BlyatDrop Account Privacy Policy Version: account-2026-10-12-v1

1. Responsible service and contact The owner operating BlyatDrop at blyatdrop.com is responsible for the account information described in this policy. Contact the owner at [email protected] for account or privacy requests and complaints. The service name identifies BlyatDrop without asserting a registered company, a particular operating country or a licence. Crypto deposits and other available financial services have separate information in their applicable notices.

2. Account and security information For credential accounts, we store an account identifier, username, email address, password hash, email-verification status and relevant creation and security timestamps. Passwords are hashed for verification rather than stored as recoverable account passwords.

For configured Steam or Google sign-in, we process the provider's verified account identifier and available profile/display-name/avatar information. Google sign-in uses basic identity/profile/email permissions. The integration keeps the identity fields it needs and does not keep social access or refresh tokens as reusable player account credentials. Display-name or email matches do not themselves merge accounts.

We keep linked identities, recorded policy acceptance versions, adult declarations when actually supplied, session and recovery-token hashes, expiry and revocation records, and security/recovery events. Direct social sign-in does not create an invented declaration or consent record. Infrastructure and network providers can process IP addresses, requests and security information needed to deliver and protect the service.

3. Profiles, activity and account features Display names, provider avatars and avatars you upload can be shown publicly wherever the service displays your profile or activity. Uploaded avatars are processed into service image assets. Replacing an avatar changes the active profile; it does not promise immediate erasure of every cached or historical copy. Do not upload an image containing personal information you do not want public.

Authenticated activity, community messages and original opening/game command records can be stored to operate the corresponding available features, prevent duplicate execution and recover interruptions. A Play-money result is separate from a paid financial entitlement. Public activity projections contain the fields the feature displays rather than player credentials or private provider evidence. Support emails contain the information you choose to send.

Administrator records, if administrator access is granted, include roles, authenticator-enrollment information, recovery credential hashes, session/MFA events and audited actions. Sensitive authenticator data is encrypted. The owner's authorised option to import their own existing authenticator entry retains BlyatDrop's independent encryption, account authority and replay checks; it does not import RustSnowball player accounts or balances. Administrator secrets are not public activity data.

4. Purposes We use account information to create and authenticate accounts, verify and link sign-in methods, record actual acceptance and declarations, provide available profile/community/account features, recover original operations, protect access, investigate abuse or disputes, handle support requests and meet applicable legal obligations. Configured account email can support verification, recovery or security notices when its sender is available. An email configuration or policy publication is not a claim of completed email delivery. We do not treat a social identity or account declaration as independent financial eligibility verification.

5. Cookies and browser storage Operational cookies bind sessions and authentication requests. Production session credentials are held in Secure, HttpOnly cookies. Browser storage can keep preferences such as favourite cases, the selected balance view, and original operation references or temporary pending receipt state needed for recovery. Clearing storage can remove a locally saved reference or preference; it does not cancel an accepted server operation or delete server records.

Use sign-out and available session-revocation controls to end account access. Cloudflare and other delivery infrastructure have their own security and operational processing. This account policy covers the service's operational uses; any separately introduced optional tracking or marketing requires its applicable disclosure and choices.

6. Providers and disclosure BlyatDrop uses its independently configured VPS/database and backup arrangements, Cloudflare for domain/security delivery, Steam/Valve and Google for their available authentication functions, and Zoho for the contact mailbox. The account email integration uses AWS SES when its sender is configured, enabled and available. The fact that a provider is named does not claim that every optional service is active. Payment and fulfilment providers, where available, are described in the relevant separate notice.

Providers receive information according to their function. Internal access is restricted by account/session and administrative roles. Relevant records may be used or disclosed when lawfully required or to investigate abuse and protect legitimate legal rights. Providers can operate internationally, and processing can occur outside your country. This policy does not claim an unverified location for all processing or backups, or an unverified transfer agreement. Contact [email protected] for questions about a particular provider or processing request.

7. Retention, corrections and security Account, identity and security records are kept to operate the account, protect access, handle recovery and disputes, and preserve outstanding or applicable legal obligations. Tokens have limited lifetimes and are invalidated when used or revoked as their flow requires. Policy acceptance, audit and financial history can remain immutable through normal application operations. Encrypted backups preserve recovery history and can contain older records.

There is no automatic promise to delete all records when you sign out or stop using the service. The owner reviews retention and deletion requests individually, including what can be changed in the active service and what must remain for an outstanding operation, investigation, financial history or applicable obligation. No fixed deletion deadline for all categories or immediate removal from every backup is promised. Incorrect financial history is corrected by an attributable adjustment rather than silently rewriting an original journal.

Credential hashing, encryption for sensitive administrative/mail payloads, session checks, limited roles and audit records protect account information. No online service can guarantee absolute security.

8. Requests, age and complaints Email [email protected] for access or correction, to ask about deletion or retention, or to raise a privacy concern. Include enough account information to identify the request. The owner may request proportionate proof that the account or information is yours; never send passwords, authenticator secrets, recovery codes or private keys. The owner reviews the request, explains available action and any records that must remain, and handles the rights and response requirements applicable to that request. This does not remove your right to contact an applicable regulator or complaints authority.

Accounts are intended for adults aged 18 or over. A declaration is not independent age verification. Tell [email protected] if you believe a child supplied information so the owner can investigate and take appropriate action.

9. Changes and consent The effective version is made available for the relevant account flow. Material changes are made available prospectively and new acceptance is requested where needed. Historical acceptance retains the original policy versions. Publication does not create an acceptance record for an existing or future player, and acceptance on RustSnowball does not substitute for BlyatDrop acceptance.