Política de privacidade

1. Controller

The controller responsible for data processing is WERBEDREI, Gewerbestrasse 2, 2102 Bisamberg, Austria (further details in the legal notice at https://nebulonx.io/en/imprint). For any privacy question or request, contact us at [email protected].

2. Visiting the website

When you open nebulonx.io, our web server processes technically necessary information: your IP address, date and time, the requested address and your browser identifier. This is needed to deliver the pages and to fend off attacks (legitimate interest, Art. 6(1)(f) GDPR). We keep these logs only as long as needed for these purposes.

The website sets no cookies. In your browser storage (localStorage) it remembers at most the language you chose and whether you closed the language hint. This information never leaves your device.

The “Galaxies”, “Status” and home pages fetch public key figures directly from our galaxies (for example g1.nebulonx.io), without cookies. We serve fonts and images ourselves.

On the “Vote” page we show the banner of a games portal, which your browser loads from that portal’s server (currently topg.org). The portal learns your IP address in the process; we do not send a referrer. Only when you click through does the portal’s privacy policy apply.

3. Your NebulonX account

For your account we process the data needed for the game (performance of contract, Art. 6(1)(b) GDPR):

• email address, display name, language and a public account ID; optionally your country of origin (never derived from your IP address) and who may see your profile,
• collection, medals, season results, account level, star shards and their transactions, Premium periods, friends, previous names and alliance memberships,
• your settings (for example notifications and who may message you),
• passkeys: only the public key, a key identifier and information about the device type. The private key stays on your device.

Sign-in: you sign in with a link sent by email (valid for 24 hours) or with a passkey. For your session we store only a check value (hash), plus your IP address as a non-reversible check value (for IPv6 only the network) and a shortened browser identifier, so you can recognise your signed-in devices and we can detect misuse. We delete expired sessions after 30 days.

Consent and announcements: when you create your account, and when a new version of the Terms of Service requires your express consent, we store when you agreed to which version and confirmed your minimum age (with the check value of your IP address in the account log). When we announce a new version to you by email, we store which version it was and when the email was sent to you. Both serve as proof (legitimate interest, Art. 6(1)(f) GDPR) and are kept for as long as the account exists.

When you enter a galaxy, the account passes on what the galaxy needs for the game: account ID, name, language, status, Premium, level, country, friends, collection and your settings.

Surveys: if you voluntarily take part in a survey by the team (in your account under “Surveys”), we store your answers without any link to your account, without a timestamp and under a random ID — the results never show who answered what. Separately, we only remember that your account took part (the day and any Star Shards credited), to prevent taking part twice and to credit the reward once (performance of contract, Art. 6(1)(b) GDPR); we delete this record 90 days after the survey ends. A reward appears in your wallet like any other transaction. Please do not write anything in free-text answers that could identify you.

4. Playing in a galaxy

In each galaxy we store your game state (planets, buildings, research, fleets, reports, ranking) and what you write there: messages, alliance feed posts, alliance chat messages, applications, notes, names of planets and alliances. The legal basis is performance of contract (Art. 6(1)(b) GDPR). Most galaxies run in seasons: at the end of a season the galaxy is reset, planets, fleets, reports and messages are deleted, while alliances and their feed remain. A persistent galaxy has no season end: there your game state and your messages are kept until the galaxy ends or is reset. There is no shorter period for messages there; if you delete a message in your inbox, it only disappears for you.

In every galaxy we delete older game history even before that: completed flights as well as espionage, radar and survey reports after 30 days, battle reports, completed trades and the logs of points and karma after 90 days. This does not apply to reports you have saved with a star, or to battle reports in the Hall of Fame, in the records or attached to a ticket. Of your points history, only one value per day is kept after 60 days.

You upload alliance logos as images. We re-encode them and store them without metadata. If the logo is replaced or the alliance is disbanded, we delete it.

Game analysis: in galaxies where we announce it (for example an alpha or test galaxy), we additionally record how the game develops in order to improve balancing: once a day the game state of every player (planets with buildings, fields, biome and storage; research, ships, defence, class and skills), every flight (mission, origin, target, ships, cargo, times, outcome) and the decisions of the bots; there we also keep the resource bookings and the bots’ expedition reports for that long. This contains only game states and game actions with your player ID, no messages and no connection data. The legal basis is our legitimate interest in a balanced game (Art. 6(1)(f) GDPR). We delete this record 30 days after the end of the season, even if the galaxy is reset before that.

5. Fair play and security

To detect multiple accounts, bots and attacks, we store characteristics of your connection when you sign in to a galaxy: IP address, network and browser identifier, but only as non-reversible check values (created with a secret key, no plain text), for 30 days. In addition there are counters of your game activity per hour (14 days), hits of our rate limits (30 days) and check results (90 days). The legal basis is our legitimate interest in a fair and secure game (Art. 6(1)(f) GDPR).

Actions taken by our team (for example suspensions) are logged so that they remain traceable; we delete these entries after 24 months.

6. Payments via Stripe

You pay for Premium via Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your payment details directly into Stripe’s payment form; we never see them. The payment form only loads when you click “Buy”.

We send Stripe the amount, currency, package, an internal payment and account ID and your email address for the payment receipt. To calculate VAT, Stripe processes your country, and for the USA and Canada also your postal code.

For each purchase we store: package, amount, currency, tax country and amount, the Stripe payment ID, its status, the time of your consent to the immediate start (right of withdrawal) and your IP address as a non-reversible check value. To show the right currency, we roughly determine your country from your connection.

We keep the record of a purchase (package, amount, currency, tax country and amount, Stripe payment IDs, time of your consent to the immediate start) for seven full calendar years after the year of payment, as required by Austrian tax law (§ 132 BAO), and delete it afterwards. The record refers to your account only by a random ID, not by name or email address; if your account is deleted, it remains in this pseudonymised form. We delete the check value of your IP address on a purchase, purchases that were never completed and Stripe’s technical notifications after 13 months. The email address for the payment receipt is held only by Stripe.

The legal bases are performance of contract (Art. 6(1)(b) GDPR) and statutory retention obligations for accounting records (Art. 6(1)(c) GDPR). Stripe’s own privacy policy also applies to the processing at Stripe.

7. Emails

Without you doing anything, we only send emails your account needs: sign-in links, confirmation of a new email address including a notice to the old one, notices about registration, and announcements of new versions of the Terms of Service and this privacy policy. At your request we also send an email when a galaxy opens that you asked to be notified about in your account (“Notify me at launch”): once, because you asked for it (Art. 6(1)(b) GDPR); we delete that request 30 days after this email. We never send advertising from third parties; our own news only with your consent.

News by email: only if you expressly consent (Art. 6(1)(a) GDPR) do we write to you about news from NebulonX, for example when a new galaxy opens or a season starts. You can consent with a separate checkbox when you register or in your account under “Notifications”; it is never preselected, and you do not need it to play. You can withdraw your consent at any time there or via the “Unsubscribe” link in every such email; the withdrawal takes effect for the future. For this we store when and where (registration or account) you consented and to which wording, and when and how you withdrew; as with the consent to the Terms of Service, the account log contains an entry with the check value of your IP address. We keep this proof for as long as your consent exists and for 3 years after a withdrawal, so that we can show that we were allowed to write to you (Art. 7(1) and Art. 6(1)(f) GDPR); if your account is deleted, we delete it along with it. We remember which news was sent to you for 30 days so that nothing arrives twice.

We use Microsoft 365 (Exchange Online) to send emails. Emails to us pass through Hornetsecurity’s filtering service, which checks them for spam and malware, and then also arrive in Microsoft 365.

8. Tickets and “Report a problem”

When you write us a ticket or report a problem, we store your text, the replies and any images you attach. With “Report a problem” we add technical information that helps us find the bug: browser identifier, screen size and language settings.

We scan images for malware and re-encode them, removing metadata such as camera and location data (GPS). They are only visible to you and our team. Images you upload but never send are deleted after 24 hours.

Closed tickets (in your account and in the galaxies, including “Report a problem”) are deleted together with their messages and images 12 months after the last change; open tickets are kept until they are resolved. The legal basis is performance of contract or your request (Art. 6(1)(b) GDPR).

9. Connections with other services

If you voluntarily connect your NebulonX account with Discord, Steam, Xbox (Microsoft), Apple or Google, you sign in there and the service sends us your ID at that service and, where the service provides it, your display name there. We store only these two items, to show the connection, to prevent misuse of the one-time reward and, for Discord only, to keep your roles on the NebulonX Discord up to date (“Linked Roles”: account connected, account level, number of galaxies, account age, account name); for this we additionally store an encrypted access key for Discord. We do not receive or store your email address, password or any other profile data.

The legal basis is your consent (Art. 6(1)(a) GDPR) or the performance of the terms of use (point b); you can disconnect any connection at any time under Profile → Connections. We then delete the ID, name and key immediately; only a non-reversible check value (hash) of the ID remains so that the one-time reward is not paid out again (legitimate interest, point f). The privacy policy of the respective service applies to signing in there.

10. Push notifications

Push notifications are only sent if you allow them in your browser (consent, Art. 6(1)(a) GDPR). We then store the delivery address your browser creates for this, the associated keys and the browser identifier. Notifications are delivered through the push service of your browser vendor (for example Google, Mozilla, Apple or Microsoft). You can turn push off at any time in the game or in your browser; we delete invalid subscriptions automatically. We keep a log of which notifications we delivered for 90 days.

11. Usage statistics and error reports

To improve the game, we count which features are used and where on a page people click. For players we only store totals across all players, never per person, without timestamps and without text. Hourly values are deleted after 90 days (legitimate interest, Art. 6(1)(f) GDPR).

If an error occurs in the game, your browser sends a technical error report. We store it with your player ID but without your IP address, and delete it after 30 days.

12. Cookies and browser storage

We only use technically necessary cookies, without tracking. No consent is required for these.

• Account (account.nebulonx.io): session cookie for sign-in, 30 days, extended when you use it; short-lived cookies for the sign-in link (1 hour), registration (30 minutes) and passing your sign-in on to a galaxy (15 minutes).
• Galaxies: session cookie for sign-in, 7 days after signing in via the account, otherwise 30 days; a cookie for the sign-in link (1 hour).
• In your browser storage (localStorage, sessionStorage) the website, account and game remember settings such as language, time zone and display, as well as intermediate states (for example a purchase you started). This information stays on your device.

13. Hosting, Cloudflare and backups

Our servers are located in a data centre in Germany. For name resolution (DNS) and partly as an upstream network service (proxy) we use Cloudflare. Requests then pass through Cloudflare’s servers, which process your IP address (legitimate interest in fast operation protected against attacks, Art. 6(1)(f) GDPR).

We back up our databases regularly. Off-site backups are encrypted beforehand and stored with Cloudflare R2 in the EU; they are deleted automatically after about 30 days.

14. Recipients and transfers to third countries

Your data is only seen by our team and the service providers named above, as far as their task requires: Stripe (payments), Microsoft (email), Hornetsecurity (email filtering), Cloudflare (network, backups), and at your request the connected services and your browser’s push service. Some of these providers are based in the USA or process data there. They base the transfer on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses (Art. 45, 46 GDPR).

Other players see what is public: name, profile (depending on your setting), ranking, alliance and what you write in messages or the feed.

15. How long we keep data

We only keep data for as long as it is needed for the respective purpose. The most important periods:

• sign-in links: 24 hours; expired sessions (account and galaxies): 30 days
• connection characteristics for fair play: 30 days; check results: 90 days
• error reports: 30 days; hourly usage values: 90 days; push delivery log: 90 days
• closed tickets with their messages and images: 12 months after the last change (open tickets until they are resolved)
• taking part in a survey (which account took part): 90 days after the survey ends; the answers themselves are stored without your account from the start
• votes: 400 days; account log and log of our team’s actions: 24 months
• game state and messages of a galaxy: until the end of the season, in a persistent galaxy until the galaxy ends or is reset
• older game history in every galaxy: completed flights, espionage, radar and survey reports 30 days; battle reports, completed trades, logs of points and karma 90 days (reports with a star and battle reports in the Hall of Fame, records or tickets are kept)
• alliance chat messages: 7 days; reported ones are kept as a copy in the ticket
• game analysis (only in announced galaxies): 30 days after the end of the season
• payment records: seven full calendar years after the year of payment (§ 132 BAO), pseudonymised; check value of the IP address on a purchase, purchases never completed and Stripe’s technical notifications: 13 months
• consent to the Terms of Service (time and version), proof of the emails announcing new versions, and account: as long as the account exists
• consent to news by email (time, way, wording, withdrawal): as long as it exists, 3 years after a withdrawal; which news was sent to you: 30 days; request to be notified at the launch of a galaxy: 30 days after the launch email

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future. Just write to [email protected] from the email address of your account.

You can also lodge a complaint with a data protection supervisory authority, for example the Austrian Data Protection Authority (https://www.dsb.gv.at) or the authority of your country of residence.

17. Children and young people

NebulonX is intended for people aged 16 and over. Anyone younger needs the consent of their parents or legal guardians.

18. Changes

If the game or the law changes, we will update this privacy policy. We will inform you of every new version by email to the address of your account at least 30 days before it takes effect (as described in section 13 of the Terms of Service). You can always find the current version at https://nebulonx.io/en/privacy-policy.