Privacy Policy

Last Updated: October 8, 2026

Effective Date: October 8, 2026

Summary of Privacy Commitments

• We Protect Your Data: GameOct collects only the minimum information necessary to authenticate you, deliver features, and maintain platform security.
• We Never Sell Your Personal Information: We do not sell personal information for monetary consideration to data brokers.
• Advertising Transparency: When third-party advertising or analytics partners (including Google AdSense) are active, standard advertising cookies are utilized in accordance with transparent opt-out controls.
• Zero Raw Payment Storage: All financial transactions for OctCoins are processed by secure PCI-DSS compliant payment gateways. We never see or store your credit card or bank numbers.
• Your Rights: Under GDPR (EU/UK), CCPA/CPRA (California), and the DPDP Act (India), you have the right to access, export, correct, and permanently delete your data at any time via your account settings.
• No Under-13s: GameOct is strictly for gamers aged 13 and older. We immediately delete any accounts created by minors under 13.

1.0 Introduction & Scope

1.1 About GameOct. GameOct ("Platform", "we", "us", or "our") is an interactive gaming social media network providing discussion feeds, real-time community maps, search engines, and social recognition systems. This Privacy Policy details how we collect, store, process, transfer, and safeguard your personal data when you visit gameoct.com, use our progressive web app (PWA), or interact with our APIs.

1.2 Data Controller & Operator. The data controller responsible for personal information processed under this policy is GameOct, an independent digital platform operated by its founder in India. All formal privacy, data protection, and regulatory correspondence is managed electronically via gameoctofficial@gmail.com.

1.3 Global Compliance Framework. This policy is designed to comply with international privacy standards, including:

• The European Union General Data Protection Regulation ("GDPR") (Regulation (EU) 2016/679) & UK GDPR;
• The California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act ("CPRA");
• The Children's Online Privacy Protection Act ("COPPA") (15 U.S.C. §§ 6501–6506);
• The India Digital Personal Data Protection Act, 2023 ("DPDP Act") and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

1.4 EU & UK Representative Status (Statutory Exemption). GameOct operates as an early-stage digital community. Pursuant to Article 27(2)(a) of the EU GDPR and the equivalent provision of the UK GDPR, GameOct's data processing is occasional, does not involve large-scale processing of special categories of data under Article 9(1), and is unlikely to result in a risk to the rights and freedoms of natural persons. Accordingly, GameOct relies on this statutory exemption and has not appointed a commercial EU/UK representative. European and UK users may exercise all statutory data protection rights directly via our compliance desk at gameoctofficial@gmail.com or lodge complaints with their local Data Protection Authority.

2.0 Information We Collect

We collect information across three categories:

• Account Registration: Email address, authenticated account identifier, and display name provided through single sign-on providers (such as Google OAuth) or direct registration.
• Profile Data: Public username, bio (limited to 500 characters), profile avatar image, location tags, gaming platform handles, and matchmaking keywords ("Find Buddy" preferences).
• User-Generated Submissions: Posts, text discussions, comments, uploaded images (JPEG, PNG, WebP, GIF up to 8MB), upvotes, clickbait flags, and game coordinates submitted on interactive maps.
• Private Messages & Quick Chat: Text communications transmitted through direct messages or Quick Chat features. Private message content is retained during active account tenure, encrypted in transit and at rest, and accessed by automated moderation systems or authorized staff strictly when reported by a participant for abuse, harassment, or illegal conduct.
• Customer Communications: Correspondence, support inquiries, feedback submissions, and bug reports sent to our support channels.

B. Information Collected Automatically

• Device & Network Telemetry: IP address (used for city/country geolocation estimation and rate-limit defense, not GPS tracking), browser user-agent string, operating system version, and device type.
• Usage & Event Logs: Page navigation history, click streams, time spent on game modes, search queries within the GameOct search engine, award transactions, and interface interactions.
• Cookies & Local Storage: Essential session cookies, cookie consent choices, and client-side UI preferences (such as dark mode and active game mode filters).

C. Information Received from Third Parties

• Google OAuth: Account identifier, verified email address, profile picture URL, and name as permitted by your Google account permissions.
• Payment Processors & Merchants of Record: Transaction identifiers, payment timestamps, currency amounts, and order fulfillment statuses. We do not collect, process, or store raw credit card numbers, CVVs, or bank account details. Payment processing and billing operations are conducted by PCI-DSS Level 1 compliant processors and authorized Merchants of Record (such as Xsolla, Stripe, and PayPal) under their independent privacy frameworks.

3.0 Legal Bases for Processing (GDPR & International Standards)

We process your personal information only when we have a valid legal basis:

4.0 How We Use Your Information

We utilize personal data strictly for legitimate operational purposes:

1. Service Provision: Authenticating accounts, synchronizing feeds, serving interactive GTA 6 and game maps, and powering search engine queries.
2. Virtual Currency & Awards Engine: Recording OctCoin transactions, calculating balances, applying awards, and managing Verified Badges.
3. Media Delivery & Protection: Optimizing uploaded images via Cloudflare R2 and applying "Gameoct.com" visual watermarks to protect user submissions against unauthorized scraping.
4. Safety & Security: Enforcing server-side rate limits on posts, comments, and uploads, mitigating DDoS attempts, detecting multi-accounting, and maintaining administrative audit logs.
5. Community Moderation: Reviewing flagged clickbait posts, moderating abusive comments, and enforcing bans.
6. Platform Evolution: Analyzing aggregated, non-identifying telemetry to identify trending game topics and optimize mobile loading speeds.

5.0 How We Share Your Information

We share data strictly with the following authorized service categories and partners:

A. Infrastructure, Service Providers & Merchants of Record

• Supabase Inc. (USA): Cloud database infrastructure, Row-Level Security (RLS) enforcement, and server-side RPC functions.
• Cloudflare, Inc. (Global CDN): Distributed caching, DDoS mitigation, edge routing, and Cloudflare R2 object storage for user media.
• Google LLC (USA): Identity verification and single sign-on authentication via Google OAuth.
• Payment Processors & Merchants of Record (Xsolla / Stripe / PayPal): Payment authorization, order management, and tokenized billing execution.
• Third-Party Advertising Networks & Monetization Partners: We may partner with digital advertising networks, programmatic exchanges, and gaming monetization partners (including Google and authorized third-party ad vendors). These vendors use cookies, web beacons, and device identifiers to serve ads based on a user's prior visits to this website or other websites across the internet. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to GameOct and other sites. You may opt out of personalized advertising by visiting Google Ads Settings or through industry-wide opt-out mechanisms at www.aboutads.info and Network Advertising Initiative.

B. Public Platform Information

• Your username, avatar, bio, submitted posts, comments, received awards, and active verified badge status are public by design and visible to all platform visitors and search engines.
• When you upload an image, it is publicly accessible and watermarked with "Gameoct.com" attribution.

C. Legal Compliance & Harm Prevention

We may disclose personal information to competent judicial, administrative, or law enforcement bodies if required by applicable law, search warrant, court order, or subpoena, or when necessary to protect the life, safety, or property of GameOct users or the public.

D. Corporate Transactions

In the event of a merger, acquisition, restructuring, bankruptcy, or sale of company assets, user personal data may be transferred as an operational business asset, subject to standard confidentiality protections.

6.0 International Data Transfers

6.1 Cross-Border Architecture. GameOct operates a distributed global infrastructure. Data is processed in India, with cloud database and edge hosting provided by infrastructure partners located in the United States and global edge nodes (including Supabase, Cloudflare, and Google).

6.2 Standard Contractual Clauses (SCCs). For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, transfers of personal data outside the EEA are safeguarded pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46, accompanied by supplementary technical safeguards including end-to-end TLS encryption and database-level encryption at rest.

7.0 Cookies & Tracking Technologies

7.1 Cookie Types. We use cookies and browser storage technologies strictly as outlined below:

7.2 Managing Cookies. You may configure your web browser to reject or delete cookies. However, disabling essential session cookies will prevent login authentication and core platform operations.

8.0 Data Retention & Tombstoning

8.1 Active Accounts. Personal data is maintained as long as your account remains active.

8.2 Account Deletion & Tombstoning. When you delete your account via Profile Settings:

• Your profile record, email address, password hash, bio, and OAuth identifiers are permanently scrubbed from the active profiles table within thirty (30) days.
• To preserve conversation threads and map accuracy for the community, your submitted feed posts, comments, and map coordinates are anonymized ("tombstoned") by setting the author ID to NULL (displaying as "[Deleted User]").
• Audit logs containing IP addresses recorded for fraud prevention are retained for ninety (90) days, after which they are permanently purged.
• Financial transaction audit records (OctCoin purchases) are retained for seven (7) years to comply with statutory accounting and tax regulations.

9.0 Your Privacy Rights (GDPR, CCPA/CPRA, DPDP Act & Global)

A. European Economic Area & UK Users (GDPR Rights)

• Right to Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete profile data.
• Right to Erasure ("Right to Be Forgotten") (Art. 17): Request permanent deletion of your personal data.
• Right to Restrict Processing (Art. 18): Limit how we process your information under certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing carried out under legitimate interest grounds.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA) in your EU member state of residence.

B. California Residents (CCPA / CPRA Disclosures)

• Right to Know & Access: Request details regarding the categories and specific pieces of personal information collected, sources, and commercial purposes.
• Right to Delete: Request deletion of personal information, subject to legal retention exemptions.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Opt-Out of Sale / Sharing: GameOct does not sell personal information for monetary consideration. However, the deployment of third-party advertising cookies by network partners (such as Google AdSense) may constitute "sharing" under California CPRA for cross-context behavioral advertising. You may opt out of personalized ad targeting via Google Ads Settings, aboutads.info, or by enabling the Global Privacy Control (GPC) signal in your browser, which we automatically honor.
• Right to Non-Discrimination: We will not discriminate against you (in pricing or quality of service) for exercising your CCPA privacy rights.
• California "Shine the Light" Law: We do not disclose personal information to third parties for their direct marketing purposes.

C. India Residents (DPDP Act, 2023 Rights)

• Right to access a summary of personal data processed.
• Right to correction, completion, and erasure of personal data.
• Right of grievance redressal via our designated Grievance Officer.
• Right to nominate an individual to exercise rights in event of death or incapacity.

D. Exercising Your Rights

To exercise any privacy right, email our Data Protection team at gameoctofficial@gmail.com with the subject line "Privacy Rights Request." We will verify your identity via your registered account email and fulfill your request within thirty (30) calendar days.

10.0 Children's Privacy (Strict COPPA & DPDP Act Compliance)

10.1 Under-13 Prohibition. GameOct is strictly for users aged thirteen (13) and older. We do not knowingly solicit, collect, or maintain personal data from children under 13.

10.2 Immediate Remediation. If we discover that an individual under 13 has created an account or submitted personal data, we will immediately terminate the account, purge their personal data from our servers, and tombstone any public submissions. If you are a parent or guardian who believes your child has registered an account, contact us immediately at gameoctofficial@gmail.com (Subject: "Underage Account Report").

11.0 Technical Security Measures

We implement multi-layered enterprise security measures, including:

• Encryption in Transit: All traffic is enforced via HTTPS/TLS 1.3 with strict Transport Layer Security headers.
• Encryption at Rest: All database tables, Cloudflare R2 object stores, and backup volumes are encrypted at rest using AES-256.
• Database Isolation: Row-Level Security (RLS) policies implemented on Supabase ensure that users can only modify their own profile data, while sensitive role fields are protected by security-definer database triggers.
• Upload Sanitization: All user media uploads are verified via server-side magic byte inspection (blocking disguised executables), limited to 8MB, and sanitized before storage.
• Rate Limiting: Critical endpoints (posting, commenting, password attempts, feedback) are protected by rate limiters to prevent brute-force attacks and abuse.
• Data Breach Notification: In the event of a verified security incident affecting the confidentiality, integrity, or availability of personal data, GameOct will notify affected users without undue delay and notify competent supervisory authorities where legally required (such as within 72 hours under GDPR Article 33).

12.0 Do Not Track (DNT) & Global Privacy Control (GPC) Signals

We honor universal browser opt-out signals such as the Global Privacy Control (GPC) for applicable state privacy regimes. Because we do not sell personal data or engage in cross-context behavioral ad tracking, platform features operate consistently with GPC signals active.

13.0 Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological, legal, or operational developments. When revisions occur, we will update the "Last Updated" date at the top of this document and provide prominent notice via a platform banner or direct email notice at least fourteen (14) days prior to the effective date.

14.0 Grievance Officer & Data Protection Inquiries

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the details of the designated Grievance Officer are:

• Designation: Founder & Grievance Officer, GameOct
• Jurisdiction: India (Operating purely digital online services)
• Email: gameoctofficial@gmail.com (Subject: "[Grievance Officer]")
• Statutory Timelines: Grievances are acknowledged within twenty-four (24) hours of receipt and formally disposed of within fifteen (15) days. Grievances involving non-consensual imagery or impersonation are actioned within twenty-four (24) hours.