Blitz Jong Sub-processors and Data Recipients
This page lists the third parties that receive player data when you use Blitz Jong, and what each of them receives. It is an annex to our Privacy Policy.
1. Independent controllers
These companies decide for themselves how they process your data. They are not our processors, and their own privacy policies govern what they do with it.
| Party | Where it applies | What they receive | What we receive back |
|---|---|---|---|
| Valve Corporation | Steam sign-in, Steam wallet purchases, community market | Your Steam account, payment, and market activity | Your Steam ID, public persona name, and a snapshot of the items you hold in this game |
| Xsolla (merchant of record) | Coin top-ups on the website | Payment credentials, billing information, anti-fraud data | Order results only: order ID, item, amount, status |
| Google LLC | Google sign-in (optional) | The fact that you signed in on Google's side | openid/email/profile: account identifier, email address, display name |
2. Processors and sub-processors
These companies process data on our instructions.
| Party | Role | Data involved | Location |
|---|---|---|---|
| Tencent Cloud International (Hong Kong Lighthouse) | Production host. The game server and all business data sit on this machine's disk | Account records, wallet ledger, inventory, match records, telemetry, server logs (including IP addresses) | Hong Kong |
| Cloudflare, Inc. | Edge network (DNS, CDN, WAF, Tunnel). All player traffic reaches the origin through it | Request metadata, IP address, user agent, TLS fingerprint | Global anycast |
| Cloudflare Email Service | Outbound transactional email (address verification, password reset) and inbound routing for our published contact addresses | Recipient address, message content, delivery status; for inbound mail, whatever you write to us | Global |
| Google LLC (Gmail) | Mailbox behind our published contact address | Your email address and the content of your message, if you write to us | Global |
| GitHub (ghcr.io) | Container image distribution | No player data, only our build artefacts | Global |
We do not use advertising SDKs, third-party analytics (Google Analytics, Firebase, AppsFlyer or similar), crash-reporting SaaS, helpdesk SaaS, or third-party anti-cheat. Adding any of them requires updating this page and the Privacy Policy first.
3. Where data lives and who reaches it
| Business data is stored in | Hong Kong (production disk and snapshots) |
| Backups / cold storage | None off-site at present |
| Operational access from | The United States |
| Inbound ports on the origin | None. An outbound Cloudflare Tunnel carries all traffic, and the host accepts no inbound TCP, including SSH |
4. Change log
| Date | Change |
|---|---|
| 2026-08-13 | Rewritten in English. Added Cloudflare inbound email routing and the mailbox provider behind our published contact address. Writing to us means your message passes through both. |
| 2026-08-09 | First version: expanded the Privacy Policy's category-level disclosure into a named list; added Google, Cloudflare, and Tencent Cloud International. |