# V2 Privacy Policy

This policy is the product and engineering baseline for V2 telemetry, analytics,
ghost data, crash reports, balance experiments, and public esports results.

## Telemetry Collection

V2 telemetry is published only through canonical `@oshun/event-bus` topics and
then routed through `v2-telemetry-firehose` to the warehouse dataset
`warehouse.v2_telemetry.events`. The ingest path strips PII before warehouse
storage and rejects raw account identifiers. Client payloads must use hashed
account identifiers or match-scoped identifiers.
`@v2/telemetry-privacy-compliance` strips PII before warehouse storage for
optional analytics and attaches the `v2-telemetry-privacy-retention-v1` policy
to accepted events.

Core events cover match start/end, move frequency, per-move damage, combo
length, drive/heat/hype/stun resource use, finisher triggers, rage quits,
symbolicated crashes, and frame-budget exceedance.

## Opt Out

Players can disable optional telemetry from the privacy settings surface. The
preference is stored outside normal save data and remains active after a save
reset, profile reset, or new local slot creation. In product terms, telemetry
opt-out persists across save reset boundaries. The localized string key
`Privacy.TelemetryOptOut` explains this behavior in the launch string table.

Required operational telemetry is limited to platform, crash, security,
purchase, and compliance facts needed to operate the game and meet platform or
legal obligations.

## Ghost Data

Ghost match capture and sharing are off until the player opts in. The player can
enable friends-only sharing, global pool sharing, both, or neither. The
localized string key `Privacy.GhostSharingOptIn` is the launch disclosure for
this control.

Ghost data uses `v2.player.ghost.match.captured` and
`v2.player.ghost.share-consent.updated`. Revoking consent stops future sharing
and removes unexpired entries from friends/global discovery pools.

## Player Analytics

The segmentation model groups accounts into Casual, Competitive, CosmeticBuyer,
Completionist, Spectator, EsportsAspirant, Returning, and AtRisk segments from
play-pattern features. Churn scoring is refreshed weekly.

At-risk re-engagement can grant cosmetics or invite players to a free weekend.
It must never pressure a player into a paywall, exploit loss aversion, or hide a
gameplay-affecting item behind a purchase.

## Balance Experiments

Balance A/B tests use explicit assignment and public-result topics, include a
rollback runbook, and stay outside rollback simulation authority. Post-patch
public results must summarize before/after pick rate, win rate, and drop rate
per affected fighter or move. PTB regressions can place a patch hold before
release.

## Crash And Performance

Crash reports are symbolicated before triage. Dev builds keep fault injection in
the loop so crash reporting and recovery paths stay exercised. Performance
telemetry enforces 60Hz simulation and 60+ fps render targets with per-platform
budgets.

## Public Esports Results

The public archive at `apps/v2/web/esports/results/` exposes tournament event,
player, fighter, date, bracket, result, and replay-link search. Public results
must not expose private account identifiers, internal moderation state, or
non-public player contact information.

## Data Rights And Regional Compliance

The launch compliance register lives at `V2/docs/legal/data-categories.md`.
Players can submit Access, Rectification, Erasure, Portability, Restriction, and
Objection requests from the privacy settings surface or linked web DSR form.
Requests require account 2FA and route through `@themis/privacy` plus
`@oshun/data-residency`.

Cosmetic wagering thresholds are controlled by
`V2/docs/legal/wagering-thresholds.md`; regions with legal uncertainty default
to disabled until a local rule file is approved.

The extended privacy baseline is `V2/docs/legal/privacy-compliance-extended.md`.
It adds the public sub-processor registry, California minor-protection defaults,
Quebec and Brazil regional privacy controls, France paid product-placement
disclosure, Italy and Belgium no-loot-box SKU disclosures, erasure audit scope,
and privacy ops on-call. The public sub-processor list is mirrored at
`V2/legal/sub-processors.md` and `apps/v2/web/legal/sub-processors/`.