Privacy Policy

1. Who we are

Nandonia is operated by a sole trader based in Western Australia, Australia. We run the browser game at nandonia.com.

We are the data controller for the information described in this policy, which means we decide what is collected and why. This policy explains what we actually collect, what we do with it, and what you can ask us to do about it.

You can reach us about anything on this page at [email protected].

2. What we collect

We have tried to list everything, rather than give a vague category list. If you spot something we hold that is not described here, please tell us so we can fix the policy.

Signing in

There are three ways to sign in to Nandonia: a Google account, an Apple account, or a Solana wallet. One account uses one sign-in method. We do not link them together.

• Which of the three methods you used.
• An identifier from that provider. For Google and Apple this is an opaque subject ID that means nothing outside their systems.
• Your email address, where the provider gives us one. If you use Apple's Hide My Email, the only address we ever receive is Apple's private relay address, and that is all we store.
• An account ID we generate for you, plus the times your account was created and last signed in.

Wallet sign-in works differently and you should understand it before choosing it. The identifier we store is your public Solana wallet address itself, in plain form, for as long as your account exists. A wallet address is a public identifier: anyone who learns it can look up that address's activity on the Solana blockchain, and can potentially connect your Nandonia account to anything else you do with the same wallet. No email address is collected on this path at all, so wallet sign-in gives us less contact information about you and a more public identifier for you. If that trade is not one you want, use Google or Apple instead.

To prove you control a wallet we generate a one-time challenge phrase for you to sign. Those challenges are short-lived and are deleted once they expire.

Your country

We store a two letter country code, recorded when you sign up and updated when you sign in. It comes from the CF-IPCountry header that Cloudflare adds to requests reaching our servers. We do not store the IP address itself in our database. See the note on server access logs below, which is a separate matter.

Network addresses and browsers

When you sign in, and periodically while you play, we store a one-way hash of your IP address, made with a secret key, together with your browser's user-agent string (which names the browser and operating system). We use them only to detect one person running several accounts, which the Terms do not allow. We never store the IP address itself. Each record is deleted 180 days after we last see it. Your sign-in sessions carry the same hash, and they are deleted on the schedule in section 6.

Your game

• Lands, cities, buildings, resources and their history.
• Envoys, their skills, journeys and investments.
• Achievements, leaderboard positions, and player statistics.
• Daily login streaks and a per-day record of whether you were active.
• A ledger of in-game currency movements, including Gold you have bought and spent.
• Records of delves, discoveries, wonder visits, trades and other in-game actions.

Purchases

If you buy Gold, no card details ever reach Nandonia. Stripe collects them on its own hosted payment page and we never see or store them. What we store is a record of the purchase: the Stripe transaction and payment intent references, the amount, the currency, which Gold pack you bought, how much Gold was credited, and whether the payment succeeded.

If you pay with SolanaPay we store the on-chain reference for the payment. Payments on a public blockchain are public by nature: the transaction, the amount and the addresses involved are visible to anyone, and that is a property of the network rather than something we control.

Text you write

• Your display name, your city names and your envoy names.
• In-world writing: diary fragments, scholar's notes, inscriptions and custom lore choices.
• Reports you file about other players, including the reason you give.

We keep the original wording of anything you submit even when it is rejected by moderation, and even if you later edit it. We need that record to review moderation decisions, handle appeals, and deal with anyone who repeatedly submits abusive content.

Email updates

At some point while you play, we ask you once whether you would like email from us. If you signed in with Google or Apple, we store your answer, yes or no, and when you gave it. We also keep a record of every answer you give, including any later change on your profile page: what you chose, when, which version of the question's wording you saw, and where you answered. That record is how we can show that you agreed, if we are ever asked. We do not store your IP address with it. Accounts that sign in with a Solana wallet have no email address, so we never ask them.

How you found us

When you create an account we record how you found us: any utm_ parameters in the link you arrived on, the website that referred you, and the page you landed on. It is kept with your account, and only ever written when the account is created, so an account that already exists never picks up a new one.

None of it is stored on your device at any point. While the tab is open the page holds the details in memory, and they are sent to us only if you go on to sign in. Close the tab without signing in and they are gone, with nothing left behind in your browser. Because nothing is stored on your device, this works the same way wherever you are, including the EU, the EEA and the UK. Our lawful basis is our legitimate interest in knowing where players find the game, and you can object to it: see "Your rights" below.

Visit counts

We count page visits using Umami, analytics software we run ourselves on our own server. It is not a third party service: nothing about your visit leaves our infrastructure, and there is no advertising network, data broker or analytics company involved at any point.

For each page view it records the page address, the site that referred you, your screen size, your browser and operating system, your language, and your country. It does not store your IP address, it does not set a cookie, and it writes nothing to your browser's storage. To tell one visit from another within a single day it derives a temporary identifier from your IP address and browser combined with a secret that changes daily, so yesterday's visits cannot be linked to today's, and none of it can be traced back to you or joined to your account.

We also record two named events. The first is that a sign in button was pressed, and which of the three sign in methods it was. The second is that an account was created, and it records nothing else at all, not even which method was used; it is sent only when you sign in with a Solana wallet, because the other two methods take you away to Google or Apple and the page that would send it is gone by the time you come back. Neither event carries your account, your name or your email address, and neither can be traced back to you. They exist so we can tell how many visitors reach the sign in step and how many finish it, which is not something a page count can answer.

If your browser sends a Do Not Track header we record nothing at all.

Errors and server logs

• When something breaks we send an error report to Sentry so we can fix it. A report is about the fault, not about you, but it can incidentally include the page you were on, your account ID, and technical details about your browser or our server. A small sample of requests is also sent for performance monitoring.
• Our web servers keep standard access logs. These do record the IP address of each request, along with the time, the page requested and your browser's user agent string. They are rotated by size rather than by age, which is explained properly in "How long we keep it" below.

3. Why we collect it, and our legal basis

Privacy law in some countries asks us to name a legal basis for each use. Here they are in plain language.

To provide the game you asked for (performance of a contract)

• Creating your account and letting you sign back in.
• Saving your game so it is still there tomorrow.
• Showing your name and achievements to other players where the game is designed to do that, such as on leaderboards and public profiles.
• Taking payment and delivering the Gold you bought.
• Sending you in-game messages about your account, such as a moderation decision.

To run the game responsibly (legitimate interests)

• Moderating names and written content so the game stays suitable for all ages.
• Detecting cheating, multiple accounts, and abuse of game mechanics.
• Keeping the service secure and available, including rate limiting and blocking attacks.
• Diagnosing and fixing bugs from error reports.
• Understanding how players find the game, so we know where to spend a small marketing budget. We keep this narrow on purpose: the link you arrived on, the site that referred you, and the page you landed on, recorded once when the account is created and stored on nothing but our own server.

For each of these we have considered whether our interest is outweighed by your privacy, and we have kept the data narrow because of it. You can object to any use based on legitimate interests. See "Your rights" below.

Because you said yes (consent)

• Emailing you when something you started in the game has finished while you were away, or when your login streak is about to end.
• Emailing you now and then with news about Nandonia, including what is new in the shop.

We only send these if you said yes, and you can switch them off at any time on your profile page. From then on we send none. We are not sending these emails yet. When we start, this page will name the service that delivers them.

Because the law requires it (legal obligation)

• Keeping records of payments for as long as tax and accounting law requires.
• Responding to a valid legal request, such as a court order.

4. Who we share it with

We do not sell your data. We do not run advertising, we have no advertising network, and we use no third party analytics or tracking pixels. Nandonia makes money from optional Gold purchases and nothing else.

We use these service providers, each for one stated purpose:

Google, Apple, Stripe, Sentry, Cloudflare and Helius each have their own privacy policies, which govern what they do with the data they hold. We suggest reading them if you use those services. Helius only comes into it if you choose to pay with SolanaPay: a node provider is how any application reads the Solana blockchain, and reaching the network without one is not practical.

We would also disclose information if the law required it, if it were needed to protect someone from harm, or if the game were ever sold or transferred to another operator. In that last case we would tell players before it happened.

5. Where your data lives

Our servers and database backups are in Australia. Some of the service providers listed above operate globally, so your data may be handled in other countries as part of delivering the service.

If you are in the EU, the EEA or the UK, this means your data leaves that area. Australia has not been given an EU adequacy decision, so there is no official finding that its laws offer equivalent protection. We rely on the fact that transferring your data is necessary in order to give you the game you signed up for. There is no way for us to run your account on servers you can reach without the data arriving on those servers. This is the position described in Article 49(1)(b) of the GDPR.

We would rather be straightforward about this than dress it up: this is a small operation with servers in one country, and if that is not acceptable to you, the honest answer is not to create an account.

6. How long we keep it

We run three timed deletions: action logs after 7 days, sign-in sessions 30 days after they were last used or 3 days after you sign out or the session is revoked, and hashed network addresses and browser strings 180 days after we last see them. Access logs are bounded by size rather than by age, backups are not bounded at all yet, and everything else in the table is kept while your account exists or until you ask us to delete it. The next two paragraphs explain the two awkward rows properly rather than burying them.

About the server access logs: our web servers write access logs that include client IP addresses, and these are rotated by size, not by age. Each service keeps up to ten log segments of 100 MB, so roughly 1 GB in total, and the oldest segment is discarded when a new one begins. That bounds how much is stored, but it does not bound how long any single entry survives: on a quiet service an old entry could sit there for a long time before enough new traffic pushes it out. We have no time-based deletion for these logs, and we would rather say so than imply a retention period we do not enforce.

About the backups: a dated copy of the database is uploaded to Google Cloud Storage every day, and at present nothing deletes the older copies. There is no automatic expiry rule on them, so they are retained indefinitely until we put one in place. This matters for deletion requests, so we want to be direct about it: we remove your data from the live database, but a copy of it may remain in older backups, and we cannot edit a single record out of a backup file. Setting a retention limit is on our list, and we will update this page when it is done.

When you ask us to delete your account we action it in the live database within 30 days, with the backup caveat above. We may keep the minimum needed to meet a legal obligation, such as a payment record, or to stop a banned player simply signing up again.

7. Your rights

We give these rights to every Nandonia player, wherever you live. We have not gated them by region, because we could not think of a good reason why a player in one country should have less control over their data than a player in another.

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix anything that is wrong.
• Deletion: ask us to delete your account and its data.
• Restriction: ask us to stop using your data while a dispute is sorted out.
• Portability: ask for your data in a machine readable form.
• Objection: object to any use we base on legitimate interests.
• Withdrawing consent: where we relied on your consent, such as for email updates, withdraw it at any time. For email updates you can do this yourself with the switch on your profile page. Withdrawing consent does not undo anything done before you withdrew it.
• Complaint: raise a concern with us, or with a data protection authority.

To use any of these, email [email protected]. We will reply within 30 days. We may need to check that you are the account holder before we act, usually by asking you to send the request from the email address on the account or to prove control of the wallet you signed in with. We will not charge you for a reasonable request.

Be aware that this is a manual process. Nandonia has no self-serve delete button and no one-click data export: a person reads your email and does the work. We say so because a policy that implies a tool exists when it does not is misleading. If player numbers ever justify building those tools, we will build them and update this page.

Deleting your account removes your game. Lands, cities, envoys, achievements and any unspent Gold go with it, and none of it can be restored afterwards.

8. Cookies and local storage

Here is the named storage Nandonia uses in your browser. A handful of additional short-lived entries, which last only as long as the current tab, are described directly below the table, so that between the two you have the complete picture.

Your access token is held in your browser's memory only and is never written to storage at all, which limits the damage a script injection attack could do. It disappears the moment you close the tab.

The tab-only entries are these. Two of them, one for each place we detect it, remember that a page reload has already been tried after a script failed to load, so you are not caught in a reload loop after we deploy. One records that you have already seen today's daily reward. And several are counters behind the in-game prompts that suggest buying Gold: manual_upgrade_count, dispatch_count, and five upsell_ flags. Those exist so that the same suggestion is not put in front of you twice in one sitting. We would rather name them for what they are, since a prompt to spend money is not the same thing as a display preference.

You will not see a cookie banner on Nandonia, and that is deliberate rather than an oversight. Nothing that persists between visits is anything but necessary to make the game work, for every visitor, everywhere, so there is nothing for a banner to ask about.

Our visit counting does not change that, which is the whole reason we chose the software we did. It sets no cookie and writes nothing to your browser at all, so there is no storage on your device for a banner to ask you about. It is also not a row in the table above for the same reason: the table lists storage, and this uses none.

Two entries in that reasoning are judgement calls, and we would rather set them out and let you judge them than quietly leave them off this page.

The first is nandonia_ref, the invitation code in the table above, because crediting the player who invited you is not a technical necessity in the narrowest sense. We treat it as necessary because it does only what you asked for by following that invitation: it holds the code from the page you landed on until you create an account, is a code you were handed rather than anything we observed about you, dies when the tab closes, and is used for nothing else. It is not used to work out where you came from. That is recorded separately and is stored on no device at all.

The second is the upsell counters, because their purpose is commercial rather than technical. We treat them as not requiring consent because they exist only while the tab is open, they hold a small number and nothing that identifies you, they are never sent to us or to anyone else, and they are not used to build a profile of you or combined with any other data. If that turned out to be wrong, we would remove the counters rather than add a banner.

You can clear all of this at any time through your browser settings. Clearing it will sign you out and lose your local transaction history, but your game itself is on our servers and is unaffected.

9. Children

You must be at least 13 years old to have a Nandonia account. If you are under 16, you need a parent's or guardian's permission before you sign up. If you are under 18, you need a parent's or guardian's consent before making any purchase.

We do not knowingly collect data from anyone under 13. If we find out that an account belongs to a child under 13, we will delete the account and its data.

If you are a parent or guardian and you believe your child has an account you did not agree to, email us at [email protected]. Tell us the display name or the email address on the account and we will look into it, and delete the account if you ask us to. You have the same rights over your child's data as they would have themselves.

Separately from the age minimum, the game's content standard is that everything written by players should be suitable for players of any age. That is set out in our Community Guidelines.

10. Security

What we actually do:

• All traffic between your browser and our servers is encrypted over HTTPS.
• We store no passwords, because we have none. Sign-in is handled by Google, Apple, or a cryptographic signature from your wallet, so there is no Nandonia password to steal.
• We store no card details, because Stripe collects them on its own page and we never receive them.
• Your access token lives in browser memory only, never in local storage.
• Database backups are stored in Google Cloud Storage, which encrypts them at rest.
• Access to the production database and servers is limited to the operator.
• Requests are rate limited, and sign-in sessions expire and must be renewed.

What we will not claim: no system is completely secure, and we cannot promise that your data will never be exposed. Nandonia is a small operation, not a bank. Please do not put anything in a city name, an envoy name or a diary fragment that would harm you if it became public, because those are visible to other players by design.

If a breach happened that put you at real risk, we would tell affected players and any regulator we are required to notify, as quickly as we could establish the facts.

If you find a security problem, please tell us at [email protected] rather than exploiting it or posting it publicly. We will not take action against anyone who reports a genuine issue in good faith.

11. Changes to this policy

Nandonia is in active development, so this policy will change as the game does. The "last updated" date at the top of this page always tells you which version you are reading.

For a small correction or clarification we will simply update the page. If we make a change that materially affects you, such as collecting something new or sharing data with a new provider, we will give you notice in the game before it takes effect.

We do not currently keep a record of which version of this policy each player has read. Continuing to play after a change means the updated policy applies to you.

12. Contact and complaints

For anything to do with your privacy, including exercising any of the rights in section 7, email [email protected]. We will reply within 30 days.

That privacy address is for data rights and privacy questions only. For a security problem or anything else, use [email protected] instead.

Nandonia is operated by a sole trader based in Western Australia, Australia.

If you are unhappy with how we have handled your data or your request, please tell us first: most problems are quicker to fix directly, and we would rather hear about it. If you are still not satisfied, you may raise the matter with the data protection authority for your country. Which authority that is, and whether it can act on your complaint, depends on where you live.