Operations and Security

How Yvaldis will be operated once it exists. None of this is needed in the proof of concept (35), which has no network, accounts or outside players; it exists so that today's decisions (authoritative server, layered economy, 18+ for economy) do not run into surprises. Section 9 uses declared assumptions and section 10 brings questions, not conclusions; nothing here is a legal opinion.

1. Principles

1. The server decides; the client only asks (05).
2. Tiny team: whatever can be automatic, logged and reversible, is. A human moderator is the last resort.
3. Log in order to undo: every relevant economy and combat event goes into an immutable log; punishment and refunds are reversible.
4. Less data, less risk (section 7).
5. Security proportional to what is at stake: those who play without economy require little; wallet, market and withdrawal require a lot (08).

2. Moderation

Reports. Button on name, chat, private message, player content (sign, clan name, contract, house) and behavior (harassment, griefing). The report automatically attaches the context: the last 2 minutes of chat, positions and combat events, ids. Queue by severity: (1) threats, minors, doxxing, handled within hours; (2) real-money fraud (only in Phase 4); (3) harassment and hate; (4) spam and offensive names. Mass reports from a rival clan against one account do not punish on their own, they only open a review (prevents reporting as a weapon, 19, 23). Mute, block, hide global chat and "friends and party only" are always at hand and solve most cases.

Chat filter. Layers: list of terms and variations, per-minute limit, repetition detection, blocking of links and external invites for new accounts, blocking of typical scams ("selling gold", login requests). Minors (no economy and no voice, 05) do not receive messages from strangers by default. Voice only for verified 18+, with a short buffer for reporting and a minimum retention period (legal question). It starts with rules, cheap and explainable to those punished; toxicity classifier later.

Player-written content (24). Names and signs pass through a filter before appearing; long texts (city laws, diaries) only on objects one chooses to open, not above everyone's head. No upload of player images, sounds or 3D models at launch: it is the shortest path to illegal content and copyright violations. Decoration comes from a closed catalog (which also allows NFTs without IP risk, 08). Offensive text in a house or shop leaves the object "blurred" to others until review, instead of punishing immediately.

Ladder: warning → mute (24 h, 7 d, 30 d, as in 32 §10) → suspension → loss of economy privileges → ban. Every step has a written reason and appeal; a ban for fraud links to the verified person (if there is KYC), not just the device. Killing a player in open PvP is part of the game (karma, 23); what is punished is days of stalking, spawn camping and insults.

3. Support with a tiny team

Model: self-service first, one person next, no phone.

• Help center in the launcher with guided flows: recover account, missing item, report, contest punishment, refund.
• Single form; the system gathers the account log (latest actions, items, session). Most "I lost an item" cases are solved by reading the log.
• Support never creates an item out of nowhere: it restores what the log shows existed, from a snapshot, with a value cap per case; above it, a second person (the owner, at the start).
• Honest SLA published (e.g. up to 3 business days); a general incident goes to the status page and Discord, not to tickets.
• Volunteers (mentoring, 24 §5) answer game questions; only staff touch accounts, assets or punishments.
• Load: assumption of ~1 ticket per 100–200 active players per week. Hire the first support person when the queue exceeds ~2 days of delay for two weeks in a row.
• Non-custodial wallet (05): the studio does not recover keys or reverse transactions. The help page says this before the wallet is created.

4. Anti-cheat

The client belongs to the attacker; the server only accepts what is possible.

Statistical detection: superhuman precision and reaction, perfect aim, XP/hour beyond 3 deviations from the general population generate a suspicion score for human review; only certain technical proof (repeated impossible speed) punishes on its own. Each anomaly stores the input sequence, to reproduce it and to support the appeal. Test: our own "cheating clients" (out-of-range strike, teleport, hand too fast) run against the server in CI and all must be rejected.

5. Anti-bot

• Behavior signals (no invasive collection): sessions of 20+ h, identical routes, near-zero interval variance, never speaks or reacts to events, gathering fixed at one spot, inhuman market pace. Score per account, human review above the threshold.
• Design that discourages farming: daily production cap per account, diminishing returns at the same spot, gathering minigames with human input, real-time respawn with a cap, NPC raw material bound to the account (00 E5, 08).
• Light challenge (a gesture, an object) only on suspicion, never for everyone.
• KYC only for economy functions (wallet, token market, withdrawal, land): one verified person = one eligible account (00 E5). Those who play without economy hand over no documents.
• RMT: daily gold cap between players, fee, "mule" detection (many new accounts sending to one). Gold never becomes a token (00 E2), which removes the main incentive.

6. Account security

• Mandatory 2FA for wallet, market, withdrawal and email change; recommended (with a cosmetic benefit) for the rest. Priority: authenticator app and passkey; SMS only for recovery.
• Slow hash (argon2id), check against leaked passwords, limit and gradual lockout of attempts.
• Short session token, device list, new-login alert, "sign out of all".
• Slow recovery on purpose (24–72 h to change a factor, with a notice to the old email): it is the attacker's path.
• The game never asks for the wallet recovery phrase; scam alert in the launcher; large transactions ask for extra confirmation.
• Official domain, launcher and store as the only origins; monitor domains similar to yvaldis.com/.net (00 #9).
• Secrets in a vault, none in the repository; named production access, with 2FA and logging. The Blender MCP stays bound to localhost (12).

7. Personal data (LGPD and GDPR basics)

• Data map before the first open server: what is collected (email, id, IP, logs, chat, KYC result), why, where it is kept and for how long.
• Contract performance and legitimate interest cover the essentials (to be confirmed); extra telemetry and marketing require separate, switchable-off consent.
• Data subject rights (access, correction, deletion, portability) through an account flow, with deadlines. Deletion coexists with what the law requires keeping (tax, KYC, fraud) and with the blockchain, which does not erase: put no personal data on-chain, only address and item metadata.
• KYC through a licensed partner, which keeps the document; the studio receives only "verified, 18+, country" and an id.
• Retention (assumptions): chat 30–90 days, combat logs 30 days, economy logs several years, backups with a fixed term.
• Servers in São Paulo and US East imply international transfer (legal basis is a question for the lawyer).
• Privacy policy and data protection officer (DPO; at the start the owner, with a public channel) before the first outside player. A leak follows the plan in section 8; GDPR speaks of 72 h to notify the authority, to be confirmed.

8. Incidents and backups

Classes: S1 (gold/item duplication, leak, server or contract intrusion), S2 (general outage, character corruption), S3 (limited exploitation, one-off DDoS), S4 (the rest). Steps: contain (turn off the feature) → preserve logs and snapshot → understand → fix and restore what the log allows → notify players in plain language (what is known and what is not) → blameless report with a concrete action.

• Per-function switches (market, trade, shop, auction, withdrawal, voice, PvP) without taking down the game; they exist from Phase 2.
• Automatic lock when gold/item creation exceeds N deviations from normal.
• Pausable contracts, multisig for administrative actions, withdrawal limit per window, independent audit before any real value (16).
• Simple rotation with phone alert for S1/S2; the rest waits for business hours. One drill per quarter from Phase 2.

Backups:

• Postgres: daily full + continuous log archiving (recovery to the minute), copy in another region and another account. Retention: 14 daily, 8 weekly, 12 monthly.
• Redis is rebuildable, not a source of truth.
• Snapshot per character at each logout and relevant transaction: restores one player without rolling back the world.
• Monthly restore test (a never-tested backup does not count). Targets (assumption): RPO ≤ 5 min, RTO ≤ 4 h.
• UE project and assets: Git LFS + external copy, from the PoC. Encrypted backups, separate keys.

9. Server cost per concurrent player (Chapter 1)

Order of magnitude, not a budget; Phase 2 measures the real figure (06).

Assumptions: (a) the goals of 00 T1: 10 thousand concurrent per world, ~500 per region server, 30 ticks/s in combat; (b) an 8 vCPU/32 GB instance sustains 500 players (strong assumption, could be half or double) at ~US$ 0.50/h ≈ US$ 365/month; (c) ~5 KB/s per player, network egress at US$ 0.05–0.09/GB; (d) managed database, Redis, account/chat/auction services, balancer, logs and monitoring ≈ US$ 0.30 per concurrent player/month; (e) 30% headroom for peaks and idleness.

• 10 thousand concurrent: US$ 22–29 thousand/month (20 game instances).
• 100 concurrent (alpha): the fixed floor dominates; ~US$ 600–1,000/month across two regions, or US$ 6–10 per concurrent player.
• If the peak were 5% of monthly actives (assumption), that is ~200 thousand actives and **US$ 0.11–0.15 per active/month** of infrastructure, to be covered by cosmetics (08).
• What moves it most: players per instance, the network (much cheaper on a provider with cheap egress or bare metal) and scaling instances by the daily curve (20–40% savings possible).
• Outside the calculation: people, KYC per verification, payment and store fees, contract audit, middleware licenses, DDoS protection.

10. List for the future lawyer (questions)

Gather after the PoC, together with the company (00).

Securities and crypto

• Brazil: with the design of 14 (in-game utility token, buyback with part of the revenue, withdrawal with a cap, no sale), could the token or NFT be a security for the CVM? Does the fact that the studio never sells, only distributes through play, weigh in? Do Law 14.478/2022 and the Central Bank require authorization as a service provider?
• US: does the Howey test reach a token distributed through play, without sale, but with buyback? How does the SEC treat it?
• EU: what is the classification under MiCA; does the exception for a token giving access to an existing service (16) apply? Does a serial cosmetic NFT count as fungible?
• Does buyback with cosmetics revenue create an expectation of profit from the studio's effort? How to word the "small, variable extra" without it becoming a promise?
• Is a non-custodial wallet with on/off-ramp through a partner enough to avoid being a VASP/CASP? Which partner, in which countries?

Gambling and reward boxes

• Are auctions, lot draws among registrants (25), rare drops and the casinos on hold (23) gambling in BR, US or EU? Do they need authorization?
• With no purchasable source of chance (08), does no local law treat the game as loot box? How does the ECA Digital (reported ban on loot boxes for under-18s) apply to a drop that is not purchased?
• If the token becomes money, what becomes a "bet" inside the game?

Terms and ownership

• ToS and privacy for an online game with economy: moderation, banning, appeal, jurisdiction.
• NFT if the game shuts down: what does the player actually own? What warning before purchase? Is there a duty to refund, give advance notice or keep data? And the land deed when the world disappears?
• Rights over player creations and liability for their content (Marco Civil; DSA).
• Do Fab/CC0/CC-BY licenses allow selling an NFT of a derived item? Is there a blockchain clause in an engine or store (35 §5)? What to say about AI-made art (12)?

Minors

• ECA Digital (Law 15.211/2025, in force since March 17, 2026 according to the sources consulted): what age verification is required for a free game, chat and voice? What counts as acceptable verification for "18+" (document, facial estimation, card)? Minors' profile, advertising, parental control.
• Age rating (Ministry of Justice), ESRB/PEGI; COPPA and consent by age under GDPR.

Data: legal basis per processing, DPO and RIPD/DPIA, BR–US–EU transfer, minimum retention of KYC and economy, deletion versus data on the blockchain.

Taxes: cosmetics revenue (ISS, PIS/COFINS, ICMS?), revenue and accounting of crypto and of the buyback fund, taxation of the player's "extra" and reporting duties (Receita, DAC8), VAT and sales tax, company type and jurisdiction.

Company and IP: corporate type, contracts and assignment of rights, registration of Yvaldis at INPI/USPTO/EUIPO (00 #9), liability and cyber insurance.

11. Rollout order