Features How It Works Ecosystem & Store Policy & FAQ
Download Launcher
Effective Date: June 14, 2026

Data Handling Protocol

This Data Handling Protocol outlines how user data, automated tokens, and financial point ledgers are processed internally within the HyRockersGaming infrastructure. Unlike a public privacy policy, this document serves as your operational blueprint for backend data management, security, and pipeline architecture for the MVP.

1. Data Classification Matrix

To ensure compliance and security, data passing through the website and launcher is strictly classified into three tiers:

Data Tier Examples Storage Method Access Control
Tier 1: Public / Low Risk Username, Game Playtime, Streak Count, Public Leaderboard stats Standard SQL Database (unencrypted, indexed for speed) Publicly readable via API
Tier 2: Personal / Medium Risk Email addresses, IP logs, purchase history, Point Wallet Ledger Encrypted at rest, isolated database tables Internal automated services only
Tier 3: Critical / High Risk User passwords, Session Tokens, encrypted Third-Party Gaming Credentials (for auto-login) Strongly hashed (bcrypt/Argon2) or asymmetric encryption Zero direct employee access; programmatic token exchange only

2. Secure Automation & Credentials Handling

Because the launcher automates account delivery and automated game login, protecting Tier 3 data is your highest technical priority.

Automated Account Login Flow

  • Zero Raw Text Storage: The launcher must never store raw third-party gaming passwords. Instead, authentication must rely on OAuth2 tokens or secure session refreshes where applicable.
  • Local vs. Cloud Storage: Temporary session tokens used by the launcher client should be encrypted locally using the operating system's secure credential storage tool. Windows: Windows Credential Manager / DPAPI. Linux: Secret Service API / Libsecret.
  • Transit Security: All programmatic authentication requests between the launcher client, your website backend, and target game servers must be enforced via TLS 1.3.

Instant Delivery & Webhooks

  • When a user redeems points for a game, the transaction log must be finalized before the inventory system triggers.
  • Webhooks passing game keys or account assignments from your store database to the launcher must use cryptographically signed payloads (e.g., HMAC-SHA256 signatures) to prevent users from fabricating delivery success signals.

3. Reward Points & Wallet Ledger Integrity

A digital economy is a prime target for database manipulation. Your data handling for the wallet system requires strict financial-grade logging.

  • Immutable Transaction Logs: Point updates must never simply use an UPDATE wallet_balance SET points = points + 10 SQL query. Every single point earned or spent must create a separate, immutable transaction row (Transaction_ID, User_ID, Delta_Points, Action_Type, Timestamp).
  • Reconciliation Engine: The system must periodically run a backend script to recalculate the sum of a user’s transaction rows and verify it matches their active displayed balance. Discrepancies should automatically freeze the wallet for review.

4. Telemetry & Anti-Cheat Monitoring

To prevent users from exploiting the daily streak and point systems via memory editors or macros, the launcher collects lightweight telemetry.

  • Process Verification: The launcher monitors the execution state of the target game executable to verify it is actively running.
  • Focus Tracking: To prevent users from simply leaving a game running minimized in the background for 24 hours to farm points, the launcher tracks window focus states and lightweight mouse/keyboard activity counter metrics without logging actual keystrokes.
  • Data Isolation: Telemetry logs used for anti-cheat verification are kept entirely separate from marketing or personal profile data and are routinely overwritten.

5. Data Retention and Purging Schedule

To reduce database bloat and legal liability, data is systematically purged once its operational utility expires:

  • Session Tokens: Expire and are deleted after 30 days of inactivity, forcing a secure re-login.
  • Anti-Cheat Telemetry Raw Logs: Automatically overwritten or permanently purged every 14 days.
  • Failed Login/IP Rate-Limit Logs: Kept for 7 days to analyze malicious brute-force patterns, then cleared.
  • Deleted Accounts: Upon user request for deletion, personal data fields are hard-deleted or completely anonymized, e.g. changing user_123 email to anon_123@deleted.hyrockersgaming.com, to preserve historical sales and financial bookkeeping analytics without keeping personal identifiable information.