Privacy Policy
Last updated: 25 October 2026
This Privacy Policy explains how Countdown Studio ("we", "our", or "the service") collects, uses, stores, and protects personal information when you use the website at countdown-studio.id.vn. By creating an account or using the service, you agree to the practices described in this policy.
1. Information We Collect
- Account data: When you register, we collect your username, email address, display name, and a securely hashed password (using the scrypt algorithm with a random salt). We never store your password in plain text.
- Google OAuth data: If you sign in with Google, we receive your Google account ID, email address, display name, and profile picture URL from Google. This information is stored to link your Google account to your Countdown Studio account.
- Career statistics: For Individual accounts, we store gameplay statistics (round results, scores, session history) to power the career progression feature. This data is tied to your account and stored in our PostgreSQL database.
- Server logs: Our server records IP addresses, request paths, HTTP status codes, and timestamps for security monitoring and abuse prevention. These logs are retained for up to 30 days.
- Session tokens: We issue a JWT-signed session token with a 7-day TTL on login. This token is stored in your browser and sent with authenticated requests. It contains only your internal user ID and expiry time — no personal data.
2. How We Use Your Information
- To authenticate you and grant access to features permitted by your account role.
- To display your username and display name in the game interface.
- To store and retrieve your career statistics across sessions.
- To detect and prevent brute-force login attempts via IP-based rate limiting.
- To respond to support requests submitted via email.
3. Data Sharing
We do not sell, rent, or share your personal data with third parties for marketing purposes. Your data may be processed by the following service providers solely to operate the service:
- Render.com — Hosting and database infrastructure.
- Google LLC — If you use Google OAuth, Google processes your sign-in credentials. See Google's Privacy Policy.
- Google Fonts — Font files are loaded from Google's CDN. Google may log requests per their privacy policy.
4. Data Retention
Account data is retained for as long as your account exists. Career statistics are retained as part of your account. Server logs are retained for up to 30 days. If you request account deletion, we will remove your personal data within 30 days of the request.
5. Security
Passwords are hashed using scrypt before storage — we cannot recover your password. All connections are encrypted via HTTPS with HSTS enforced. Session tokens use HMAC-SHA256 signatures. Failed login attempts are rate-limited and accounts are temporarily locked after 5 consecutive failures.
6. Your Rights
You may request access to, correction of, or deletion of your personal data at any time by emailing support@countdown-studio.id.vn. We will respond within 30 days. We do not currently operate in EU/EEA jurisdictions, but we follow reasonable data-protection practices consistent with international norms.
7. Cookies
Countdown Studio does not use tracking or advertising cookies. The service stores your session token in browser memory or localStorage only for authentication purposes. No third-party analytics cookies are used.
8. Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top of this page will reflect the date of the most recent change. Continued use of the service after a policy update constitutes acceptance of the revised policy. Significant changes will be communicated via the email address associated with your account.
9. Contact
Questions about this Privacy Policy should be directed to support@countdown-studio.id.vn. See our Contact page for full support options.