Privacy Policy

Who we are

The MU Unit is an independent project of MU Online maintained by UNIT GAMES LTDA, CNPJ 69,860,540/0001-41, headquartered at R. do Riachuelo, 105, Sala 0216, Edf. Círculo Católico, Boa Vista, CEP 50050-400, Recife/PE. This policy applies to the site https://muunit.com, the launcher, the mobile app, the game, the in-game voice, and the official channels, and follows the General Data Protection Law (Law 13,709/2018), the Civil Rights Framework for the Internet (Law 12,965/2014) and the Digital Statute of Children and Adolescents (Law 15,211/2025).

Data controller: UNIT GAMES LTDA, CNPJ 69,860,540/0001-41. Data protection officer: via email suporte@muunit.com.

What data we collect

• Registration: name, CPF, date of birth, email, login and password for game accounts, and phone number, if you wish to inform. The CPF links accounts to the same person, limits how many accounts each person creates, and is used for contributions, withdrawals, and account recovery. Those living outside Brazil inform the country and an identification document (such as DNI, ID card, or passport) instead of the CPF, and do not inform the address.
• Age: the date of birth confirms that you are 18 years old or older. It is checked during registration, before enabling the voice feature, and before each contribution. We may request an official document to verify age and identity.
• Acceptances: the version of the Terms of Use and Voice Rules that you accepted, with date, time, IP, browser or app, and the channel used (website, app, or launcher).
• Account usage: open sessions (IP, port, country, region, and approximate city by IP, browser, launcher, or app, and dates), failed login attempts (entered login, IP, and time), and account activity logs, such as creation, password changes, logins, contributions, credit usage, Market, and withdrawals.
• Device: a unique code for the computer or cell phone, calculated from device data and stored only in irreversible code form (hash), the game and system version, and performance and network measurements (ping, packet loss, and frames per second).
• Game: characters, level, resets, guild, items, zen, position, trades, Market and Store purchases, drops, event participation, commands used, online time, and penalties. We may log messages sent in the game chat for moderation and investigation of reports. The rankings publicly display the character name, class, guild, and score.
• Anti-cheat protection: while open, the game, launcher, and app check the integrity of their own files and memory, the programs, windows, and libraries open on the device, the system clock, action speed, and signs of debugging, injection, or emulation. When they find something prohibited or suspicious, they send to the server the type of finding, the program name or file path (the user folder is replaced by %userprofile%), the device code, the account, the character, the IP, and the time. The check does not read your documents, photos, passwords for other services, or conversations outside the game.
• Contributions and withdrawals: on the first contribution, we ask for your address (ZIP code, street, number, neighborhood, city, and state) to issue the invoice, and we keep it for the next ones. When contributing via PIX, we send name, CPF, and email to the payment processor (Asaas or Mercado Pago) to generate the charge. For withdrawals, we use the CPF from the registration as the PIX key. We keep records of amounts, status, dates, and receipts. We do not receive card data or access to your bank account.
• Voice in the game: the voice goes in real-time through our voice server and is not recorded. We store the acceptance of the Voice Rules, the guild rooms, moderation actions, reports (who reported whom, reason, and time), and technical usage numbers.
• Recording and live streams: the recording made by the game stays on your computer and is not sent to us. For live streams, we store the channel linked to the account, the link, the title, the platform, the times, the number of viewers, and public images from the live stream (thumbnails or frames) used to read the game code and confirm the live stream.
• AI: questions asked to the site and game AI, the answers, and messages sent to the chat automatic translator are processed by Cloudflare Workers AI and are recorded with your account for usage control, security, and improvement of responses.
• Support: messages from tickets, reports, and emails exchanged with support@muunit.com.
• Site navigation: a proprietary measurement of visits, without saving IP, that uses a random code saved in your browser and records pages viewed, where you came from, link campaign, approximate country, region, and city, device, browser, and system (and your account, when you are logged in). On public pages, we also use Google Analytics 4 and ad tags from Google Ads, TikTok, and Meta, which record cookies from Google, TikTok, and Meta.

What we use it for and the legal basis

• Create and maintain your account, your characters, and the game running: contract execution (Terms of Use).
• Confirm the minimum age of 18 years and comply with child and adolescent protection: legal obligation and legitimate interest.
• Account and server security, combat against cheating, fraud, and abuse, handling of reports, and application of penalties: legitimate interest, player protection, and regular exercise of rights, including in judicial or administrative proceedings.
• Process contributions, credits, Premium, and withdrawals and keep payment records: contract execution and legal obligation.
• Prove acceptance of the Terms and Voice Rules: regular exercise of rights.
• Support and notify you about your account (verification codes, password recovery, security): contract execution.
• Understand how the site and the game are used to improve the server: legitimate interest.

We do not sell personal data. We do not use age data for ads.

Who we share with

We use suppliers that handle data on our behalf, only to make the service work:

• Cloudflare: site hosting, files, visit measurement, connection routes, and AI.
• Hostinger: game, voice, and database server, in Brazil.
• OVH: domain email server.
• Asaas and Mercado Pago: charges, refunds, and withdrawals via PIX.
• Twitch, YouTube and TikTok: conference of the lives you connect to your account.
• Google: Google Analytics, Google Ads, and, for the official channel, YouTube.
• TikTok: posts on the official profile and ad measurement (TikTok Pixel).
• Meta: server publications on Instagram and Facebook and measurement of ads (Meta Pixel and Conversions API: when you create an account, download the game, enter the game for the first time, or contribute, the server notifies Meta with email, phone number, and city, when you provided them, and name, transformed into an irreversible code by hash, along with the IP and browser).

Some of these services handle data outside of Brazil. We choose suppliers with protection guarantees compatible with LGPD.

We deliver data to authorities when the law or a court order requires it, and we inform authorities of any content involving the exploitation of children or adolescents.

Cookies and browser storage

• session and other_sessions: keep you logged in and allow you to switch between your accounts (30 days).
• mfa_challenge: stores the two-step verification step for a few minutes.
• language: remembers the chosen language (1 year).
• mu-launcher and mu-downloaded: remember that you have already installed or downloaded the game (1 year).
• indicacao_ref and live_ref: remember which referral or live you arrived through, for registration (up to 30 days).
• mu-visitor (local storage): random code for own visit measurement.
• Google Analytics _ga cookies: audience measurement on public pages.
• Cookies from Google Ads, TikTok Pixel, and Meta Pixel (such as _gcl_au, _ttp, and _fbp): ad measurement on public pages.

You can delete or block cookies in your browser settings. Without session cookies, you cannot stay logged in. To refuse Google Analytics, use the Google add-on: https://tools.google.com/dlpage/gaoptout.

YouTube and Google services

The MU Unit uses YouTube API Services to manage its own official channel: publish videos, read channel and video information and statistics, and change video visibility. This integration is used only by the MU Unit administration, with the Google account owning the channel, and does not access player data or viewers' data.

We store, encrypted, the authorization given by Google and the identifier, name, and photo of the channel. The authorization can be revoked at any time on the Google Account permissions page (https://myaccount.google.com/permissions) or by the Disconnect button on the server panel; upon disconnecting, we delete the authorization.

When viewing or interacting with channel content, the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google Privacy Policy (https://policies.google.com/privacy) also apply.

TikTok

The MU Unit uses the TikTok API (Login Kit and Content Posting API) to publish videos and photos on the official server profile and to read the name, photo, numbers, and video list of this profile. This integration is used only by the MU Unit administration, with the server's TikTok account, and does not access player data or data of those who watch the videos.

We store, encrypted, the authorization given by TikTok and the identifier, name, @, and photo of the profile. The authorization can be revoked at any time in the security settings of the TikTok app, in app permissions, or by the Disconnect button on the server panel; upon disconnecting, we delete the authorization.

When viewing or interacting with the profile content, the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service) and TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy) also apply.

How long we keep

• Account, characters, account activities and questions to the site's AI: while the account exists or until you request deletion.
• Access logs (IP, date and time of sessions): at least 6 months, as required by the Marco Civil da Internet.
• Acceptance of Terms and Voice Rules: while the account exists and for up to 5 years afterwards, to prove what was agreed.
• Records of protection against cheating, reports and punishments: while the account exists and, afterwards, for the time necessary for defense in a process, up to 5 years.
• Payment, refund and withdrawal records: for the period required by law.
• Own visit measurement: 90 days.
• Conversations with the AI inside the game: 30 days.
• Voice usage numbers: 30 days.
• Launcher network measurements: 7 days.
• Failed login attempts: 1 day.

Security

The site password is stored with hash (scrypt), session tokens only as hash, and the secrets of two-step verification and integration keys are encrypted.

The game account password must be read by the game server at login and is stored in the game database, with restricted access to administration. Use a password that you do not use anywhere else and enable two-step verification in My Account.

If a security incident occurs that may cause significant risk or damage, we notify the affected holders and the National Data Protection Authority, as required by the LGPD.

Your rights

Under LGPD, you can request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data (date of birth changes only by support, with proof);
• anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• data portability;
• information about who we share with;
• review of decisions made solely by automated means, such as automatic suspension for cheating;
• deletion of data and account closure, respecting the records that the law requires to be kept.

Make the request to suporte@muunit.com or by opening a ticket at https://muunit.com/conta/suporte. We respond within 15 days. You can also file a complaint with the National Data Protection Authority (ANPD).

Children and teenagers

The MU Unit is exclusively for individuals over 18 years old. We do not accept registration of minors and do not intentionally collect data from children or adolescents.

If we know that an account belongs to a minor under 18 years old, we suspend the account and delete the data that we do not need to keep by law.

Parents and guardians can request the deletion of a minor's data and the return of contributions made by them, with proof of relationship, at suporte@muunit.com.

Changes to this policy

When this policy changes, the date and version at the top of this page change as well. Important changes are also announced on the site.

This page may appear automatically translated. In case of difference, the Portuguese text prevails.