Blitz Jong Privacy Policy
1. Who We Are
MarcoHard LLC ("we", "us"), 8401 Mayland Dr Ste A, Richmond, VA 23294-4648, USA, is the data controller for personal information processed in connection with the game Blitz Jong and its websites (the "Service").
Game servers are located in Hong Kong. Our team may access data from other locations to run the Service.
For privacy matters, contact [email protected].
2. What We Collect
A. Information you provide
- Account information: your account identifier, sign-in credentials handled by our account system, and your display name.
- Age information: the birth year and month you enter at first sign-in, kept together with the verification result. We do not collect your full date of birth.
- Support communications: messages you send us and the contact details you use.
B. Information generated by playing
- Match data: match logs and replays, including the actions taken in a match, the display names of the players in it, and timestamps.
- Profile and progression: rank, match statistics, unlocked cosmetics and their loadout, quest and reward state.
- Transaction records: your Virtual Currency balance and ledger entries (amounts, timestamps, item identifiers, and payment-transaction reference numbers). We never receive or store your card numbers, bank details, or other payment credentials. Payments are processed by Valve or our merchant of record (Section 5).
- Technical and gameplay telemetry: connection events, latency and timing measurements, and gameplay-balance events, used for service quality, balancing, and anti-cheat.
- Log data: IP address, device/browser type, and access timestamps from our servers and edge network.
- Moderation records: reports you submit about another player (the reason, your note, and the match involved), reports other players submit about you, and any enforcement action on your account (type, reason, duration, and the record it was based on).
C. Information from third parties
- From Valve (if you play via Steam or link a Steam account): your Steam ID, public Steam persona (nickname, avatar), and a snapshot of the Blitz Jong items in your Steam inventory.
- From our merchant of record (Xsolla) for website purchases, we receive order results: order ID, product, amount, and payment status (success/refund). Not your payment credentials.
- From platform sign-in providers you choose to link: the account identifier and basic profile needed to link the credential.
D. Local storage on your device
The game stores a small amount of data in your browser's local storage: your sign-in token, your language, your display preferences (such as which cosmetics you have selected locally and whether sound is muted), and, if you play as a guest, a guest identity credential so that returning to the game keeps the same guest profile instead of creating a new one each time. Clearing your browser storage discards that credential, and with it the guest profile's rank and match record; those are not recoverable, which is why we offer to move them to an account. This is strictly necessary to keep you signed in and to render the game as you configured it. We set no advertising or analytics cookies, and there is no third-party tracker on our pages. Clearing your browser storage signs you out and resets local preferences.
We do not collect precise location, contacts, or advertising identifiers, and the Service contains no third-party advertising or ad-tracking SDKs.
3. Why We Process It (Purposes and Legal Bases)
| Purpose | Data used | Legal basis |
|---|---|---|
| Operating the game: accounts, matchmaking, seat reclaim on reconnect, replays, rankings | A, B (match data, profile) | Performance of contract |
| Processing purchases and delivering Virtual Currency / items; refund handling | B (transactions), C (Xsolla/Valve) | Performance of contract; legal obligation (financial records) |
| Fair play: detecting cheating, automation, multi-accounting, and reward abuse | B (match data, telemetry, log data) | Performance of contract (fair gameplay); legitimate interests |
| Service quality and balancing: latency analysis, rule-parameter tuning | B (telemetry), aggregated where possible | Legitimate interests |
| Reviewing reports and enforcing the rules | B (moderation records, match data) | Performance of contract; legitimate interests |
| Player support | A (support), relevant B records | Performance of contract |
| Security, abuse prevention, legal compliance | B (log data), others as needed | Legitimate interests; legal obligation |
| Optional communications (news, events) | A (contact) | Consent (opt-in, withdrawable) |
We do not use your personal information for third-party advertising, and we do not sell it.
4. Public Information: Replays, Leaderboards, and In-Match Display
Playing an online game means other players see you. Specifically:
- Your display name and rank are visible to other players in your matches.
- Match replays include the display names and actions of all four players. A replay is available to the players who took part in that match; we do not provide a public directory of replays.
- Leaderboards display your display name and rank.
Choose your display name accordingly. Do not use your real name if you do not want it visible.
A replay is a single record shared by the four players in the match. If you delete your account, we delete your account records and the information that identifies you outside those matches. The display name you played under remains in the record of matches already played, because removing it would impair the other three players' record of the same match. Section 7 sets this out in full.
5. Who We Share It With
- Platform operators (independent controllers). If you play via Steam, Valve processes your Steam account, wallet, and Community Market activity under Valve's own privacy policy. We receive from Valve only what Section 2.C describes.
- Merchant of record (independent controller for payments). Website purchases are made from Xsolla as merchant of record. Xsolla collects your payment details, billing information, and anti-fraud data under its own privacy policy; we receive only order results.
- Service providers (processors). Hosting and infrastructure providers that store and transmit data on our instructions, bound by contract to use it only for us. Currently: Tencent Cloud International (game server and data storage, Hong Kong), Cloudflare (edge network for all player traffic, and delivery of transactional email such as verification and password-reset messages). A current list is published as our sub-processor list.
- Sign-in providers you choose. If you sign in with Google, Google confirms your identity to us and we receive your account identifier, email address, and basic profile. Google processes that sign-in under its own privacy policy.
- Legal. We may disclose information when required by law, to enforce our Terms, or to protect players and the Service; and to a successor in a merger or acquisition, subject to this policy.
6. International Transfers
Your data is stored on our servers in Hong Kong and may be accessed by our team in the United States to operate the Service. Where your local law regulates cross-border transfers, we rely on the safeguards described in the regional supplements in Section 10, such as EU standard contractual clauses and the statutory notice required where PIPL applies.
7. How Long We Keep It
| Data | Retention |
|---|---|
| Account and profile | Life of the account; deleted within 30 days of account deletion |
| Age-verification record (birth year/month + result) | Life of the account; deleted with the account |
| Sign-in credentials and linked platform identifiers | Deleted with the account |
| Match replays | Retained as part of the match record. Deletion of your account does not remove the display name you played under from matches already played (Section 4) |
| Telemetry (balance/latency events) | Retained for balancing and anti-cheat. Contains the display name used in the match, on the same basis as replays |
| Transaction ledger | Retained as required for financial and tax records. After account deletion the entries carry only an internal identifier and no longer identify you |
| Server and edge logs (IP) | Retained for security and abuse investigation |
| Support communications | Retained while needed to handle your request and any follow-up |
| Reports (submitted and received) | Retained while needed to review them and to address repeated conduct |
| Enforcement records (suspensions, recoveries) | Life of the account; permanent suspensions retained after deletion in minimised form (account identifier + reason) to enforce the ban |
We do not currently apply fixed maximum retention periods to replays, telemetry, or logs. Those periods will be published here when they are introduced.
Where law requires longer retention (tax, accounting, disputes), we keep only what that law requires, separated from operational use. Your data remains exportable on request (Section 8).
8. Your Rights
Subject to your local law, you can:
- Access and export your data (account profile, match history, ledger) in a portable format;
- Correct inaccurate profile data;
- Delete your account and associated personal data (Section 7 describes what happens and what we must retain);
- Withdraw consent for anything based on consent (such as optional communications);
- Object to or restrict certain processing, where your law provides;
- Complain to your local data-protection authority.
Automated decision-making. We use automated signals to detect cheating, automation, multi-accounting, and reward abuse. These signals do not by themselves permanently suspend an account: a permanent suspension is made by a person reviewing the underlying match record. Automatic, immediate measures are limited to reversible ones (such as rejecting an action, ending a match, or recovering items obtained through a bug), and you can contest any of them through support.
To exercise rights, contact [email protected] from the contact associated with your account; we will verify the request and respond within the time your local law requires (and in any case within 45 days). For payment-credential and refund matters, contact Xsolla or Valve as described in Section 5; for Steam account data, contact Valve.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them (14 in mainland China; up to 16 in certain EEA states, see Section 10). If we learn we have collected such data, we will delete it. Parents who believe their child has used the Service may contact [email protected]. For United States users, Section 10.4(d) describes our COPPA practices in detail.
10. Regional Supplements
10.1 Mainland China (PIPL)
If you are in mainland China: our processing described in this policy involves providing your personal information to MarcoHard LLC outside mainland China (recipient: MarcoHard LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294-4648, USA, contact: [email protected]; purposes, categories, and methods as described in Sections 2–3; you may exercise the rights in Section 8 against the recipient via the same contact). When you create an account from mainland China, we ask for your separate consent to this cross-border provision, as a distinct choice from your acceptance of the Terms and this policy. You have the rights to access, copy, correct, and delete your personal information and to withdraw consent; because all of our infrastructure is located outside mainland China, withdrawing this consent means we can no longer provide the Service to you, so we treat a withdrawal request as an account deletion request under Section 8. Users under 14 require a guardian's consent, and we do not knowingly serve users under 14 without it.
10.2 Japan (APPI)
If you are in Japan: your personal information is transferred to and stored in Hong Kong and accessed from the United States as described in Section 6. We provide this notice under Article 28 of the APPI; the recipient MarcoHard LLC implements protections consistent with this policy and applicable OECD privacy principles. Requests under the APPI can be made via Section 8.
10.3 EEA and United Kingdom (GDPR)
If you are in the EEA or UK: the legal bases in Section 3 apply as described. Transfers out of the EEA/UK rely on adequacy decisions where available and otherwise on the European Commission's standard contractual clauses (and the UK Addendum). You additionally have the rights to data portability and to restriction of processing, and you may lodge a complaint with your supervisory authority. The minimum age is 13 or your member state's higher age of digital consent.
10.4 United States
(a) State privacy rights. If you live in a U.S. state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, Texas, and others): the categories of personal information we collect are listed in Section 2, our purposes in Section 3, and the recipients in Section 5. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects, and we do not collect sensitive personal information as defined by those laws (no precise geolocation, biometrics, health, or government identifiers). Because we do not sell or share personal information, there is nothing to opt out of; where a universal opt-out preference signal (such as Global Privacy Control) applies to us, we honor it. You may exercise the rights in Section 8 (access, correction, deletion, portability), including through an authorized agent where your state provides for one, and we will not discriminate against you for doing so.
(a2) Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for how services must respond to it. Because we do not track you across other websites or services and do not serve behavioural advertising, we do not change our behaviour in response to the signal; where a legally recognised universal opt-out preference signal applies to us, we honour it as stated above.
(b) Appeals. If we decline a privacy request, we will explain why, and you may appeal by replying to our decision. We will respond to an appeal within the period your state's law requires (generally 45–60 days). If the appeal is denied, you may contact your state Attorney General.
(c) California. California residents additionally have the rights under the CCPA/CPRA described above, the right to request the "Shine the Light" disclosure (we make no such third-party marketing disclosures), and, if you are under 18, the right to request removal of content you posted (such as your display name on shared replays), which you can exercise via Section 8.
(d) Children (COPPA). The Service is a general-audience service, is not directed to children under 13, and we do not knowingly collect personal information from children under 13. We apply an age screen at account creation and do not encourage misrepresentation of age. If we obtain actual knowledge that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. We do not disclose children's personal information to third parties, and we retain personal information only as long as necessary for the purposes in Section 3, as described in Section 7. Parents may contact [email protected] to review or request deletion of their child's information.
10.5 Notice at Collection
We link this policy from the account-creation screen and from the in-game settings, so that it is available to you at or before the point where we collect your information.
11. Security
Hidden game state (such as other players' hands) never leaves the server; personal data is transmitted over encrypted connections, access is restricted and key-based, and payment credentials never touch our systems. No online service is perfectly secure; we will notify you and the relevant authority of a breach where the law requires.
12. Changes
We will post updates here and, for material changes, give in-game or website notice before they take effect. The "last updated" date below reflects the current version.
Last updated: 2026-08-14. MarcoHard LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294-4648, USA. Contact: [email protected].