Privacy Policy
Last updated: October 22, 2026
This policy explains what personal data the game OVERSPRAY processes, why, who we share it with and what your rights are. It applies to the game, its online servers and services, and the website playoverspray.com.
1. Who is responsible for your data
The data controller is FAZAY SERVICOS DE TECNOLOGIA LTDA ("Fazay Games", "we"):
- Brazilian company registration (CNPJ): 68.731.006/0001-72.
- Address: Av. Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, 90560-001, Brazil.
- Contact and data protection officer: dev@fazay.com.br.
2. Summary
| What we process | Why |
|---|---|
| Your store account ID and name (Steam, Epic, Xbox) | Sign-in, matchmaking, showing your name |
| Match results and ranking | Scoreboards, seasonal ranking and history |
| Reports and penalties | Moderation and fair matches |
| Anti-cheat data | Detecting and stopping cheating |
| IP address and connection data | Connecting you to the match server |
| Crash reports that don't identify you | Fixing bugs |
| Proof of purchases made in the store | Unlocking the Founder's Pack, Premium, skins and passes |
We do not sell your data, use it for advertising or build marketing profiles.
3. Data we process
3.1 Platform account
You play OVERSPRAY with the account of the store where you own the game: Steam, Epic Games Store or, in the future, Xbox. There is no separate sign-up or password. We receive:
- account ID: for example, your SteamID;
- public profile data: display name and avatar;
- country: as provided by the platform based on your connection;
- friends list: only to show who you can invite to your party. We don't store it.
Epic Online Services, which we use for lobbies, cross-platform identity and anti-cheat, creates a player ID linked to your account.
3.2 Matches and ranking
For each match we store:
- player IDs and names, country, team and whether a player was a bot;
- mode, map, score and duration;
- how many players each person soaked and how much paint they dealt;
- whether someone left the match;
- points won or lost.
For ranked play we also store points, rank, wins, losses and streaks for each season.
3.3 Text and voice chat
- Text chat: goes through the match server only to reach other players. The game filters profanity. We don't store chat history in our database.
- Voice chat: runs on Unity Vivox and is streamed live to your team. We don't record your voice. You can turn off your mic, mute players or disable voice in the settings.
3.4 Reports and moderation
When someone files a report, we store:
- who reported and who was reported (IDs and names);
- the reason chosen;
- the match and the server.
We also store our review and the decision. If an account is suspended or banned, we store how long the penalty lasts and why.
3.5 Anti-cheat
OVERSPRAY uses Easy Anti-Cheat by Epic Games.
- What it checks: while the game is running, the game files, running programs and modules, system and hardware information, and device identifiers.
- Where it goes: the results of these checks are sent to Epic.
- What it's for: only to detect cheating and protect match integrity.
Epic also processes this data under Epic Games' privacy policy.
3.6 Connection and servers
- What we use: your IP address and network data, such as latency.
- Why: to choose the region and dedicated server, connect you and keep the match running.
- Who runs the servers: Edgegap.
- Technical logs: kept for a limited time to troubleshoot and protect the servers from abuse.
3.7 Crash reports
When the game hits an error or closes unexpectedly, it sends:
- the error type, message and stack trace;
- the game version and the store;
- the operating system, graphics card and amount of memory;
- the screen the game was on;
- a random session code.
Your Windows user name is removed from the report before it is sent. Reports are not linked to your account.
3.8 Purchases
Purchases are made through the store (Steam or Epic). We never receive or store card or payment details. We only receive confirmation that your account owns an item, so we can unlock it in the game:
- Founder's Pack;
- Premium;
- skins;
- season passes.
3.9 Data on your computer
Settings, key bindings, language, graphics options and game log files are saved on your own computer.
3.10 The playoverspray.com website
- Hosting: the site is hosted by Vercel, which logs technical access data to serve pages and prevent abuse: IP address, browser and page visited.
- Cookie: the
osp_langcookie remembers the language you pick, for up to 1 year. - No tracking: we use no advertising cookies and no analytics tools.
- Fonts: on the Chinese, Japanese and Korean versions, fonts load from Google Fonts, which receives your IP address.
3.11 Contact
If you email us, we keep your message and email address to reply.
4. Why we use data and our legal bases
| Purpose | Legal basis (LGPD art. 7; GDPR art. 6) |
|---|---|
| Providing the game, matchmaking, ranking, lobbies, chat and purchased items | Performance of a contract (these Terms of Use) |
| Anti-cheat, security, moderation and fraud prevention | Legitimate interests and performance of a contract |
| Fixing bugs and improving stability | Legitimate interests |
| Complying with legal obligations and authorities | Legal obligation |
| Establishing or defending legal claims | Exercise of legal rights |
Automated decisions
- Anti-cheat: Easy Anti-Cheat may automatically block you from joining matches when it detects cheating.
- Bans: account bans in OVERSPRAY are decided by a member of our team.
- Appeals: you can appeal any penalty at dev@fazay.com.br.
5. Who we share data with
We use service providers that process data on our behalf, only to run the game:
| Provider | What it does |
|---|---|
| Valve (Steam) | Account, friends, invites and purchases |
| Epic Games (Epic Online Services and Easy Anti-Cheat) | Player identity, lobbies, cross-platform sign-in and anti-cheat |
| Edgegap | Dedicated match servers |
| Unity Technologies (Vivox) | Voice chat |
| Supabase | Database for ranking, matches, reports and crash reports (USA) |
| Vercel | Website hosting |
| Google (Google Fonts) | Fonts for the Chinese, Japanese and Korean versions of the site |
Each store (Steam, Epic and Xbox) also processes data under its own privacy policy.
- What other players see: your name, platform avatar, team, score and ranking position.
- Authorities: we share data with authorities only when the law requires it.
6. International transfers
Some providers are outside Brazil, mainly in the United States, and matches may run on servers in other countries. In these cases we use providers that offer appropriate safeguards, such as standard contractual clauses, under LGPD art. 33 and Chapter V of the GDPR.
7. How long we keep data
| Data | Retention |
|---|---|
| Account, ranking and match history | While the game is live or until you ask us to delete it. Past seasons may be kept in summary form |
| Reports and moderation decisions | Up to 2 years after the decision |
| Bans | For as long as the penalty applies |
| Crash reports | Up to 12 months |
| Technical connection and access logs | As long as the law requires; in Brazil, the Marco Civil da Internet requires 6 months for application access logs |
| Contact emails | As long as needed to resolve the matter |
After these periods, data is deleted or anonymized.
8. Your rights
You can ask us at any time for:
- confirmation and access: whether we process your data, and a copy of it;
- correction: of incomplete or wrong data;
- anonymization, blocking or deletion: of unnecessary data or data processed unlawfully;
- portability: of your data to another provider;
- deletion: of data processed based on your consent;
- information about sharing: who we share your data with;
- objection: to processing based on legitimate interests;
- review: of automated decisions.
To exercise your rights, email dev@fazay.com.br with the subject "Privacy" and tell us your account (for example, your name and SteamID). We reply within 15 days.
Some data may be kept after a deletion request when we need it to:
- comply with the law;
- prevent fraud, such as the record of a cheating ban;
- defend legal claims.
You can also complain to a data protection authority:
| Where you live | Authority |
|---|---|
| Brazil | Autoridade Nacional de Proteção de Dados (ANPD) |
| European Union | The authority in your country |
| United Kingdom | Information Commissioner's Office (ICO) |
California residents (USA): we do not sell or share personal information for cross-context behavioral advertising.
9. Children and teenagers
- Minimum age: OVERSPRAY is not intended for children under 13, and we do not knowingly collect their data. If we learn we hold data from a child under 13, we delete it.
- Age rating: 14 in Brazil, Teen (ESRB) and PEGI 12.
- Teenagers: should play with the permission and supervision of a parent or guardian.
- Parents and guardians: can email us to access or delete their teenager's data.
10. Security
We protect data with these measures:
- encrypted connections;
- an authoritative match server;
- a database with restricted access and tables closed to public reads;
- secret keys kept outside the game;
- team-only access.
No system is perfectly secure. If a relevant security incident happens, we will notify the ANPD and the people affected, as the law requires.
11. Changes to this policy
We may update this policy. The last update date is at the top of the page. We will announce relevant changes on the website and, where it makes sense, in the game.
12. Contact
FAZAY SERVICOS DE TECNOLOGIA LTDA: dev@fazay.com.br Av. Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, 90560-001, Brazil.