Privacy Policy

What data MYPEX collects, why it is needed, who it is shared with and how to delete it.

Version of October 29, 2026 · In force from the moment of publication

In brief. We do not ask for your name, address or phone number. A nickname is enough to play. Bank card details never reach us. There are no ads and no advertising or analytics trackers, and data is not sold or passed to advertisers. You can delete your account yourself in the game or with a message to support. The Project is intended for people aged 13 and over.

Contents
  1. 1. Who processes the data
  2. 2. What data we collect
  3. 3. Why it is needed
  4. 4. Cookies and signing in to the game
  5. 5. Who we share data with
  6. 6. How long we keep it
  7. 7. Your rights
  8. 8. Security
  9. 9. Children
  10. 10. Changes to the policy
  11. 11. Contacts

1. Who processes the data

1.1. The data operator is the Administration of the MYPEX game project — an individual who maintains the website mypex.net, the MYPEX game — in the browser (play.mypex.net) and in the apps for Android, iOS, Windows, macOS and Linux — its game servers, the in-game voice chat and the Telegram bot @mypexbot.

1.2. You can contact the operator on any question about data processing by the means given in section 11.

1.3. The Policy applies to all the services listed. It does not apply to third-party websites that may be linked from the game or from player materials.

1.4. By using the Project, you agree to data processing on the terms of this Policy.

2. What data we collect

We follow the principle of minimality: we collect only what the game and support cannot work without.

WhenWhat exactly
When creating an account and signing in In-game nickname; password — only as an irreversible hash, the password itself is not stored anywhere; registration date. When signing in via Telegram — the numeric Telegram identifier, name and username, which Telegram itself provides. When signing in with Apple — only the permanent Apple identifier (the game does not ask Apple for your name or e-mail) and the access key issued by Apple, stored encrypted — it is needed to revoke that access when the account is deleted. When signing in with VKontakte or linking it — only the numeric VKontakte user identifier.
During play Dates of first and last sign-in, your rank and perks, in-game currency balances (coins and platinum), game progress, items and the changes you make to the game world, clan and role in it, friends, ban status.
In chat The messages you write in the public chat and in private messages, and reports about players — for moderation and investigating violations. Other players can see the public chat. The voice chat carries sound to nearby players in real time and is not recorded; the microphone is used only with your permission and when you press the talk button.
When signing in from a device A session cookie and, if you chose "remember me", a device token (stored as a hash) with the date of issue and of last use.
When buying platinum Nickname, the chosen platinum pack, amount, order number, payment status and the transaction identifier from the payment service: TradeMC on the website, Google Play or the App Store in the apps. Card details, card number, expiry date and CVC do not reach us.
When you contact us The text of your request: a team application with answers to the questionnaire, a bug report or idea, a video link with a title and comment, a review and rating of an article on the website — together with your nickname. The game itself attaches technical details to a bug report: version, platform, frame rate, screen size, input type and the last lines of the game log, with nicknames and IP addresses removed.
Automatically IP address, date and time of the request, browser and device type — in the server's technical logs; the game version, platform (for example Android, iOS, Windows or a browser), the kind of input device (touch, keyboard and mouse, or gamepad) and game error reports. In the Android and iOS apps — the result of the app genuineness check from Google Play or Apple (see section 3).

We do not collect your full name, passport data, address, phone number, e-mail (except where you wrote to us from your mailbox yourself), geolocation, biometrics, contacts, photos or files from your device, or an advertising ID. Please do not include such information in your nickname, chat or requests.

3. Why it is needed

  • Account operation — signing in (including via Telegram, Apple and VKontakte), regaining access, linking Telegram and VKontakte, revoking devices.
  • Gameplay — saving progress, ranks, balances, clans and statistics, crediting purchased platinum.
  • Supporting the project — checking disputed payments, refunds.
  • Feedback — reviewing applications, bug reports, ideas and reviews, publishing players' videos.
  • Moderation and security — investigating violations of the Rules, fighting cheats, multi-accounts used to evade bans, hacking and attacks on the server.
  • Notifications — news and in-game messages via the Telegram bot, if you have linked Telegram.

Cheating protection. To keep the game fair, we check that the game client is genuine and unmodified, and we analyse gameplay signals such as movement timing and input patterns. These checks use the technical data listed in section 2 and do not read other apps, files or personal content on your device.

The legal basis for processing is your consent, given when creating an account and using the Project, as well as the operator's legitimate interest in keeping the service working and secure.

We do not use data for advertising profiling and do not make automated decisions that have legal consequences for you. Bans are imposed by a person.

4. Cookies and signing in to the game

4.1. The website uses three cookies. mypex_sid stores a signed session identifier, lives for 30 days and is marked with the HttpOnly, Secure and SameSite=Lax flags: it cannot be read by scripts on the page and is not sent to third-party websites. mypex_lang remembers the website language you chose and lives for a year; the same choice is kept in the browser's storage (localStorage). mypex_beta appears only if you joined the beta test of the Android app: it is a signed note of the tester group you were given, and it lives for 30 days.

4.2. The cookie is strictly necessary for signing in. There are no advertising, analytics or tracking cookies on the website. We do not use web analytics systems or counters.

4.3. If you chose to remember the device, a token is issued for signing in to the game client without a password. It is stored in the database as a hash. The list of remembered devices and the revoke button are in the "Security" section of your profile; revoking is the only way to invalidate a stolen token.

4.4. You can delete or block cookies in your browser settings. In that case signing in to the website will not work.

4.5. The website's design uses Google Fonts, which are loaded from Google's servers (fonts.googleapis.com, fonts.gstatic.com). When a font is loaded, Google receives your IP address and browser data. Google Fonts does not set cookies.

5. Who we share data with

We do not sell data and do not pass it to advertisers, data brokers or third parties for their own purposes. Data is transferred only to the extent necessary for the Project to work:

RecipientWhat is transferred and why
Payment service TradeMC
trademc.org		 The in-game nickname, the chosen platinum pack and the amount — to set up the transfer. A payment confirmation comes back. Payment details are processed by the service and the payment method chosen in it; they do not reach us.
Google Play, App Store
Google LLC · Apple Inc.		 Only if you buy platinum in an app: the payment is handled by the app store, and we receive a confirmation of the purchase and its identifier. Payment details do not reach us. In addition, the Android or iOS app obtains a confirmation from Google Play or Apple that it is genuine, and our server verifies that confirmation.
Telegram
Telegram Messenger Inc.		 Only if you have linked Telegram: the bot sends you notifications. Telegram passes us your identifier, name and username to confirm sign-in.
Apple
Sign in with Apple		 Only if you sign in with Apple: Apple passes us a permanent identifier; we do not ask for your name or e-mail. When the account is deleted, we ask Apple to revoke the access it gave us.
VKontakte
VK ID		 Only if you sign in with VKontakte or have linked it: VKontakte passes us the numeric user identifier. We do not store VKontakte access keys.
Google
Google Fonts		 IP address and browser data when loading the website's design fonts.
Hosting provider Data is stored on a rented server. The provider does not process it independently and has no access to it in the course of normal operation.
Government authorities Upon an official lawful request and only to the extent it requires.

The in-game nickname, rank, clan, public chat messages, the mode you are playing and your device type (an icon in the player list), reviews on the website and videos approved by moderation are the public part of the Project and are visible to other players. Nothing else is.

Data is stored and processed on servers located in the territory of the Russian Federation. If you live in another country, this means your data is stored outside it; the same protection applies to every player, wherever they are.

6. How long we keep it

  • Account data and game progress — as long as the account exists and for another 12 months after the last sign-in, after which the account may be deleted as inactive.
  • Sessions and device tokens — until they expire or until you revoke them; expired ones are deleted automatically.
  • Purchase records — 3 years, so that a disputed situation can be examined and a refund confirmed.
  • Requests, applications and bug reports — 12 months from the time they are reviewed; reviews and ratings on the website — as long as the account exists.
  • Technical server logs with IP addresses and chat messages — up to 90 days. The account's IP address history is kept for security as long as the account exists and is visible only to staff, never to other players.
  • Ban records — for the duration of the ban; for a permanent ban — indefinitely, to prevent evasion.

7. Your rights

You have the right to:

  • find out what data of yours we process and obtain a copy of it;
  • correct inaccurate data;
  • withdraw consent and demand deletion of data;
  • unlink Telegram and turn off notifications;
  • revoke access from remembered devices — yourself, in the profile;
  • appeal our actions to the data protection authority of your country (in Russia, Roskomnadzor) or in court; if the law of your country (for example in the EU, the UK or California) gives you other rights as well, they apply too.

How to exercise them. Write to us by the means given in section 11 from the Telegram account linked to the game account, or confirm ownership of the account in another available way — this protects you from other people's requests made in your name. We will reply within 30 days.

Deleting an account. You can delete the account yourself in the game: "Profile" → "Delete account" (details are on the page "Account deletion"). Deletion is carried out after 14 days, and until then it can be cancelled by signing in to the game with your password, or, for an account without a password, the way it was created (via Telegram, Apple or VKontakte). Or at your request, by the means given in section 11. Uninstalling the app does not delete your account. We delete the nickname, password hash, the Telegram, Apple and VKontakte links, game progress, balances (platinum and coins are erased without refund), the account's IP address history, requests, applications, and reviews and ratings on the website. The following are kept: records of transfers (order number, amount, date, status and the nickname under which the payment was made; there are no card details) — to the extent and for the period (3 years) necessary for accounting, tax records and refunds; records of penalties — for the duration of the penalty, and of a permanent ban — indefinitely, otherwise deleting an account would become a way to evade a penalty; blocks built in the world (the world data holds no owner names); a deletion log with an irreversible hash of the nickname. Technical server logs are not erased when an account is deleted and are not rewritten on request. After the period has passed, deletion is irreversible.

8. Security

  • The website works only over HTTPS, and the connection between the game and our servers is encrypted.
  • The password is stored as an irreversible hash — the original password cannot be recovered from the database.
  • The session cookie is inaccessible to page scripts and is protected from being sent to third-party websites.
  • Device sign-in tokens are stored as hashes, have a limited lifetime and are revoked with one click.
  • Payment confirmations from the payment service and the app stores are accepted only after a cryptographic check and are not processed twice.
  • Access to the database is limited to the Administration; the server is protected against password guessing.

There is no such thing as absolute protection. If we learn of a leak affecting your data, we will announce it in the news on the website and on Telegram and notify the authorities as the law requires.

For your part, do not use your game password on other websites and do not give third parties access to your account.

9. Children

The Project is intended for people aged 13 and over. If your country sets a higher age of consent to data processing, that age applies. We do not knowingly collect data from children below that age. If you are a legal representative and believe that a child has given us data, write to us — we will delete it.

10. Changes to the policy

We may update this Policy. The current version is always posted on this page, with the date at its top. We announce significant changes in the news on the website and on Telegram at least 3 days before they take effect.

11. Contacts

In the subject of your request put "Personal data" and attach your in-game nickname — this way the request reaches the right person faster.