1. Who this policy covers, and who we are

This Privacy Policy explains what personal data BackpackOT (the website and game operated by an individual, without a separate registered legal entity for this project, "we", "us") processes about you, why, and what rights you have. It applies to the BackpackOT website and game account system.

If you have questions about this policy or want to exercise a privacy right, contact backpackot@gmail.com.

BackpackOT is operated by a private individual and does not currently publish a separate business address.

2. What we process

We process the following categories of data, to the extent they apply to how you use the Service:

• Account data: your account name or number, email address, and password (stored as a salted hash, never in plain text). Optional profile fields you choose to fill in, such as a real name or location shown on your public account page, and country.
• Authentication and security data: your account recovery key; session identifiers used to keep you logged in; and, where you choose to enable it, two-factor authentication data.
• Access and security logs: IP address and timestamps associated with logins and certain account actions (for example, an account action log showing what changed and from which IP), used for account security, abuse prevention and troubleshooting.
• Game data: your characters, their stats and progression, and gameplay events that are inherently part of playing (for example, kills, which are shown publicly on the Last Kills page as part of normal game functionality).
• Backpack Coin and transaction data: your Backpack Coin balance and transaction history, and records of purchases, including a payment reference from our payment provider (see Section 4). We do not store your full card number or equivalent payment credentials -- see Section 4.
• Legal acceptance records: which version of our Terms of Service, Purchase Terms or Privacy Policy you accepted or were shown, when, and the context (for example, at registration or at checkout). See our Terms of Service.
• Support communications: anything you send us when contacting support, so we can respond to you.
• Cookies and similar technology: a session cookie that keeps you logged in, and a CSRF (cross-site request forgery) token used to protect account actions from being triggered by other websites. See Section 6.

We do not run visitor analytics or advertising tracking on the Service by default. If this changes in the future, this policy will be updated accordingly before it takes effect.

3. Why we process it, and on what basis

We process personal data to: operate your account and let you play the game (performance of our contract with you, i.e. these Terms); keep the Service secure and prevent fraud, cheating and abuse (our legitimate interest in operating a fair and secure service, balanced against your rights); process payments and deliver Backpack Coins you purchase (performance of our contract, and our Purchase Terms); respond to support requests (performance of our contract, or our legitimate interest in providing support); and comply with legal obligations that apply to us, where applicable.

4. Payment data

Backpack Coin purchases are currently processed through PayPal. When you pay, your card or PayPal account details are entered on PayPal's own systems, not ours -- we do not receive or store your full card number or equivalent payment credentials.

After a successful payment, PayPal notifies us of the transaction, and we store a transaction reference, the amount paid, the currency, and the payer's PayPal-provided email address, so we can credit your account correctly and keep a record for accounting and support purposes. PayPal processes your payment information under its own privacy policy, which we encourage you to review.

If additional payment methods are enabled in the future, this section will be updated to reflect how they actually work before they go live.

5. Who we share data with

We do not sell personal data. We share it only where necessary to run the Service:

• PayPal, to process payments, as described in Section 4.
• Publicly, within the game and website, for information that is inherently public as part of how the Service works -- for example, character names and levels on highscores, and kills on the Last Kills page. This does not include your account name/number, email address or password.
• Where required by law, for example in response to a valid legal request from an authority with jurisdiction over us.

We do not currently use third-party analytics or advertising services. Some pages may embed third-party content (for example, a Discord widget or social share buttons); those third parties may set their own cookies according to their own privacy policies when their content loads, independently of us.

6. Cookies and session data

We use a session cookie to keep you logged in and a CSRF token to protect your account actions. These are functional and necessary for the Service to work -- there is no non-essential tracking cookie in use by default.

7. How long we keep data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including operating and securing BackpackOT, maintaining account and transaction records, resolving disputes, preventing fraud and abuse, and complying with applicable legal obligations.

Retention periods may vary depending on the type of data and the reason it is processed. For example, certain account, payment and transaction records may need to be retained for longer periods for accounting, fraud prevention, dispute handling or legal compliance.

When personal data is no longer reasonably necessary for these purposes, it will be deleted, anonymized or otherwise removed from active use, unless continued retention is required by law.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to complain to your local data protection authority. To exercise any of these, contact backpackot@gmail.com. We will respond within a reasonable time and may need to verify it is really you before acting on the request.

9. Changes to this policy

We may update this Privacy Policy as the Service changes. The current version number and effective date are shown at the top of this page.