapore. Cloudflare, Stripe, Google, and GitHub may process personal data in other countries. Section 33 of the PDPO is not in operation. We use contracts and access controls with these providers. Overseas law can differ from Hong Kong’s.
5. How long we keep it
| Data | Period |
|---|---|
| Account, membership, legal acceptance, billing ids | Life of the Account, then up to 7 years |
| Game artifacts and step modules | Until the project or Account is deleted, plus backups up to 90 days, unless quarantined or under a legal hold |
| Chat | 90 days, or longer while a safety case is open |
| Guest cookie | Up to 30 days |
| Player session tokens | Until they expire, within 15 minutes |
| Usage and rate-limit counters | Current period plus 13 months |
| Reports and security findings | Until resolved, then up to 3 years |
| Audit records | Up to 7 years |
| GitHub connection metadata | Life of the connection, then up to 1 year |
| Support mail | Up to 3 years after the thread closes |
| Runtime reports and HTTP request logs | Only in Railway service logs for the production project, for the retention period Railway applies to those logs, and not in the Loki account database |
6. Direct marketing
We do not use your personal data for direct marketing, and we do not provide it to other businesses for their direct marketing. Service, security, and billing messages are not direct marketing. If we later want to send direct marketing, we will ask for the consent required by Part VIA of the PDPO before we do so.
7. Security
We use TLS on public endpoints, hashed secrets and invites, short-lived sessions, separate platform and multiplayer databases, sandboxed game origins, and operator access control. Passwords are held by Supabase Auth, not in the Loki application database. No method of storage or transmission is completely secure.
Hong Kong law does not currently impose a general statutory duty to notify personal-data breaches. We will tell affected people and the Privacy Commissioner where we consider it appropriate or where the law requires it.
8. Access and correction
You may ask to access or correct personal data we hold about you. Write to contact@lokiplay.cc. We will respond within 40 days, or explain a refusal or extension the PDPO allows. We may charge a fee that is not excessive.
You may complain to the Privacy Commissioner for Personal Data, Hong Kong: https://www.pcpd.org.hk
9. Children
You must be at least 13 years old to use the Service. We do not knowingly collect personal data from children under 13. If you are under 18, a parent or legal guardian must accept the Terms for you. If you are a parent and believe we hold data from a child under 13, contact contact@lokiplay.cc.
10. Automated review
Uploads and step modules are scanned, and some are reviewed with automated tools, for malware, phishing, credential theft, mining, prohibited advertising, and unsafe code. A high-confidence finding can quarantine a deployment. Uncertain findings can wait for a person. This is security processing.
11. Creators who collect data
HTML forms in uploaded builds are rejected. If you collect personal data from Players through game code, you are the data user for that collection and must give your own PDPO notice. A leaderboard display name and score for that game is the collection this Service provides.
12. Cookies
We use a strictly necessary guest cookie, loki_guest_{projectId}, and similar storage for sign-in, security, and load balancing. We do not use advertising cookies. If a cookie is personal data, the PDPO applies. Blocking strictly necessary cookies can stop play or sign-in.
13. Changes
We may amend this policy by publishing an updated version on https://lokiplay.cc. The updated version is effective immediately on publication. If you object, you must email contact@lokiplay.cc within 5 business days after publication. If you object, you must stop using the Service.
This policy is published only in English. It describes our PDPO practices. It does not limit a right the PDPO gives you. Contractual disputes about the Service follow the Terms of Service, which are governed by Hong Kong law and the exclusive jurisdiction of the Hong Kong courts.
Reveflo Technologies Limited
Company number 74466581
The Chelsea, 69 Jervois Street, Sheung Wan, Hong Kong