Privacy Policy

Last updated: July 26, 2026

This policy describes what data Neverest ("the game", "the service") processes, why, and how you can exercise your rights over it under Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD), which governs this processing regardless of where you play from.

Controller

The data controller is Vinícius Luiz, a natural person. Contact: neverest@viniciusluiz.dev.

What the server stores

Anonymous account. No email, password, or name is required to play. When you create an account, the server generates a random 32-byte access token; only the cryptographic hash (SHA-256) of that token is stored, never the token itself.
Display name (optional). If you set one, it is shown publicly on the leaderboard next to your time.
Per-run data. The daily course seed, the course version, the resulting time (computed by the server, not reported by the app), and the input trace — the sequence of quantised steering inputs you used to complete the run, one value per 1/60 of a second. Only each player's best result per course is kept.
Google sign-in (optional). You may optionally link a Google account to recover your account on another device. Doing so stores only your Google account's identifier — never your email, name, or photo. This identifier is used solely to find your account again when you sign in with the same Google account elsewhere; it is never shown to other players and never used for anything else.

What stays only on your device

Your sound preference, your local ranking of your own runs, the "ghost" trace of your personal best on each course, and your account's access token are stored locally on the device and never leave it except as needed to authenticate your requests to the server.

Legal basis and purpose

Processing of account and run data relies on the legal basis of performing a service requested by the data subject (LGPD art. 7, V): without the access token and the recorded time, the leaderboard simply does not function. The display name, being optional and publicly visible, is processed on the basis of consent (art. 7, I), given when you set it.

Sharing

Your display name (or its absence) and your run times are publicly visible on the game's leaderboard. Beyond that, data is not sold and not shared with advertisers or data brokers — because no such relationships exist. Neverest uses no cookies, no advertising, no third-party trackers, and no analytics tooling. Data is hosted on infrastructure operated by the controller on Oracle Cloud.

The device token and losing access

The token stored on your device is the primary element that identifies your account to the server. If the device is lost, its data is erased, or the token is otherwise misplaced, access to the account is lost along with it, unless you have optionally linked a Google account (see above) — in that case, signing in with the same Google account on another device recovers your account. If you never link a Google account, there is no recovery path.

Your rights as a data subject

Under LGPD art. 18, you may request, at any time, through the contact above:

confirmation that processing is occurring, and access to your data;
correction of incomplete, inaccurate, or outdated data;
anonymisation, blocking, or deletion of unnecessary data, or data processed in a way that does not comply with the LGPD;
portability of your data to another service provider;
deletion of data processed on the basis of your consent;
information about which public or private entities your data is shared with (see "Sharing" above).

Because the account is identified only by the device token (and, optionally, a linked Google account identifier), a request for access, correction, or deletion needs to be made from a device authenticated with the account in question, or by providing the account identifier, since no email or other contact detail is tied to it to verify your identity another way. Unlinking a Google account, or deleting your account entirely, can also be requested through the contact address above.

Changes to this policy

This policy may be updated at any time. The date at the top of this page indicates the version currently in effect.