Privacy Policy

This describes what Antilopy actually stores, why, and for how long. It is written from the code, not from a template, so it is specific on purpose.

1. What we collect

Your account

Username, email address, when the account was created, whether the email is confirmed, and the state of your subscription. Your password is stored only as an Argon2id hash — we cannot read it, and neither can anyone who steals the database.

Sessions

When you sign in, a session token is issued. We store only a SHA-256 hash of it, never the token itself, so a database leak does not hand over live sessions. Sessions expire after 12 hours.

Purchases

The plan, the amount, the status, the payment reference from our provider, and the timestamps. We do not store your CPF or CNPJ. PIX requires it, so it passes through to the payment provider and is discarded on our side — keeping a customer document we have no use for only creates liability.

Diagnostics from the loader

When the game or the loader crashes, the loader uploads a report automatically so we can fix it without asking you for files. It contains: the crash code, your Windows version and build number, your graphics card model, which build of Antilopy you were running, the time, your account, your IP address, and the last 64 KB of the loader's own local log file.

That log is what the loader prints about itself — attach status, addresses it resolved, feature toggles, errors. It does not contain your password, your chats, your files, your keystrokes, or anything from other programs. Reports are deleted automatically after 45 days.

Security records

Failed sign-in attempts and the IP they came from, so we can rate-limit brute force. Actions taken by administrators on accounts, so there is a record of who changed what.

2. Why we hold it

Account and session data: to run the service you signed up for — a contract basis under the LGPD. Purchase records: to meet tax and accounting obligations. Diagnostics and security records: our legitimate interest in keeping the software working and the accounts safe.

We do not sell your data, we do not share it for advertising, and we do not profile you.

3. Who else sees it

Only these, and only what each one needs:

• BuyPix — processes the PIX payment. Receives your name, document, and the amount.
• Resend — sends confirmation and password-reset email. Receives your email address.
• Vercel — hosts this website.
• Microsoft Azure — hosts the server that holds the database.

Our server is in the United States (South Central US). That means your data leaves Brazil and is stored abroad. By using Antilopy you agree to that transfer.

4. How long we keep it

• Account data: while the account exists, and until you ask us to delete it.
• Sessions: 12 hours, then removed automatically.
• Crash reports: 45 days, then removed automatically.
• Purchase records: kept as long as tax law requires, even after the account is deleted.

5. How it is protected

Everything between you and us travels over TLS. The loader goes further: it pins our certificate, so it refuses to send your password or session token to a server that is not ours, even if a certificate authority were tricked into issuing a valid-looking one. Passwords are hashed with Argon2id, session tokens are stored hashed, and error messages for "wrong password" and "no such account" are identical so the login page cannot be used to discover which accounts exist.

No system is perfect. If a breach happens that puts you at risk, we will tell you and the ANPD, as the LGPD requires.

6. Your rights

Under the LGPD you can ask us to confirm what we hold, give you a copy, correct anything wrong, delete it, tell you who we shared it with, or withdraw consent. Write from the email address on your account and we answer within 15 days.

Deleting your account removes your login, your email, your sessions, and your diagnostics. Purchase records stay for the period tax law requires, reduced to what that law demands.

7. Children

Antilopy is for adults only. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we close it and delete the data.

8. Cookies

One cookie, for your session. It is httpOnly, so scripts on the page cannot read it, and it exists only to keep you signed in. No analytics cookies, no advertising cookies, no third-party trackers.

9. Changes

If this policy changes, the date at the top changes with it. If we start collecting something materially new, we will say so before it starts.

10. Contact

support@antilopy.xyz

See also the Terms of Service.