Privacy Policy
This policy explains what personal data Monia Online (the game) and monia-online.com (this website) collect, why, who sees it, how long it is kept and what you can do about it. It is written for Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who we are
Monia Online is made and run by Megamite Lab ("we", "us"), the data controller for the personal data described here. Megamite Lab is operated by Pittawat Sommai.
Contact for anything in this policy: [email protected]. As a small studio we have not appointed a Data Protection Officer (DPO); send every question or request about personal data to this address.
2. What we collect
Your account
- Guest account: a random account name (like "Guest-123456") and a secret code kept in your device's secure storage. We keep only a scrambled (hashed) form of the secret. To limit abuse we also receive an identifier of your app install when a guest account is made.
- Username account: your username and password. We store the password only as a one-way hash, never in readable form.
- Sign in with Google: Google's identifier for your Google account and the email address Google shares with us.
- Sign in with Apple: Apple's identifier for you, the email Apple shares (it may be a private relay address, or none), and a token Apple gives us so we can revoke the app's access when you delete your account.
- Session and "remember me" tokens that keep you signed in.
Your play
- Your characters: names, looks, jobs, levels, items, gold, pets, progress, monster collection, achievements and titles, and saved copies of them (see section 6).
- What you do with other players: parties, trades, Market and Exchange listings and purchases, mail, duels and Arena results, your block list.
- Your diamond balance and its history, coupon codes you redeem, and your Premium status.
Purchases
Payments are made through the Apple App Store or Google Play. We receive the purchase record (the product, the store's transaction id and dates, renewals and refunds) so we can deliver what you bought. We never receive your card or bank details.
Chat, reports and support
- Zone and party chat messages, kept so staff can act on reports and on abuse.
- Reports you make or that are made about you, with a copy of the chat around them.
- Emails you send to support and our replies.
Technical data
- At each sign-in: your IP address, a hashed identifier of your app install, the app version, platform (for example iOS), OS version and game content version.
- Error and crash reports the app sends automatically when something goes wrong: the error message, where in the app it happened, the last lines of the app's log, the screen you were on, versions, and your IP address and install identifier. We built this ourselves; no third-party crash or analytics service receives it.
- Signals of cheating, for example requests that an unmodified app never sends.
We do not use advertising identifiers, show ads, sell personal data, or use third-party analytics or tracking in the game or on this website. We do not collect your precise location, contacts, photos, camera or microphone.
3. Why we use it
| Purpose | Data | Legal basis (PDPA) |
|---|---|---|
| Run your account and the game, save your progress | Account, play | Contract (to provide the service you asked for) |
| Deliver purchases, handle refunds, keep accounting records | Purchases, diamond history | Contract; legal obligation |
| Keep the game fair and safe: stop cheating, fraud, account theft and abuse; moderate chat and names | Technical data, chat, reports, play | Legitimate interest |
| Fix bugs and crashes, keep the servers running | Error reports, technical data | Legitimate interest |
| Understand how players use the game so we can improve it, for example daily players and play time (our own statistics, never shared with third parties) | Days you play, play sessions, play | Legitimate interest |
| Answer your support requests | What you send us, account | Contract; legitimate interest |
| Meet legal requests | As required | Legal obligation |
We do not make decisions about you by automated means alone. Cheat detection only flags accounts; a staff member reviews before any action.
4. Who we share it with
- Other players see your character's name and look, your chat, and your Market listings.
- Apple and Google, when you sign in with them or buy through their stores. Their own privacy policies apply to what they collect.
- OVHcloud, which hosts our game servers and database (Singapore).
- Cloudflare, which stores our database backups and the game's downloadable content (R2), serves this website, and provides DNS and network protection.
- Our email provider, which receives and stores the emails sent to [email protected] and our replies.
- Authorities, when the law requires it.
These providers process data only to run their service for us. We do not sell or rent personal data.
5. Where it is stored
The game's servers and database are in Singapore (OVHcloud). Backups and game content are stored with Cloudflare, whose network spans many countries. Apple and Google process data in their own facilities worldwide. Where data leaves Thailand we rely on the protections the PDPA allows for such transfers, including the providers' contractual commitments.
6. How long we keep it
| Data | Kept |
|---|---|
| Account and characters | While the account exists; see "Deleting your account" |
| Chat messages | 30 days |
| Sign-in records (IP, device, versions) | 90 days |
| Error and crash reports | 30 days |
| Cheat signals | up to 30 days |
| Saved copies of characters (to undo mistakes or cheating) | 48 hours (hourly), 30 days (daily), 60 days (at an update), up to 90 days (made by staff) |
| Database backups | up to 30 days; the point-in-time recovery archive about 14 to 21 days |
| Purchase and diamond records, trades, Market history, reports and moderation actions | Kept for accounting, fraud prevention and the game's integrity; after an account is deleted they no longer identify you (section 7) |
Deleted data can remain in backups until those backups expire, after which it is gone.
7. Deleting your account
In the game: Settings > Account > Delete account. You can also email us (see Support). Deletion happens 7 days after you ask; until then you can sign in and cancel it. After 7 days:
- Deleted: every way to sign in (username and password hash, guest secret, Google and Apple identifiers and emails, Apple's token, which we also revoke with Apple), sessions, sign-in records (IP, device, versions), your block list, your chat messages, saved Market searches, and your characters' name history.
- Blanked: each character's name and the account name, the account details on error reports (with their IP and device), and your name on Market and coupon records.
- Kept without your identity: records needed for the game's economy and fair play, such as purchase and diamond history, trades, Market history, duel results, item serial numbers, player reports and staff actions. They remain linked only to an empty account number.
Characters, items, diamonds and Premium time are lost for good. A Premium subscription must be cancelled separately with Apple or Google.
8. Your rights
Under the PDPA you may ask us to: give you access to and a copy of your personal data; send it to you or another controller in a usable format; correct it; delete or anonymise it; restrict its use; object to its use; and withdraw any consent you gave. Some requests may be limited where the law allows, for example records we must keep for accounting or to resolve a dispute.
Email [email protected] from the address linked to your account, or tell us your account name. We may ask you to prove the account is yours. We will answer within 30 days.
You may also complain to Thailand's Office of the Personal Data Protection Committee (PDPC).
9. Security
Connections between the app and our servers are encrypted (HTTPS/TLS). Passwords and guest secrets are stored only as hashes. Staff access to player data is limited by role and every staff action is logged. Backups are kept in write-protected storage. No system is perfectly secure; if a breach puts your rights at risk we will tell the authority and you as the PDPA requires.
10. Children
Monia Online is meant for players aged 13 and over. We do not knowingly collect personal data from children under 13. If you are under 20 (the age of majority in Thailand), ask a parent or guardian before you play or buy anything. If you believe a child under 13 has an account, contact us and we will delete it.
11. This website
monia-online.com sets no cookies and uses no analytics, ads or third-party scripts, fonts or trackers. Cloudflare, which serves the site, processes your IP address and browser details to deliver pages and protect against attacks.
12. Changes to this policy
We may update this policy as the game changes. The date at the top shows the latest version. For important changes we will tell players in the game before they take effect.
13. Contact
Megamite Lab (Pittawat Sommai) · [email protected]
If this English version and the Thai version differ, the Thai version prevails.