This policy explains what information Monster Fusion Masters Online (the "Service") actually collects and how it is used. By registering or continuing to use the Service, you acknowledge this policy.
1. INFORMATION WE COLLECT
- Account data: PLAYER ID, email address, account status, and account creation and update times.
- Login and abuse-prevention data: salted password hashes, login sessions, registration and login attempt times, country and network metadata supplied by the hosting platform, and keyed network-address-derived identifiers used to prevent brute-force attacks and correlate possible abuse without storing the raw address for this feature.
- Game and fair-play data: seasons, wins, losses, games played, rankings, room and connection status, completed match records, and limited risk-signal summaries generated from unusual login, connection, matchmaking, or game-action patterns.
- Support and moderation data: the contact email, PLAYER ID, problem description and administrator notes submitted through the HELP form, plus account suspension, restoration, and risk-review history when moderation is required.
Passwords are never stored in plain text, and administrators cannot view an original password. An administrator can only issue a temporary password. A password reset invalidates existing login sessions.
2. WHY WE USE THIS DATA
We use this information to create and secure accounts, keep players signed in, operate rooms and human matchmaking, calculate seasonal records, answer account requests, detect and review possible abuse or ranking manipulation, maintain the Service, and create recovery backups. Automated risk signals are used to prioritize administrator review and do not automatically suspend an account. Processing is limited to what is reasonably necessary to provide and protect the Service, manage the user relationship, and comply with applicable law.
3. BROWSER STORAGE AND TRACKING
The Service uses localStorage or sessionStorage to keep login tokens, room recovery information, and administrator sessions, and IndexedDB to keep player replays that you choose to save on this device. These local replay copies stay in this browser and are not uploaded by the current player replay feature. The Service currently does not use advertising trackers and does not use collected email addresses for marketing messages.
4. HOSTING, SERVICE PROVIDERS, AND INTERNATIONAL PROCESSING
The Service uses Cloudflare Workers, Durable Objects, D1, and static asset hosting to run the site and store data. Information may be processed through Cloudflare's global infrastructure. We do not sell personal information or disclose it except when reasonably necessary to provide and secure the Service, meet legal obligations, or protect rights and safety.
5. RETENTION AND BACKUPS
Account and game data are generally kept until an account is permanently deleted or the administrator clears the relevant records for operational reasons. A player account may be suspended while its account and game records are retained, or disabled and placed in PLAYER TRASH so it can be restored before permanent deletion. Risk signals are time-limited for active scoring; ignored or expired signals and moderation history may be retained for a reasonable period to document reviews and prevent repeated abuse. Support requests may be archived after handling and later deleted by the administrator. Administrators can download readable JSON data copies that exclude password hashes, password salts, login sessions, network fingerprints, risk signals, and moderation history. These data copies are not complete database backups and cannot restore login credentials.
Permanent account deletion operates only on accounts in PLAYER TRASH. It removes the account and linked ranking, match, session, replay, tutorial and moderation records, plus server Master AI records identified by that account ID. It clears matching structured account references in HELP and risk evidence. HELP requests and free text are retained; contact email is replaced only when both the matched account and its current email agree. Ownership conflicts, free text and other unstructured references require manual review. This operation does not erase downloaded copies, other players' local replays or provider backups.
JSON restore requires every backup account to still exist with matching PLAYER ID, creation time and email. If any identity is missing or different, the whole restore is rejected; it does not rebuild accounts in an empty database. Current HELP requests stay unchanged and HELP entries in JSON are not imported. Downloaded copies can still contain older data; full disaster recovery requires a separate controlled process.
6. YOUR CHOICES AND RIGHTS
You may request access to, a copy of, correction of, restriction of, or deletion of information associated with you. Submit a request through the lobby HELP tab and provide a reachable email address. If information required to operate an account is deleted, the account, ranking, or matchmaking functions may no longer be available.
HELP is a private intake form for account recovery, moderation appeals, privacy requests and account termination. Requests and internal administrator notes are accessible through authenticated administration, not a public case list. Keep the request ID shown after submission. Do not include passwords or unrelated sensitive information.
The administrator handles requests manually, checks identity or authority as appropriate, and replies through an appropriate verified email channel. A matching PLAYER ID or email alone does not prove ownership. Submission, saving an internal note, resolving or archiving a request does not send an email. Explain the information or outcome you seek; access or copies must be limited to information you are entitled to receive, with other players' and security information protected. If a request cannot be fully completed, the response should explain the scope, remaining steps or applicable retention reasons.
7. DATA SECURITY
We use password hashing, rate limiting, session invalidation, keyed network identifiers for abuse correlation, administrator authentication, and data-minimized backups. No online system can guarantee absolute security. If a confirmed data incident may affect you, we will take appropriate response and notification steps as required by applicable law.
8. CHILDREN
If you are below the age at which you may independently consent to online services in your location, obtain permission from a parent or legal guardian before using the Service. Do not include unrelated sensitive information in a support request.
9. CHANGES AND CONTACT
Material changes will update the effective date on this page and may be announced in the Service when appropriate. For privacy or account questions, use the HELP / RECOVERY REQUEST form in the lobby.
You may also consult Taiwan's official Personal Data Protection Act.