Privacy Policy
Effective date: 13 September 2026
AvatarStar-Web operates the Avatar Star website and multiplayer browser game. This policy explains how we handle information when you visit the Launcher, sign in or play. Contact us at [email protected].
1. Information we process
- Sign-in information. When you choose Sign in with Google, Google supplies an identity token that may contain your Google account identifier, name, email address and profile image information. We use the platform account identifier (Google’s sub identifier) and name to create or find your game account; it does not separately save Google email or profile images as account fields. CrazyGames supplies its user identifier, username, game identifier and token. We verify sign-in credentials and retain the platform-to-game-account association.
- Registered accounts. When account registration is enabled, we store your username, a salted password hash and the registration time. We do not store the submitted password in plaintext.
- Game and operational data. We process your game account and character identifiers, character and progression data, game activity and features you use, content you submit through available social or support functions, connection addresses, login times, errors and diagnostic events. This supports gameplay, saving progress, troubleshooting and protection against abuse.
- Browser storage. The Launcher stores your language preference locally. Game resources may be cached in your browser. Sign-in sessions and short-lived entry tickets enable access to the game. The administrator interface uses a session cookie; it is separate from player accounts.
Google and account/password sign-in use a necessary HttpOnly login cookie, valid for one hour with the current configuration. It lets the game obtain a fresh entry ticket after a page refresh. Page scripts cannot read this cookie; signing out revokes its session.
2. How information is used
We use this information to authenticate users, maintain accounts and game progress, operate multiplayer and social features, diagnose problems, protect the service, and respond to support or privacy requests. Google account information is used for sign-in and account identification, not for advertising profiles. We do not sell Google user data.
3. Third parties and disclosure
Google processes sign-in interactions under its Privacy Policy. When you use the CG version, CrazyGames processes SDK and platform interactions under its Privacy Policy, including any advertising features you use there. Following enabled Discord, Facebook or TikTok community links takes you to those services, whose own policies apply. These services may use their own browser storage.
Our game, login, storage and operational services process information to deliver this service. Access is limited to service operation, support and security needs. We may disclose information where required by applicable law or necessary to address abuse and protect users. If you contact us by email, your message and contact details are processed to handle the request.
4. Retention and deletion
Player login sessions currently expire after one hour and unused game-entry tickets after fifteen minutes; entry tickets can be consumed only once. Account, game and operational records do not disappear when you sign out. We retain them for providing the service and handling support, security and legal obligations; there is currently no single automatic deletion period for all records.
You may request access, correction or deletion by contacting [email protected]. Provide your sign-in method and game account or character identifier, but never send passwords or tokens. We will verify account ownership before acting. We will explain any information that must be retained and why. You can review or remove the connection in your Google Account connections. Removing Google authorization does not automatically erase an existing game account or end an existing game session. Sign out to end the login session and contact us separately to request account deletion. Browser preferences and cached assets can be removed through your browser settings.
5. Security, minors and changes
Public sign-in connections use HTTPS, registered passwords are hashed, and game-entry credentials are short-lived. No system can guarantee complete security. If local law requires a parent or guardian's permission, obtain it before using the service. A guardian can contact us about a minor's information.
We will update this page when our practices change and provide additional notice where appropriate. Changes to the use of Google data will be disclosed before that new use begins, with consent where required. Questions and privacy requests: [email protected].
隐私政策
生效日期：2026 年 9 月 13 日
Avatar Star 网站与多人浏览器游戏由 AvatarStar-Web 运营。本政策说明您访问登录页面、登录账号和游玩时，我们如何处理信息。联系邮箱：[email protected]。
1. 我们处理的信息
- 第三方登录信息：当您选择 Google 登录时，Google 提供的身份凭证可能包含账号标识、姓名、邮箱与头像信息。我们使用平台账号标识（Google 的 sub 标识）和姓名创建或查找游戏账号，不将 Google 邮箱或头像另存为账号字段。CrazyGames 提供用户标识、用户名、游戏标识与凭证。我们验证凭证，并保存平台身份与游戏账号的关联。
- 自行注册的账号：开放注册时，我们保存用户名、加盐密码哈希及注册时间，不以明文保存提交的密码。
- 游戏与运行数据：包括游戏账号和角色标识、角色与进度、游戏活动和功能使用情况、您通过已开放的社交或客服功能提交的内容、连接地址、登录时间、错误及诊断事件，用于游戏运行、保存进度、排障和防止滥用。
- 浏览器存储：登录页在本地保存语言偏好，游戏资源可能缓存在浏览器中。登录会话和短期入场票据用于访问游戏。管理员后台使用独立会话 Cookie，与玩家账号分开。
Google 和账号密码登录使用必要的 HttpOnly 登录 Cookie，当前配置有效期为一小时，用于刷新游戏页后申请新入场票据。页面脚本无法读取该 Cookie，退出登录会撤销对应会话。
2. 信息用途
我们使用上述信息验证身份、维护账号和进度、提供多人游戏与社交功能、排查问题、保护服务，并处理客服及隐私请求。Google 账号资料用于登录和账号识别，不用于广告画像；我们不出售 Google 用户数据。
3. 第三方与信息披露
Google 按其隐私政策处理登录交互。使用 CG 版本时，CrazyGames 按其隐私政策处理 SDK 和平台交互，包括您在该平台使用的广告功能。点击已开放的 Discord、Facebook 或 TikTok 社区链接后将进入对应服务，其自身政策适用。这些服务可能使用自己的浏览器存储。
游戏、登录、存储和运维服务会为提供本服务处理信息；访问限于服务运行、支持和安全需要。我们可能依法披露信息，或为处理滥用、保护用户采取必要措施。您通过邮件联系我们时，邮件内容及联系信息将用于处理请求。
4. 保存与删除
当前玩家登录会话有效期为一小时，未使用的入场票据有效期为十五分钟，入场票据仅能消费一次。退出登录不会删除账号、游戏或运行记录。我们为提供服务、处理支持请求、安全问题及法律义务保留必要记录，目前没有适用于全部记录的统一自动删除周期。
您可通过 [email protected] 申请访问、更正或删除信息。请提供登录方式及游戏账号或角色标识，不要发送密码或 token。处理前我们会核实账号归属；如需保留某些信息，会说明范围与原因。您可以在 Google 账号的第三方连接中查看或移除关联。撤销 Google 授权不会自动删除已有游戏账号，也不会自动结束已有游戏会话。请退出登录以结束登录会话，并另行联系我们申请删除账号。语言偏好和资源缓存可通过浏览器设置清除。
5. 安全、未成年人及更新
公开登录连接使用 HTTPS，自注册密码以哈希形式保存，游戏入场凭证短期有效。任何系统均无法保证绝对安全。如果当地法律要求监护人同意，请先取得同意再使用服务；监护人可联系我们处理未成年人信息。
信息处理方式变化时，我们会更新本页，并在适当情况下另行通知。Google 数据的新用途将在开始使用前披露，并在需要时取得同意。问题及隐私请求请联系：[email protected]。