Privacy policy
Last updated:
Contents
This page explains what data Phố Hội collects, what it is used for, where and for how long it is kept, and what your rights are. Phố Hội is in a closed alpha, by invitation only.
Who is responsible for the data
Phố Hội is run by EvUp Teams, an individual. The operator decides the purposes and the means of the processing of personal data described here.
Contact about personal data: privacy@phohoi.app.
The data we collect
When you sign in
- Your email address. Used to send you a six-digit sign-in code and to recognise your account. The code is stored hashed and works for five minutes.
- When you sign in with Google: the name, the email address verified by Google and the profile picture of your Google account. The access tokens Google issues are stored encrypted.
- The check against automated bots: before a code is sent, your browser is checked with the Turnstile service of Cloudflare; your IP address is sent with it for the check.
When you play
- Your character: its name, the gender chosen when you create it (fixed for the account), its outfit, your language.
- Game data: your wallet and the record of every money movement, your bag, licences, stamps, quests, titles and settings.
- Other players: friend requests, your friends list, your block list, and reports you send or receive.
- Chat and wishes: the text of messages (private ones too) and of the wishes on lanterns, with the result of the filter.
Technical data
- The IP address and browser information (user agent) of each sign-in session.
- Security records: IP addresses in anti-abuse records, in the money records and in the log of administrator actions.
- Server logs: each request to the server is logged with its IP address and request headers; cookies, credentials and email are hidden.
- Rate-limit counters: your IP address is used for a short time in memory to block too many requests; the counters delete themselves after at most about an hour.
Cookies and browser storage
- One sign-in session cookie (readable only by the server, sent only over a secure connection), which ends after seven days without use.
- Browser storage keeps your choices such as language, picture quality, sound and the channel you picked.
- No advertising cookies.
Visit statistics
When turned on, this site and the game page use the visit statistics of Cloudflare. They use no tracking cookies.
What we use the data for
- To sign you in and keep you signed in.
- To run the game: characters, money, items, activities and chat.
- To keep it safe: against cheating and spam, with rate limits, and by blocking accounts that break the rules.
- To handle reports and complaints, and to answer you when you contact us.
We do not sell personal data, do not use data for advertising, and there is no advertising in the game.
Who sees your data
- Other players (signed in) see your character name, title and outfit. Your in-game profile (lanterns floated, collection, join date, licences) is public to players by default; you can turn it off under Privacy in the Settings. Profiles are not shown to people who are not signed in. Your email is never shown to other players.
- Administrators can see your email, your recent sign-in sessions with their IP address and browser, the action logs, and the text of reported messages or wishes, to keep the game safe. Every administrator action is logged.
Processors and where the data is
| Who | What for | Where |
|---|---|---|
| A virtual server provider | Runs the game servers and the database | Singapore |
| Cloudflare | Serves the website, forwards connections to the server, checks against bots, visit statistics | The global network of Cloudflare |
| Sign-in with Google, when you choose it | Google’s systems | |
| A mail delivery provider | Sends the mails with sign-in codes | Depends on the provider |
The game page loads its fonts from Google’s font service, so your browser connects to Google when you open the game page. This website does not.
Since these parties are outside Vietnam, your personal data is transferred abroad for processing.
How long data is kept
| Data | Kept for |
|---|---|
| Sign-in codes | Expire after five minutes, deleted within an hour |
| Sign-in sessions (with IP, browser) | Until the session ends |
| Chat messages | About 30 days; blocked or reported ones: about 180 days |
| Anti-abuse records | 90 days |
| Closed friend requests, read notices | 90 days |
| Account, character and game data | As long as the account exists |
| Money records, administrator action log | Kept long term, for the safety and fairness of the in-game economy |
| Server logs | No fixed automatic deletion yet |
Your rights
Under the Law on Personal Data Protection No. 91/2025/QH15 you have the right to be informed, to consent or withdraw your consent, to access, to correct, to ask for a copy, to ask for deletion, to restrict or object to the processing, to complain, to sue and to claim damages.
How: email privacy@phohoi.app from the email address of your account, saying what you are asking for. We answer within the time limits set by Decree 356/2025/NĐ-CP.
The game has no self-service account deletion or data download yet. For a request to delete or to receive your data, we will answer and tell you what can be done.
Withdrawing consent
You can withdraw your consent at any time by email to the address above. Withdrawing does not affect processing done before. Because the game cannot be played without an account, withdrawing consent for the sign-in data means you stop playing.
Children
People under 16 need the consent of a parent or guardian before playing. For a child aged 7 or over, the consent of both the child and the parent or guardian is needed where the law requires it. A parent or guardian can contact the address above to ask about their child’s data or to ask us to stop processing it.
Protecting data
Connections are always encrypted. Sign-in codes are stored hashed, and Google’s access tokens are encrypted. Administrator rights are checked on the server and every administrator action is logged.
If personal data is breached, we will notify the competent authority under the Law on Personal Data Protection No. 91/2025/QH15 within the legal time limit, and notify the people affected when needed.
Changes
When this policy changes, we update this page and the date at its top.