Privacy Policy

This policy explains what personal data Café District processes when you play the game or use this website, why, and what rights you have. The data controller is J. G. DE JESUS SOFTWARE, CNPJ 62.353.888/0001-01, Salvador - BA, Brazil, the company that makes and runs the game. Questions: privacy@cafedistrict.app.

1. In short

• You can play without giving us your name or your email: we create a guest account for your café.
• If you link your café to an email or to Google, we store that email so you can sign in.
• We store your café — what you built, earned and did in the game — so it is there when you come back.
• If you add friends, they see your café's name, avatar and level, and can visit your café and help in it. Nobody else sees them.
• We use only the cookies and device storage the game and this website need. No advertising, no analytics or tracking tools, and we never sell your data.

2. Data we process

Account data

• An account identifier, created when you first open the café (a guest account).
• Your email address, if you link your café to an email or sign in with an email code. We never store a password.
• If you sign in with Google: the email, name and profile picture Google shares with our sign-in provider.
• One-time sign-in codes, kept in a protected form until they are used or expire.

Game data

• Your café: what you placed, cooked, earned and unlocked, your level, coins and gems, and your progress.
• A record of your recent actions in the game, so your progress is saved and can be restored after an error.
• Backup copies of your café, kept for recovery.
• When you last played.
• The language you chose for the game, so it follows you to any device you sign in on.

Ratings and feedback

• The stars you give, the feedback you write, whether you allowed us to quote it, and your café's level, the game's version and your language at the time.

Friends

• Your friend code, which other players use to add you, and the name, avatar and avatar frame you give your café.
• Your friends: who they are and since when.
• If you joined through a friend's invite: who invited you. It counts toward that friend's invite rewards.
• Visits: which friends visited your café, on which day, and how they helped. Your friends see the same about your visits to theirs.
• Reports about café names: if you report a name, your report, the name and the reason you chose; if your café's name is reported, the reports about it.
• Blocks: reporting a player also blocks them, and we keep that you blocked each other so that neither of you is shown to the other again.

What your friends see: your café's name, avatar (with its frame, if it wears one) and level, and your café itself when they visit. They never see your email or your account.

Market

• The goods you put up on the Global Market: which, how many, at what price, when, and whether they sold, were taken down or expired.
• Your trades: what you bought and sold, from and to which café, the price, the market's fee and when. They are the source of the prices and volumes the market shows, which never name anyone, and they help us keep the market fair.
• What you did on the market each day, counted against its daily limits.

What other players see: your café's name and avatar beside the goods you put up, with their amounts and prices. They never see your email or your account.

Technical data

• Your IP address, used to keep the game secure and to prevent abuse, for example when you open a café or ask for a sign-in code.
• Access records: each time you open your café, your account identifier, your IP address and the date and time. Brazil's Marco Civil da Internet (art. 15) requires us to keep them for 6 months, even if you delete your account.
• Your IP address and browser details, kept with your sign-in session until you sign out or delete your account.
• Security and error records about your account.
• Standard server logs, including IP addresses, kept by us and our providers for a short time.

On your device

• Your game settings and your most recent progress, kept in your browser. See Cookies and device storage.

3. Why we process it (legal bases)

• To run the game you asked to play (performance of a contract): your account, your café, saving and syncing it, sign-in codes and emails.
• Security and abuse prevention (legitimate interests): security checks, limits against abuse, security records and server logs. Our interest is keeping the game and players' cafés safe; you can object, as described in Your rights.
• Friends, invites and visits you choose to use (performance of a contract): your friend code, café name, friends, visits and help, and invite rewards.
• The Global Market you choose to use (performance of a contract): your listings and trades, and the prices and volumes worked out from them.
• Keeping the market fair (legitimate interests): daily limits and checks for trading between one person's accounts. Our interest is a market where prices come from real players and coins are not moved around the game's limits.
• Keeping café names safe for everyone (legitimate interests): checking names, handling reports, and hiding or resetting a name that breaks our rules. Our interest is a game where players, including teenagers, are not shown offensive names.
• To read and answer your feedback and improve the game (legitimate interests).
• To meet legal obligations (legal obligation): keeping access records for as long as the law requires, and answering lawful requests from authorities.
• With your consent: quoting your feedback publicly, and signing in with Google. You can withdraw consent at any time; this does not affect what we did with your consent before.

4. Cookies and device storage

We use only strictly necessary cookies and storage — no advertising, analytics or tracking cookies — so no consent banner is shown. If we ever add analytics or tracking, we will update this policy and ask for your consent before those cookies are set.

You can clear cookies and site data in your browser. Clearing them signs you out, and you can then no longer open a guest café from that browser.

5. Who we share data with

We share data with the service providers that run Café District for us. They process it on our behalf, under contracts that protect it:

Your friends see what Friends describes, and only once you are friends; you can remove a friend at any time. When you sign in with Google, Google handles that step as a separate controller, under its own privacy policy. We do not sell your personal data or share it for advertising. We may disclose data when the law or a competent authority requires it.

6. International transfers

Our providers process data in the United States and in the European Union, among other places. If you live elsewhere, your data is transferred there; where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

7. How long we keep data

• Guest cafés: deleted, with everything in them, 30 days after the café was last played.
• Cafés linked to an email or Google: until you delete your account.
• Backup copies of your café: up to 30 days.
• Records of your recent actions: deleted once your progress is saved.
• Sign-in codes: until used, or until they expire a few minutes later.
• Security and error records: 30 days; records of measures we took on an account, 365 days.
• Feedback: up to 24 months, or until you delete your account, whichever comes first. Star ratings stay after an account is deleted, anonymised, with nothing that links them to you, so the average stays reliable.
• Access records: 6 months, including after an account is deleted, as the law requires; then deleted.
• Friends, your friend code, café name and who invited you: until you remove the friend, change the code or name, or delete your account.
• Visits: 30 days.
• Reports about café names: 180 days after they are dealt with or made, or until the account of the player who made or received them is deleted.
• Blocks: until the account of either player is deleted.
• Market listings: 30 days after they sell, are taken down or expire, or until you delete your account.
• Market trades: which cafés took part is kept 30 days; the trade itself 90 days. Daily totals of prices and volumes, which name nobody, are kept.
• Daily market counts: 7 days.
• Sign-in sessions: until you sign out or delete your account.
• Server logs: a short time, then rotated away.

8. Your rights

Depending on where you live — including under Brazil's LGPD, the EU GDPR, the UK GDPR and US state privacy laws — you have the right to:

• confirm whether we process your personal data, and access it;
• correct it;
• have it anonymised, blocked or deleted, and have it deleted when processing relied on your consent;
• receive it in a portable format;
• know who we share it with;
• know that you can refuse consent, and what happens if you do;
• withdraw consent;
• object to its processing, or restrict it.

How to use them:

• Delete your café and your account from the game's settings.
• For everything else, email privacy@cafedistrict.app. We answer within the time the law requires.

You may also complain to your data protection authority — in Brazil, the ANPD; in Spain, the AEPD — or to a consumer protection body. We will never treat you differently for exercising your rights.

9. Security

We protect your data with encrypted connections, sign-in without passwords, restricted access to our systems and safeguards against abuse.

10. Children

Café District is not directed at children under 13, and players under 18 need the permission of a parent or legal guardian (see the Terms of Use). We do not knowingly collect data from children under 13; if you believe a child under 13 has given us data, email privacy@cafedistrict.app and we will delete it. We never show advertising or build profiles of players for advertising. There is no chat in Café District: the only words one player can show another are café names, which are checked when they are set, can be reported, and are hidden or reset when they break our rules.

11. Changes and contact

We may update this policy, and we will tell you about important changes in the game or on this website. Data controller: J. G. DE JESUS SOFTWARE, CNPJ 62.353.888/0001-01, Av. Tancredo Neves, 1485, Sala 202, Edifício Esplanada Trade Center, Caminho das Árvores, Salvador - BA, CEP 41820-020, Brazil. Data protection contact (in Brazil, the *encarregado* channel): privacy@cafedistrict.app.

12. Language

This policy is written in English and is also offered in Portuguese and Spanish. If a translation differs from the English version, the English version governs, unless the law where you live gives priority to the version in your language. For players in Brazil, the Portuguese version governs.