Privacy policy

Summary

• Who: Jose Pablo Florez Maya, an independent developer who runs tkAdmin and TK from Sabaneta (Colombia).
• What: the data needed for your account, your services, your purchases and to play online without cheating.
• What we don't do: we don't sell your data, we don't share it for advertising and we don't use tracking cookies.
• Your rights: you can access, correct, delete or take your data with you by writing to soporte@tkadmin.app.

1. Data controller

• Controller: Jose Pablo Florez Maya, an individual who develops and runs tkAdmin, tkAuth, TK Engine and TK games (such as DUERMEVELA). In this policy, "we".
• Location: Sabaneta, Antioquia, Colombia, postal code 055450.
• Contact: soporte@tkadmin.app. This is the channel for questions, complaints and exercising your rights. It is handled directly by the controller, who is also the data protection contact (the "encarregado" under Brazil's LGPD).

This policy is governed by, among others, Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (now in Decree 1074 of 2015), the EU General Data Protection Regulation (GDPR) and its UK version, Brazil's General Data Protection Law (LGPD) and US state privacy laws, such as California's (CCPA/CPRA).

2. Scope

It applies to tkadmin.app and its subdomains (such as auth.tkadmin.app, api.tkadmin.app and licenses.tkadmin.app), the tkAuth account, tkAdmin cloud services and the games and tools published by TK.

• Self-hosted panel: if you install the tkAdmin panel on your own server, you are the controller of your players' and your server's data, and we have no access to it. If you enable the console's AI analysis, the panel sends log excerpts, with secrets masked, to Anthropic using the API key you configure.
• Stores and platforms: where you buy or download our games (for example, Epic Games Store or Steam), their own policies also apply.

3. What data we process and where it comes from

• tkAuth account (from you): username, email address if you provide it, password stored only as an irreversible hash, the two-factor secret if you enable it, your role and sign-up date.
• Session and security (generated when you use the service): IP address, sign-in and security events (audit log), session tokens and temporary IP blocks in case of abuse.
• tkAdmin services (from you or your servers): the servers, agents, licences and credits you register, and technical deployment data for those servers.
• Purchases (from our payment providers): name, email, country, product, amount and order ID. Your card or wallet details are handled by Lemon Squeezy or Binance Pay; we never see them.
• Emails: your address and the content of messages about licences or support.
• Games with an Epic account (from Epic Games): your Epic account ID, your display name, your Epic Online Services product user ID and the data needed for online matches, such as the session and server.
• Easy Anti-Cheat (from Epic Games): while you play, it collects technical data about your device, system and the game process to detect cheating.
• Crash reports: only if you choose to send them; they include technical data about the crash and your computer.
• Support: whatever you tell us when you write to us.

We do not process sensitive data (such as health, ethnic origin, political opinions or biometric data) or your precise location, and we do not ask for identity documents.

4. Purposes, legal bases and retention

• Creating and maintaining your account: legal basis, performance of a contract. Retention: while you have the account; if you ask us to delete it, it is erased within 30 days and removed from backups within another 30.
• Keeping you signed in: legal basis, contract. Retention: 1 hour for the access token and up to 30 days for the refresh token.
• Protecting the service (unauthorised access, abuse and fraud): legal basis, legitimate interest in security. Retention: audit logs, 12 months; IP blocks, until they expire.
• Providing tkAdmin services: legal basis, contract. Retention: while you use the service.
• Handling purchases and licences: legal basis, contract and legal obligation. Retention: as long as tax and accounting rules require (in Colombia, up to 10 years).
• Playing online with your Epic account: legal basis, contract. Retention: while the game is linked.
• Preventing cheating (Easy Anti-Cheat and sanctions): legal basis, legitimate interest in fair play and contract. Retention: for the duration of the sanction and up to 24 months afterwards, to detect repeat offences.
• Analysing crash reports you send: legal basis, consent. Retention: 90 days.
• Handling your requests and rights: legal basis, legal obligation and contract. Retention: 24 months after the request is closed.
• Complying with the law and authorities: legal basis, legal obligation. Retention: as required by law.

When we rely on legitimate interest, we have checked that it does not override your rights, and you can object. Providing your data is necessary to use the services: without it we cannot create your account or let you play online. We do not use your data for advertising, commercial profiling or any purpose other than those listed.

5. Automated decisions

Easy Anti-Cheat may automatically remove you from a match if it detects prohibited software or modified game files, and that detection may lead to an account sanction.

You can always ask for a person to review any removal or sanction, explain your point of view and contest the decision by writing to soporte@tkadmin.app. We will reply within 15 business days at most.

6. Who we share your data with

Only with those needed to provide the service:

• OVH (France): hosts our servers and databases in the European Union, on our behalf.
• Epic Games, Inc. (USA): Epic sign-in, online services and Easy Anti-Cheat. For your Epic account it acts as an independent controller: https://www.epicgames.com/site/privacypolicy
• Lemon Squeezy (USA): sells and charges for our licences as merchant of record and handles your payment data under its policy: https://www.lemonsqueezy.com/privacy
• Binance Pay: if you pay with cryptocurrency, it processes the payment under its policy: https://www.binance.com/en/privacy
• Email provider: sends licence and support messages, on our behalf.
• Public authorities: only when a law or a valid order requires it.

If the services are later transferred to a company set up by the controller or to another entity, your data will move with the same safeguards and we will let you know. We do not sell your personal data or "share" it for cross-context behavioural advertising as defined by US laws.

7. International transfers

The controller is in Colombia, the servers are in the European Union and some providers are in the USA or other countries, so your data may move between countries.

When it leaves the European Economic Area or the UK, it is protected by recognised mechanisms: adequacy decisions, the European Commission's standard contractual clauses or the EU-US Data Privacy Framework when the recipient is certified.

Under Article 26 of Colombian Law 1581 of 2012, we transfer data to countries with an adequate level of protection or, otherwise, with your authorisation, which you give by accepting this policy.

You can ask us for more information about these safeguards at soporte@tkadmin.app.

8. Cookies and browser storage

We only use what is strictly necessary for the site to work, so we do not need your consent or show a banner:

• NEXT_LOCALE: remembers your language; deleted when you close the browser.
• tk_at: keeps you signed in; 1 hour.
• tk_rt: renews your session without signing in again; up to 30 days.
• tk_state, tk_pkce and tk_return: protect the sign-in process; 5 minutes.
• tkadmin-theme (local storage): remembers the light or dark theme.

We do not use analytics, advertising or social media cookies. If we ever do, we will ask for your consent first.

9. Security

We apply reasonable technical and organisational measures: encrypted connections (HTTPS/TLS), hashed passwords, optional two-factor authentication, encrypted secrets (AES-256-GCM), restricted server access and backups.

No system is 100% secure. If a breach puts your data at risk, we will notify the competent authority and the people affected within the time limits set by law (for example, within 72 hours to the authority under the GDPR).

Help us protect your account: use a unique password and enable two-factor authentication.

10. Your rights

You have the right to know and access your data; update or correct it; have it erased; object to or restrict its processing; receive it in a format you can take to another service; withdraw your authorisation or consent at any time, without affecting what was done before; not be subject to solely automated decisions with significant effects; and lodge a complaint with an authority.

• How to exercise them: write to soporte@tkadmin.app with the subject "Privacy", from your account email if possible, and say what you are asking for. It is free. We may ask for reasonable information to verify it is you, never more than necessary.
• Time limits: we apply the shortest one under the law that protects you. In Colombia, queries are answered within 10 business days (extendable by 5) and complaints within 15 business days (extendable by 8). In the EU and the UK, within one month (extendable by two more in complex cases). In US states, within 45 days (extendable by 45).
• Appeals: if we refuse your request, we will explain why and you can ask us to reconsider; we will reply within 45 days at most.
• Representatives: you can act through a representative or authorised agent, who must prove your authorisation.
• No retaliation: we will not treat you differently for exercising your rights.
• Epic account: you can unlink a game from your account at epicgames.com, under Account → Apps and Accounts.
• Authorities: in Colombia, the Superintendence of Industry and Commerce (www.sic.gov.co), which you can approach after filing your complaint with us; in the EU, your country's data protection authority (list at edpb.europa.eu); in the UK, the ICO; in Brazil, the ANPD; in California, the California Privacy Protection Agency.

11. Information for US residents

In the last 12 months we have collected these categories: identifiers (username, email, IP and Epic account IDs); commercial information (purchases and licences); internet and network activity (security and game logs); and account login information (username and password), considered sensitive, which we only use to give you access and protect your account. The sources, purposes, recipients and retention periods are those described in this policy.

We do not sell or share personal data, we do not use it for targeted advertising or for profiling with legal effects, and we have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16. You can exercise your rights as described in "Your rights".

12. Children

You must be at least 16 to use our services. Some games may require a higher age according to their rating (for example, PEGI or ESRB).

If you are between 16 and 18 and live in a country where the law requires your parents' or legal guardians' authorisation to process your data (such as Colombia), you need that authorisation to use the services.

We do not knowingly collect data from children under 16; if we find out we have, we will delete it. If you are a parent or guardian and believe your child has given us data, write to soporte@tkadmin.app.

13. Authorisation

By creating your account, buying a licence or playing online, you give your prior, express and informed authorisation for your data to be processed under this policy. We keep proof of that authorisation for as long as the processing lasts.

14. Changes and validity

This policy is effective from 22 October 2026. Our databases will be kept for as long as they serve the service and for the retention periods stated.

If we change it, we will update the date above. If the change is significant, we will let you know in advance by email or in the service itself and, where the law requires, ask for your authorisation again.