Privacy Policy
This page explains what data Mekha Online collects about you, why, how long we keep it, who can see it, and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).
Who looks after your data
Operator of Mekha Online is the controller of personal data for this service. Contact us about personal data at privacy@mekha.online.
The data we collect and why
| Data | What it is used for | Legal basis |
|---|---|---|
| Member account: email, hashed password, sign-up method, and sign-up date. If you sign in with Google, the name and profile picture Google sends us. | To let you sign in, send verification emails, and reset passwords. | Needed to provide the service under contract |
| Guest accounts: a user ID the system creates for you, with no email or password until you bind the account to an email or Google — after that it is kept the same way as a member account | To let you play before signing up, and to carry your characters into your account when you bind it | Needed to provide the service under contract |
| The version of the terms you accepted, and when you accepted it. | Shows that you accepted them, and asks again when the terms change. | Needed to provide the service under contract |
| Character: name, appearance, level, class, items, gold, progress, friends, block list, clan, and playtime. | Lets you play and keeps your progress | Needed to provide the service under contract |
| Achievements, titles, login reward calendar, progress, Battle Pass, and redeemed gift codes, with the time used. | To show progress, pay out rewards correctly, and prevent double claims. | Needed to provide the service under contract |
| PvP results: arena score and ranking, recent match history, including teammates and opponents in those matches. | Match opponents, rankings, season reward payouts, and checking for match-fixing. | Needed to provide the service under contract |
| All chat messages in every channel, including whispers, party, and clan messages, with the time sent. | Keeping players safe: reviewing reports of harassment or scams. | Legitimate interests |
| Player reports: the reporter, the reported player, the reason, and the reported player's most recent public chat messages. | Lets our team review and act on reported issues | Legitimate interests |
| Bug reports and ideas: the text you wrote, your character, map and location, level, class, game version, screen size, browser type, and any reward sent to you. | So the team can find and fix bugs, improve the game, and send rewards to the players who reported them. | Legitimate interests |
| In-game mail: sender, recipient, subject, body, and attached items or gold. | Delivering mail to the recipient, and reviewing reports of harassment or scams. | Needed to provide the service under contract |
| Trades and the Auction House: trade partners, items and gold exchanged, seller names, listed items, and prices. Past sale prices carry no player names. | Lets players trade with each other and shows market prices | Needed to provide the service under contract |
| Item history: who gained or lost which items and gold, when, and from whom. | Finds lost items and detects cheating and scams | Legitimate interests |
| Restores a character from backup | Restoring characters when a bug caused loss, an account was accessed without permission, or our team made a mistake. | Legitimate interests |
| Connection data: IP address, login time, and browser type. | Protection against attacks and spam, limiting unusual use, and keeping traffic logs as the law requires. | Legitimate interests and legal duties |
| Game performance data: screen size, browser type, loading steps, browser errors, and characters played each day. Before storing errors, we remove addresses, emails, and auth tokens. | Fixes bugs, improves the game, and reviews overall play | Legitimate interests |
| Browser signals that Cloudflare Turnstile uses to check you're human when signing up or logging in. | Prevents bot sign-ups | Legitimate interests |
| Email registered for pre-registration on the website. | Delivers rewards to registered players | Consent |
| Messages you send to us | Answers questions and helps resolve problems | Legitimate interests |
We do not sell your data, show ads, or use advertising trackers The game has no payments yet, so we don't hold any card or bank account details., and we never ask for your national ID number or address.
Only assigned team members can view this data, and only as much as needed to run the game. Team actions are logged.
Other players see some of your character's info in game. When they open your character, they see your equipped gear, skill bar, level, class, clan, title, combat power, and whether you're online, even when you're not playing. You can hide these details in the social window, which leaves only your name, level, class, and title. Your ranking on the Hall of Heroes and in the Arena is visible to all players.
Service providers who store data for us
We use these providers, and share only what each one needs to do its job.
| Providers | What they do for us | Related information | Location |
|---|---|---|---|
| Supabase | Member account and sign-in system | Email, hashed password, sign-in data. | Singapore |
| Hetzner | Game server machines | All game data and backup copies | Singapore |
| Cloudflare | Relaying connections, protection against attacks, and Turnstile. | IP address and connection data | Global network |
| MailerSend | Sends verification emails and password resets | Your email | Overseas |
| Google sign-in when you choose it, and website fonts. | Google email and profile; IP address when loading fonts. | Overseas | |
| Discord | Community of the game, only when you join it yourself | Data under Discord's policies. Our bot stores only Discord user IDs and times, not linked to game accounts. | Overseas |
Overseas transfer of data
Our game servers and account systems are located in Singapore, and some providers operate in other countries, so your data is transferred out of Thailand. We do this to provide the service under our contract with you, and we choose providers with data protection measures.
How long we keep data
| Data | Period |
|---|---|
| Account and characters | Until you delete it; deleted characters wait in the bin for 30 more days so they can be restored. |
| PvP results for this season and match history | Until the character is permanently deleted or the game world starts a new season. |
| Login reward calendar, Battle Pass progress, and redeemed codes. | Until the account is permanently deleted or the game world starts a new season. |
| Event logs: game logins and IP addresses; chat. | 120d |
| Player reports, bug reports and ideas | Until the team closes the matter, then 180 more days |
| In-game mail | Mail with no attachments: 30 days. Mail with unclaimed items or gold is returned to the sender after 30 days and kept until someone collects it. |
| Item history | 120d |
| Restores a character from backup | 14d |
| Characters played each day | 120d |
| Server performance statistics, which contain no player data. | 120d |
| Browser errors | 30d |
| Database backups | 14 days. Deleted data is removed from internal copies within 14 days after the actual deletion. |
| Server operation logs, which include IP addresses at login. | Overwritten when the reserved space fills; not set as a number of days. |
| Email registered for early access | Until you ask us to delete it |
Deleting characters and accounts
Deleting a character: select it at the campfire and type the character's name to confirm. The character goes to the deletion bin for 30 days; you can restore it yourself at the campfire if the account has room (no more than 4 characters). In the meantime the name is still yours. After the period, the character is permanently deleted and the name becomes available to others.
Deleting an account: press delete account at the campfire and type to confirm. All your characters go to the deletion bin for 30 days, and the login account is removed from your browser at once. After that you can't sign in with the old account. If you change your mind within 30 days, sign up again with the same email, then restore your characters from the campfire. The email is kept with the characters until this period ends.
If the account deletion system fails to finish, the request stays with our team, and you can still sign in to cancel it. Our team will delete it within 30 days.
What remains after permanent deletion, with no link to your character or account name:
- Item history entries involving other players, for 120 days.
- Game login logs with IP addresses, for 120 days; your own chat messages are deleted.
- Reports used by the team to investigate, kept 180 days after the case closes; chat messages you included in reports are deleted.
- Party rows on leaderboards that other players also took part in.
- Rank, score, level, and class on the arena leaderboard of finished seasons.
Character names in the "First in the World" record and past Hall of Heroes champions remain as game world history. If you want them removed, tell us at the email below.
Your rights
Under the PDPA you have the right to:
- Request access to and a copy of your data
- Asking for your data to be sent or transferred to another provider in a machine-readable format.
- Request correction of inaccurate data
- Request deletion or anonymization of your data
- Request a temporary restriction of data use
- Objecting to processing based on legitimate interests.
- Withdrawing consent at any time for data processed on the basis of consent.
- Complaining to the Personal Data Protection Committee.
Deleting characters and accounts can be done yourself at the campfire. For other rights, email privacy@mekha.online from the email you signed up with. We reply within 30 days and may ask for more information to confirm you own the account.
Minors
People under 20 years old are minors under Thai law. Minors need parental consent before signing up. Parents can view, correct, or delete a minor's data under their care at privacy@mekha.online. If we learn an account belongs to a minor without consent, we may close it.
Data security
We encrypt connections, limit who can access data, and back up daily, but no system is completely secure. If a data breach risks your rights, we'll notify the PDPC within 72 hours of learning of it, and notify you when the risk is high.
Policy changes
When this policy changes materially, we'll announce it in game news and ask you again at your next login. The effective date and current version are shown at the bottom of this page.
Contact us
Personal data matters: privacy@mekha.online
General matters: support@mekha.online
Effective from 1 November 2569 · Version 1