Who is responsible for your data?
The data controller for NexusRPG is Yusuf Keskin, Grantofteparken 248, 2750 Ballerup, Denmark. For privacy questions, contact support@nxrpg.com. No data protection officer has been appointed; privacy requests go to this contact address.
1. Information we collect
We collect account information you provide, such as your Character Name, email address and, when you create one, securely hashed password credentials. If you use Sign in with Apple, we store Apple’s app-specific account identifier, the verified email or private relay address Apple shares, and encrypted credentials needed to keep or revoke that connection. We do not receive your Apple ID password.
We also store game data including progression, inventories, transactions, purchases, kingdom and clan activity, settings and achievements. Native purchase records can include the product, transaction and account identifiers required to verify an App Store or Google Play purchase. Optional push notifications require a device delivery token.
2. Activity, chat and moderation data
NexusRPG records gameplay activity needed to operate persistent systems. Chat messages, reports, moderation actions and relevant audit records may be retained to protect players, investigate abuse and enforce the Game Rules. A recent activity timestamp is used to calculate the public online-player count.
Poll results show totals publicly. When you cast or reconfirm a vote after the public-voter feature was introduced, your Character name and chosen answer become visible to other players. Earlier votes remain anonymous unless you choose to reconfirm them.
GameGuard temporarily evaluates server-side action timing and the number of active account sessions to identify machine-like play. It does not create a device fingerprint. A challenge stores the resulting risk score and named signals so authorised staff can review why it was issued.
3. Sessions and cookies
Essential cookies and browser storage are used for login, security, protection against forged requests, saved interface preferences and in-progress drafts. NexusRPG currently does not use optional advertising or analytics cookies. If optional technologies are introduced, we will explain them and ask for consent where required before using them.
To understand how people find the game, authorised staff can view optional registration answers and daily totals of incoming website sources. The source report stores only the referring website hostname, date and entrance count for up to 180 days—not full URLs, visitor identifiers or IP addresses—and sets no tracking cookie. If the browser does not supply a source, it is counted as Direct / unknown. These counts are not linked to your account.
4. Purposes and legal bases
- We create accounts, operate persistent gameplay, provide requested Support and deliver purchases to perform our contract with you (GDPR Article 6(1)(b)).
- We secure accounts, detect abuse, moderate player content and improve game balance and reliability based on our legitimate interests in running a safe service (Article 6(1)(f)). You may object to this processing.
- We keep and provide records when required by law, including applicable accounting records (Article 6(1)(c)).
- We send the optional email newsletter only with your consent (Article 6(1)(a)). You may withdraw it in Settings at any time without affecting earlier lawful processing.
- We publish aggregated game statistics without displaying private email addresses.
5. Services that process information
NexusRPG uses its own hosted game service to provide the shared world. Apple may process Sign in with Apple, App Store purchases and optional Apple Push Notification delivery; Google may process Google Play purchases and optional Android push delivery. Our transactional email provider delivers verification, security and requested account messages. Stripe processes purchases made on the website, but Stripe checkout is not offered inside the iOS app. These providers process only the information needed for their service under their own terms and privacy obligations.
NexusRPG does not sell personal information, use third-party advertising SDKs or combine app data with third-party data for advertising tracking.
6. Security and retention
Reasonable technical safeguards are used, but no online service can promise absolute security. The normal retention periods below may be extended when a record is linked to an open Support case, payment dispute, security investigation or legal obligation.
- Personal notifications expire after 30 days.
- Closed Support tickets are removed after 30 days; the staff audit trail for the action is retained.
- Detailed Auto-action ticks expire after 7 days, while compact progression totals remain.
- Public Chat is normally retained for 180 days. Private or reported evidence may be retained longer when needed for safety or moderation.
- Login, network, GameGuard and moderation records are retained while reasonably needed to detect abuse, investigate a report or defend account access.
- Purchase, economy ledger, permanent progression and shared-world records are retained while the account or world record exists and longer where accounting, dispute or legal duties require it.
7. Policy changes
Data structures and retention needs may change as the game evolves. If this policy changes materially, its version will be updated and renewed acceptance may be requested.
8. Access, correction and deletion requests
You can permanently delete your account inside the app from Menu → Settings → Security → Delete account. Where possible, deletion also revokes the connected Apple authorization. For help accessing, correcting, exporting or requesting deletion of personal information, contact support@nxrpg.com. Support records the request and provides the available account data through an authenticated response. Some records may need to be retained for security, purchases, disputes or legal obligations.
Depending on the circumstances, you may also request restriction of processing or object to processing based on legitimate interests. You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or the supervisory authority where you live.