GOLDENOT · Privacy and cookies
Your privacy at GoldenOT
Updated October 13, 2026 · version 1.0
This information covers the website and Live Store for Goldera, Lunara and Nadira. You can browse and read this policy without creating an account.
What we use and why
Session cookies identify your access, protect forms and let you view your account. The language preference only controls website presentation. The cookie notice does not authorize advertising, link a Twitch account or accept purchase terms.
Cookies and browser storage
The table below describes our own cookies. No button on this page disables the controls needed to protect sign-in. You can delete or block cookies in your browser settings; blocking session cookies prevents persistent sign-in. Local interface preferences and pending Live Store requests may also be stored in this browser to restore the interface and avoid resending a purchase as a new order. Clearing this data does not delete orders already recorded on the server.
| Resource | Purpose | Duration |
|---|---|---|
| MWSESSID_* | Session and access protection | Session cookie; the server also controls access validity. |
| go_language | Remember Portuguese, English or Spanish | Up to 1 year; change it with the flags or remove it in your browser. |
| go_cookie_notice | Remember that you dismissed this notice | Up to 180 days; stores the notice version, without an account identifier. |
| Temporary authentication cookies | Securely complete a sign-in or link you started | Short flow lifetime; expire or are removed when completed. |
Cloudflare and security
Cloudflare receives website connections to filter attacks, deliver files and forward allowed requests. This involves technical data such as IP address, time, requested address and connection characteristics. Cloudflare verification cookies may be used when protection requires them. They do not replace your GoldenOT sign-in. Provider infrastructure may process data outside Brazil.
Live Store and Twitch
Connecting Twitch is a separate action authorized on Twitch itself. We use the linked account identifier, name and profile image to display the connection. For streamers who authorize their channel, we read the chat participant list; sending messages is not required to appear on that list. We match eligible participation with character presence to record time, coins and rewards. Chat presence does not prove video playback.
Authorizations and history
Twitch authorizations required for the integration are protected on the server and may be refreshed while the link remains valid. You can unlink Twitch or disconnect your channel in the Live Store and revoke access in Twitch settings. Unlinking stops new credits through that link; existing balance, milestones and orders are preserved. Delivery and security records help resolve failures and prevent duplicates.
Advertising and external services
This version adds no advertising cookies or audience tracker. Links to Twitch, Discord, Google and other services open environments with their own policies. If GoldenOT introduces optional uses that require consent, a choice must appear before activation, with accessible rejection and withdrawal. Clicking “Got it” only dismisses this notice.
Retention and your requests
An identity link is kept while it exists. Account, purchase, reward, security and backup records have different purposes; unlinking a provider does not automatically erase them. To learn about data use, request correction or deletion and clarify retention for your account, contact private support through the official channel below. The team verifies ownership and explains what can be deleted or must be retained, and why. Never share passwords or codes in public channels.
Details of sign-in with Google, Discord and Apple
Updated on 5 October 2026. This page describes data use when signing in or creating a GoldenOT account with Google, Discord or Apple.
Data received and its purpose
With your permission, we receive a user identifier from the provider and, when available, your email address and confirmation that it is verified. We use the identifier to recognize the link to your GoldenOT account. At registration, the verified email becomes the new account's contact and recovery address. GoldenOT does not receive your Google, Discord or Apple password.
Sign-in requests only identity and email. It does not request messages, contacts, Discord servers, Google files or iCloud data. Authentication data is not sold or used by social login for advertising.
Google: which data is used
GoldenOT Login uses Google's identity and email permissions (openid and email). The response lets us verify the Google Account identifier, email address and whether that address is verified. These data are used to create the game account, recognize future sign-ins and allow account recovery. Sign-in does not use Gmail, Drive, Calendar or other Google Workspace APIs.
Discord's identify and email permissions serve the same authentication purpose. Sign-in uses the identifier and email; the provider's photo and display name are not used to create your character. You choose your character name in GoldenOT.
Linked providers and accounts
Matching emails or names do not automatically link accounts. To add a provider to an existing account, sign in to that account and confirm a recent sign-in through the provider or your password. The authenticator remains required when enabled. Archived accounts are not recovered through social login.
A new social account automatically receives a GoldenOT identifier and does not require creating a password. Authentication is handled by the chosen provider. Traditional account-name and password sign-in remains available for accounts with a password.
Storage and security
We store the provider, its identifier, the linked GoldenOT account and the link date. We retain these data while the link exists. Information needed to complete sign-in stays temporarily in the session. Tokens used to communicate with the provider are not stored in the database as permanent credentials.
Session cookies maintain sign-in and protect forms. IP addresses, timestamps and technical records may be processed to limit attempts and investigate security issues. OAuth callback codes are not recorded in authentication endpoint access logs.
The website communicates with providers over HTTPS. Authentication forms and callbacks validate against forged requests, and administrative server access is restricted. Provider credentials stay on the server, outside files distributed in game clients.
Client use and access duration
When you sign in through the client, approval takes place in the browser. A pairing request lasts five minutes. After approval, the client keeps a session in memory for up to one hour; closing the client requires new authorization. Your Google or Discord password is not sent to the game client.
Authorization to enter a world lasts 30 seconds. Signing out invalidates the central session and prevents new authorizations; an already-issued authorization retains its short validity period. Expired pairing, session and world-entry records are removed periodically.
Compartilhamento dos dados
Sign-in data is processed on GoldenOT servers to authenticate your account and allow access to Goldera, Lunara and Nadira. Hosting infrastructure stores these records. When you request a recovery email, the email delivery service processes the address and message needed to send it.
The chosen provider participates in authentication and processes that communication under its own policy. The team may access records needed for support and account security. Social login does not publish your email or provider identifier in rankings or character pages, sell them or share them for advertising. Data received from Google is not used to train artificial intelligence models.
Retention and deletion
The record linking your provider identifier to the GoldenOT account is retained while the link exists. Unlinking removes that association from the active database. The registration email belongs to the game account and is not automatically deleted when a provider is unlinked. Characters and game records are also independent of that link.
To request deletion of account data, use the private support channel below. The team must verify ownership and the request's scope. Removing a link from the active database does not immediately erase existing backups. Security records and backups are maintained separately; support will explain any data that must be retained and why, as applicable.
Your choices
You may continue using password sign-in, revoke authorization with the provider or remove the link in Sign-in methods. You must keep a usable sign-in method. Unlinking does not delete characters, purchases or other game account data.
When Apple sign-in is available, Apple may provide a private forwarding address. You control forwarding in your Apple account settings.
Contact and data requests
To request information, correction or deletion of data, contact the team through the comunidade oficial GoldenOT no Discord and ask for private support. The team may need to verify account ownership. Do not post passwords or authentication codes in community channels.
Providers also process data under their own policies: Google, Discord e Apple.
Language choice
On your first visit through the home page, we use your browser’s preferred language from Portuguese, English and Spanish. Your manual choice takes priority and is stored in the go_language cookie for up to one year, including authentication returns. Language-specific links are respected. We do not use IP geolocation for this, and this cookie does not grant account access. You can change the language using the flags or remove the cookie in your browser.
Language addendum: 10 October 2026.