Gaia City privacy policy
Last updated: 28 October 2026
Who we are: Kilat Studios, the maker of Gaia City ("we").
Contact: hello@kilatstudios.com
Note for the current test version: accounts and the cloud save arrive with the launch version of Gaia City. The test version that some players have now works offline: it has no account, sends nothing to us and keeps your game only on your phone. This policy describes the launch version.
1. What this policy covers
This policy explains what data the Gaia City game (Android app, and later other versions) and its account service collect, why, where it is kept, for how long, and how you can see or delete it.
2. What we collect
When you create an account and play, we keep only what the game needs:
| Data | Why |
|---|---|
| Your email address | To sign you in, to check that the address is yours, and to send you a code if you forget your password. We never use it for advertising or newsletters. |
| Your password | To sign you in. We never store your password itself, only a salted, one-way scrambled form (a "hash") that cannot be turned back into your password. |
| Your birth year | To check you are old enough to have an account (see section 6). We store only the year, not your full birthday. |
| A random player ID | To link your account to your save. It is made up by us and is not your email or your name. |
| Your cloud save | Your game progress, in-game money, items, missions and settings, so you can keep playing on another phone or after reinstalling. |
| Sign-in sessions | So you stay signed in. We keep only a scrambled form of the session key; a session ends after 30 days without use, or when you sign out. |
| One-time codes | The 6-digit codes we email to confirm your address or reset your password. Kept only in scrambled form, valid for 10 minutes. |
What we do NOT collect: no real name, no phone number, no contacts, no photos, no location, no advertising ID, no ads, no analytics or tracking, no in-app purchases. We do not sell or rent your data, and we do not share it for advertising.
3. Technical data
Like every online service, our servers receive your device's internet (IP) address when the game connects. We use it only to deliver the service and to stop abuse (for example, too many wrong passwords). We keep it only in scrambled form inside short-lived limit counters (up to 24 hours) and in our server error logs, which are deleted automatically after at most 7 days.
4. Where your data is kept, and who helps us
Our account service and database run on Cloudflare (Cloudflare Workers and D1), which also sends our emails (Cloudflare Email Service). Cloudflare processes the data for us under its data processing terms; it does not use it for its own purposes. Cloudflare's servers are in many countries, so your data may be stored or processed outside Indonesia. We use encrypted connections (HTTPS) for all data sent between the game and our servers.
5. How long we keep it
- Your account and cloud save: until you delete your account.
- Sessions: until you sign out, or 30 days without use. Codes: 10 minutes. Abuse counters: up to 24 hours. Server error logs: up to 7 days.
- When you delete your account, it is removed from our live database at once. Our database provider keeps automatic recovery copies for up to 30 days, after which it is gone for good.
6. Age
You must be 13 or older to create an account. We ask for your birth year; if you are under 13 we cannot create an account and we do not keep anything you entered. If you are under 18, please ask a parent or guardian before you create an account.
7. Your rights and choices
You can, at any time:
- See and download your data: in the game (Settings > Account > Download my data), or by email to us.
- Correct it: change your email or password in the game.
- Delete your account and all its data: in the game (Settings > Account > Delete account), on the web without the app at https://gaiacity.kilatstudios.com/delete-account, or by emailing hello@kilatstudios.com from your account's email address.
- Delete only your cloud save, keeping the account.
- Withdraw consent by deleting your account.
We answer requests by email within 3 x 24 hours where Indonesian law (UU PDP) requires it, and in any case as soon as we can.
8. Security
Passwords are stored only as salted hashes; session keys and codes only in scrambled form; all connections are encrypted; there are limits on sign-in attempts and short lockouts after repeated wrong passwords. No system is perfect: if a data breach ever affects your data, we will tell you and the authorities within 3 x 24 hours, as UU PDP requires.
9. Changes
If we change this policy (for example, when we add sign-in with Google or Apple, friends or online play), we update this page and the date at the top before the change reaches the game, and for important changes we tell you in the game.
10. Contact
Kilat Studios: hello@kilatstudios.com