Privacy Policy

1. Data controller

This policy covers the game RAYCITY-M and the website raycitym.com. It explains how we collect, use and protect your personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

The data controller is RaycityM ("we").
Contact for privacy matters: [email protected]

2. Data we collect

Player account

• Username and password (stored encrypted; we cannot read your actual password)
• Email address (if you give one at sign-up) and the sign-up date

Data when you sign in with Apple or Google
You can sign in to the game with Sign in with Apple or with Google instead of choosing a user name and password.

• We never receive your Apple or Google password. You confirm who you are with Apple or Google directly, they send a signed result to our server, and we check it before letting you in.
• What our server keeps: your identifier at Apple or Google (not your name or e-mail), the date the account was created and last used, a game account ID the system generates, the time you confirmed your age and accepted the terms, and the device model you signed in from (used to remember your sign-in on that device). For Apple we also keep, encrypted, the token Apple gave us so we can revoke the access later.
• E-mail and name: we do not store your e-mail or your name in our database. The app asks Apple for the e-mail only and does not ask for your name. If Apple or Google sends an e-mail, our server reads it only to show you which account you are using, and the app keeps that text in the encrypted storage of your own device. If you choose Apple's "Hide My Email", we do not show the relay address; we show that the e-mail is hidden.
• Why: to create your game account or link it to your existing one and to let you sign in (performance of the contract), and to prevent cheating and repeated sign-ups.
• How long: this data is kept while your account is active. When you ask for deletion there is a 30-day waiting period, after which we permanently delete your Apple or Google identifier and the encrypted token. What remains afterwards is only a record of when this account accepted the terms and how it was created, which does not identify you. Cancelled "remembered sign-in" records (device model, dates, reason) are kept for at most 365 days, and database backups can still hold the old data for the periods stated in section 5.
• Deleting your account and unlinking: you can delete an account made with Apple or Google inside the app; the app asks you to confirm with Apple or Google again, then the 30-day deletion starts, and for Apple accounts we also ask Apple to revoke the access you gave (if Apple cannot be reached at that moment, the system retries from time to time). You can also remove this app's access on the Apple or Google side yourself. When Apple tells us you revoked access, we cancel the remembered sign-ins of that account, and when Apple tells us you deleted your Apple account, we also start the 30-day deletion of the game account. Accounts made with a user name and password can be deleted with the web form at https://raycity-m.com/delete-account/ or by e-mail to [email protected]. See the account deletion page for details.
• Providers: sign-in runs through Apple and Google; what they collect is covered by their own policies: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy . In addition, Google's sign-in component in the app (Google Sign-In) declares that it may itself collect these data types: name, e-mail address, phone number, user ID, device ID, approximate location and other usage data, to make sign-in work and for analytics, and not for tracking across apps. We do not read or store that data ourselves. See Google's policy above.

Game data

• Characters, cars, items, in-game currency, mission history, friends, guilds and parties

Chat messages

• We keep in-game chat messages to review inappropriate language and cheating.

Purchase data

• Order records and status when you top up or buy items. Payments are handled by Apple or Google; we never receive your card number.

Technical data

• IP address, device model, app version and connection logs

Website visits

• If you choose "Accept all" in the cookie banner, we record your IP address, device type, operating system, browser, pages opened, referring site (site name only) and time, together with an anonymous cookie that counts unique visitors.
• If you decline or have not chosen, we set no analytics cookie and count your visit anonymously only (the last part of the IP address is removed and the visit is not linked across days).

Information you send us, such as your email and what you write when you contact support or report a player.

3. Why we use your data

• To run the game and keep your account working (performance of the contract)
• To prevent cheating, cheat software and bots (legitimate interest)
• To answer questions and provide support
• To keep our systems secure and review inappropriate chat
• To measure and improve the website (statistics), with your consent, which you can withdraw at any time
• To comply with the law and orders of competent authorities

4. Who we share data with

• Server hosting providers that help us operate the service, under data protection terms
• Apple and Google, for payments and app distribution
• Apple and Google, for sign-in with Sign in with Apple and Google (when you choose to use it)
• Government authorities, only when required by law

The game and website contain no advertising. We do not sell your personal data and we do not use third-party advertising or tracking services. The website uses a third-party analytics tool only if it appears in the cookie table below and you have consented.

5. How long we keep data, and deletion

• Account and game data are kept while your account is active.
• When you request deletion of your account, we permanently delete your data within 30 days after the request is confirmed.
• Delete it yourself in the game (accounts created with an ID and password): open the system menu, then "Options" > tab "Other" > group "Account" > "Delete account". The app asks you to confirm and opens a web page where you confirm the deletion.
• Or use the account deletion page.
• Or send a request by email to [email protected].
• Some data may be kept longer only as far as needed to comply with the law (for example purchase records) or to prevent cheating (for example records of an account suspension), and is deleted once the legal period ends.
• Website statistics are kept for no more than 90 days and then deleted automatically.

6. Your rights under the PDPA

You may ask to access and obtain a copy of your data, correct it, delete or destroy it, restrict its use, object to its processing, have it transferred, and withdraw consent you gave, at any time.

To exercise these rights, contact [email protected]. We will reply within 30 days.

You also have the right to complain to Thailand's Personal Data Protection Committee.

7. Children

This game is for players aged 13 and over. We do not knowingly collect data from younger children.

If you are a parent and believe your child created an account without permission, please contact [email protected] and we will delete that data.

8. Security

We store passwords in encrypted form and limit access to data to those who need it. The website, the web account pages (including the account deletion page) and update downloads use HTTPS. The live connection between the app and the game server uses the game's own protocol, so we do not claim that this part of the traffic is encrypted in transit.

9. International transfers

Some providers may process data outside Thailand. We make sure appropriate safeguards are in place as required by the PDPA.

10. Effective date and changes

This policy is effective from 10 November 2026. When we make significant changes, we update the "Last updated" date on this page, tell you in the game or on the website, and may ask for your consent again.

11. Contact us

RaycityM
Email: [email protected]