Privacy Policy

Who we are

The MU Unit is an independent project of MU Online maintained by UNIT GAMES LTDA, CNPJ 69,860,540/0001-41, headquartered at R. do Riachuelo, 105, Sala 0216, Edf. Círculo Católico, Boa Vista, CEP 50050-400, Recife/PE. This policy applies to the site https://muunit.com, the launcher, the mobile app, the game, the in-game voice, and the official channels, and follows the General Data Protection Law (Law 13,709/2018), the Civil Rights Framework for the Internet (Law 12,965/2014) and the Digital Statute of Children and Adolescents (Law 15,211/2025).

Data controller: UNIT GAMES LTDA, CNPJ 69,860,540/0001-41. Data protection officer: José Osvaldo Vieira Junior, by email at privacidade@muunit.com.

What data we collect

• Registration: name, CPF, date of birth, email, login and password for game accounts, and phone number, if you wish to inform. The CPF identifies the owner, links accounts to the same person, limits the number of accounts each person creates, prevents the re-registration of banned users, and is used for contributions, withdrawals, account recovery, and age verification. Those who live outside Brazil provide the country and an identification document (such as DNI, ID card, or passport) instead of the CPF, and do not provide an address.
• Age verification: we check the CPF and date of birth in an official or authorized source (CPFHub, the public consultation of the Federal Revenue, where you yourself solve the challenge within the game, or the Serpro). From the verification, we only keep the result (18 years or older: yes or no), the method used, and the date; what the source returns is only for verification, and the official name can correct the first and last name of the registration. Accounts already registered with CPF and date of birth were verified this way on 03/11/2026. We may request an official document to prove age and identity.
• Who pays: before paying, you inform if the payer is you or someone else and the payer's data (full name, CPF, address, phone, and email), saved for the invoice and for the next contribution. When paying by PIX, the payment processor informs us the masked name and CPF of the payer, to check that the payment came from the account of the person informed.
• Acceptances: the version of the Terms of Use and Voice Rules that you accepted, with date, time, IP, browser or app, and the channel used (website, app, or launcher).
• Account usage: open sessions (IP, port, country, region, and approximate city by IP, browser, launcher, or app, and dates), failed login attempts (entered login, IP, and time), and account activity logs, such as creation, password changes, logins, contributions, credit usage, Market, and withdrawals.
• Device: a unique code for the computer or cell phone, calculated from device data and stored only in irreversible code form (hash), the game and system version, and performance and network measurements (ping, packet loss, and frames per second).
• Game: characters, level, resets, guild, items, zen, position, trades, Market and Store purchases, drops, event participation, commands used, online time, and penalties. We may log messages sent in the game chat for moderation and investigation of reports. The rankings publicly display the character name, class, guild, and score.
• Anti-cheat protection: while open, the game, launcher, and app check the integrity of their own files and memory, the programs, windows, and libraries open on the device, the system clock, action speed, and signs of debugging, injection, or emulation. When they find something prohibited or suspicious, they send to the server the type of finding, the program name or file path (the user folder is replaced by %userprofile%), the device code, the account, the character, the IP, and the time. The check does not read your documents, photos, passwords for other services, or conversations outside the game.
• Contributions and withdrawals: on the first contribution, we ask for your address (CEP, street, number, neighborhood, city, and state) to issue the invoice, and we save it for the next ones. When contributing by PIX, we send name, CPF, and email to the payment processor (Asaas or Mercado Pago) to generate the charge. Those outside Brazil pay on the PayPal page, which treats the data informed there as its own controller. We do not receive card data: we save the PayPal account identifier, the country, the payment status, and if the name matches the registration, to confirm the purchase, handle returns, and prevent fraud. For withdrawals, we use the CPF from the registration as a PIX key. We save amounts, status, dates, and receipts. We do not receive card data nor access to your bank account.
• In-game voice: the voice is streamed in real-time through our voice server. To investigate reports, the server keeps only the last few minutes of audio from each conversation in memory; when someone reports, the segment of who spoke to whom is saved, and the rest is never recorded. We also store the acceptance of the Voice Rules, guild rooms, moderation actions, reports (who reported whom, reason and time), and technical usage numbers.
• Recording and live streams: the recording made by the game stays on your computer and is not sent to us. For live streams, we store the channel linked to the account, the link, the title, the platform, the times, the number of viewers, and public images from the live stream (thumbnails or frames) used to read the game code and confirm the live stream.
• AI: questions asked to the site and game AI, the answers, and messages sent to the chat automatic translator are processed by Cloudflare Workers AI and are recorded with your account for usage control, security, and improvement of responses.
• Support and reports: messages from tickets, reports made by the report button, and emails exchanged with support@muunit.com and denuncia@muunit.com.
• Site navigation: a proprietary measurement of visits, without saving IP, that uses a random code saved in your browser and records pages viewed, where you came from, link campaign, approximate country, region, and city, device, browser, and system (and your account, when you are logged in). On public pages, we also use Google Analytics 4 and ad tags from Google Ads, TikTok, and Meta, which record cookies from Google, TikTok, and Meta.

What we use it for and the legal basis

• Create and maintain your account, your characters, and the game running: contract execution (Terms of Use).
• Confirm the minimum age of 18 years and comply with child and adolescent protection: compliance with legal obligation (Law 15,211/2025, the Digital ECA) and legitimate interest.
• Limit the number of accounts each person creates and prevent the re-registration of banned users, by CPF: legitimate interest.
• Check that the payment came from the account of the person informed as the payer and refund what did not go through: fraud prevention (legitimate interest) and contract execution.
• Account and server security, combat against cheating, fraud, and abuse, handling of reports, and application of penalties: legitimate interest, player protection, and regular exercise of rights, including in judicial or administrative proceedings.
• Process contributions, credits, Premium, and withdrawals and keep payment records: contract execution and legal obligation.
• Save the voice segment of a reported conversation to investigate the report and enforce the Voice Rules: legitimate interest, protection of players, and regular exercise of rights.
• Prove acceptance of the Terms and Voice Rules: regular exercise of rights.
• Support and notify you about your account (verification codes, password recovery, security): contract execution.
• Understand how the site and the game are used to improve the server: legitimate interest.

We do not sell personal data. We do not use age data for ads.

Who we share with

We use suppliers that handle data on our behalf, only to make the service work:

• Cloudflare: website hosting, files, visit measurement, connection routes, AI, and saved voice segments in reports, in private storage.
• Hostinger: game, voice, and database server, in Brazil.
• OVH: domain email server.
• Asaas and Mercado Pago: charges, refunds, and withdrawals via PIX; Asaas also informs us the masked name and CPF of the payer.
• PayPal: payments for accounts outside Brazil, refunds, and fraud prevention, with data processing also outside Brazil.
• CPFHub: checks the CPF and date of birth in age verification.
• Serpro (Federal Data Processing Service), a federal public technology information company that safeguards the CPF data controlled by the Union: checks the CPF and date of birth in the Federal Revenue database for age verification.
• Twitch, YouTube and TikTok: conference of the lives you connect to your account.
• Google: Google Analytics, Google Ads, and, for the official channel, YouTube.
• TikTok: posts on the official profile and ad measurement (TikTok Pixel).
• Meta: server publications on Instagram and Facebook and measurement of ads (Meta Pixel and Conversions API: when you create an account, download the game, enter the game for the first time, or contribute, the server notifies Meta with email, phone number, and city, when you provided them, and name, transformed into an irreversible code by hash, along with the IP and browser).

Some of these services handle data outside of Brazil. We choose suppliers with protection guarantees compatible with LGPD.

We deliver data to authorities when the law or a court order requires it, and we inform authorities of any content involving the exploitation of children or adolescents.

Cookies and browser storage

• session and other_sessions: keep you logged in and allow you to switch between your accounts (30 days).
• mfa_challenge: stores the two-step verification step for a few minutes.
• language: remembers the chosen language (1 year).
• mu-launcher and mu-downloaded: remember that you have already installed or downloaded the game (1 year).
• indicacao_ref and live_ref: remember which referral or live you arrived through, for registration (up to 30 days).
• mu-visitor (local storage): random code for own visit measurement.
• Google Analytics _ga cookies: audience measurement on public pages.
• Cookies from Google Ads, TikTok Pixel, and Meta Pixel (such as _gcl_au, _ttp, and _fbp): ad measurement on public pages.
• measurement: remember if you accepted or declined the measurement of visits and ads in the cookie notice (1 year). Logged in, the choice is also recorded in the account, with date, time, IP and channel.

To decline the measurement of visits and ads, click Decline in the cookie notice or Cookies, in the site footer. Google Analytics, Google Ads, and TikTok and Meta Pixels stop working in your browser, and our server also stops sending your events to Google and Meta.

You can also delete or block cookies in your browser settings. Without session cookies, you can't stay logged in.

YouTube and Google services

The MU Unit uses YouTube API Services to manage its own official channel: publish videos, read channel and video information and statistics, and change video visibility. This integration is used only by the MU Unit administration, with the Google account owning the channel, and does not access player data or viewers' data.

We store, encrypted, the authorization given by Google and the identifier, name, and photo of the channel. The authorization can be revoked at any time on the Google Account permissions page (https://myaccount.google.com/permissions) or by the Disconnect button on the server panel; upon disconnecting, we delete the authorization.

When viewing or interacting with channel content, the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google Privacy Policy (https://policies.google.com/privacy) also apply.

TikTok

The MU Unit uses the TikTok API (Login Kit and Content Posting API) to publish videos and photos on the official server profile and to read the name, photo, numbers, and video list of this profile. This integration is used only by the MU Unit administration, with the server's TikTok account, and does not access player data or data of those who watch the videos.

We store, encrypted, the authorization given by TikTok and the identifier, name, @, and photo of the profile. The authorization can be revoked at any time in the security settings of the TikTok app, in app permissions, or by the Disconnect button on the server panel; upon disconnecting, we delete the authorization.

When viewing or interacting with the profile content, the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service) and TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy) also apply.

How long we keep

• Account, characters, account activities and questions to the site's AI: while the account exists or until you request deletion.
• Access logs (IP, date, and time of sessions): at least 6 months, as required by the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014, art. 15), in a controlled and secure environment.
• Acceptance of the Terms and Rules and the choice of the cookie notice: while the account exists and for up to 5 years after, to prove what was agreed.
• Records of protection against cheating, reports and punishments: while the account exists and, afterwards, for the time necessary for defense in a process, up to 5 years.
• Payment, refund and withdrawal records: for the period required by law.
• Age verification result (yes or no, method, and date): while the account exists and for up to 5 years after, to prove compliance with the law.
• Own visit measurement: 90 days.
• Conversations with the AI inside the game: 30 days.
• Saved voice segments in reports: 60 days, or until the investigation, contestation, or related process is completed.
• Voice usage numbers: 30 days.
• Launcher network measurements: 7 days.
• Failed login attempts: 1 day.

Security

The site password is stored with hash (scrypt), session tokens only as hash, and the secrets of two-step verification and integration keys are encrypted.

The game account password must be read by the game server at login and is stored in the game database, with restricted access to administration. Use a password that you do not use anywhere else and enable two-step verification in My Account.

If a security incident occurs that may cause significant risk or damage, we notify the affected holders and the National Data Protection Authority, as required by the LGPD.

Your rights

Under LGPD, you can request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data (date of birth changes only by support, with proof);
• anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• data portability;
• information about who we share with;
• review of decisions made solely by automated means, such as automatic suspension for cheating;
• dispute the age verification result;
• deletion of data and account closure, respecting the records that the law requires to be kept.

Make the request to suporte@muunit.com or by opening a ticket at https://muunit.com/conta/suporte. We respond within 15 days. You can also file a complaint with the National Data Protection Authority (ANPD).

To report abuse, illegal content, or underage account, use the report button in the game or write to denuncia@muunit.com. The support team reads and responds within 3 business days.

Children and teenagers

The MU Unit is exclusively for individuals over 18 years old. We do not accept registration of minors and do not intentionally collect data from children or adolescents.

If we know that an account belongs to a minor under 18 years old, we suspend the account and delete the data that we do not need to keep by law.

Parents and guardians can request the deletion of a minor's data and the refund of contributions made by them, with proof of relationship, via support@muunit.com. Anyone can report an underage account via denuncia@muunit.com.

Changes to this policy

When this policy changes, the date and version at the top of this page change as well. Important changes are also announced on the site.

This page may appear automatically translated. In case of difference, the Portuguese text prevails.