Privacy

Nova collects information from you, from other users who interact with you, from your use of the platform, and from the service providers that operate Nova.

• Account: username, a one-way password hash, account creation and login dates, last-seen time, and policy acceptance dates and versions. Standard signup currently does not ask for an email address, phone number, legal name, or precise location.
• Social and support: username searches, friends and requests, invites, follow-party membership, direct messages, support messages, their recipients, status, and timestamps.
• Creator and gameplay: projects, code, images, audio, game titles, cover art, creator username, published games, reservations, token balances, settings, progress, lobby membership, readiness, roles, and gameplay messages.
• Technical and network: browser storage identifiers, session and room IDs, WebRTC signaling and relay data, IP or connection information processed by hosting, security, STUN, and TURN providers, and operational timestamps.

Nova's primary account system converts the username and password into a one-way hash in the browser and stores that hash in Google Firestore. Nova does not intentionally store the plain password. Normal Nova accounts are not protected by Firebase Authentication, and there is currently no email-based password recovery. Hashing reduces exposure but does not make any account system perfectly secure.

Nova uses information to authenticate accounts; remember policy acceptance and settings; provide friends, messages, invites, support, multiplayer, games, creator tools, tokens, and reservations; publish, display, or promote content you choose to make public inside Nova; improve platform and creator features; maintain network connections; prevent misuse; troubleshoot failures; enforce the Terms; comply with law; and protect Nova and its users.

Nova uses local storage, session storage, client-created cookies, and service-worker caches to remember a username, login state, policy version, settings, tutorial state, tokens, game progress, projects, assets, and cached files. The login cookies contain the username, login status, login time, and policy version; they accompany same-origin requests and can therefore be received by Nova's hosting provider. They may remain for up to one year unless cleared or replaced. You can clear browser data through your browser, but doing so may sign you out or remove local projects, tokens, settings, or progress.

NovaShop currently uses a browser-local virtual token balance. The visible $5, $10, and $20 controls do not currently run a real-money checkout or payment processor; they add demo tokens locally. Game reservations may store username, project, date, player count, token cost, and timestamps in Firestore. If Nova later adds real payments, Nova will update this Policy and provide purchase-specific terms before collecting payment information.

You may provide project names, code, images, audio, cover art, game settings, and other content. Nova may store that content in browser storage or Firestore, including chunked project code. Published games can display your creator username and selected project content to other users. When you create or play a user-created game, its HTML and code may run inside a game frame, access same-origin browser information where the runtime permits it, load third-party resources, make network requests, or request browser capabilities. Those third parties may receive connection and device information. Treat creator games as user-provided code, review browser permission prompts, and do not include or enter credentials, hidden tracking, malicious code, or personal information you do not want shared.

Usernames are searchable. Friends and invite recipients can see the related username, game, room, and status information. Message recipients can see message content. Nova support administrators can see support conversations. Lobby members and network peers may receive player names, roles, readiness, game state, room or session IDs, and WebRTC connection information. Published games, titles, cover art, and creator usernames can be public.

Current providers include Google Firebase and Firestore for platform records, Firebase anonymous authentication in the character tool, Google Fonts and Google STUN, Netlify hosting and functions, and Cloudflare Realtime TURN for relayed multiplayer connections. These providers may process data under their own terms and privacy policies. Nova may also disclose information to protect users or the service, investigate misuse, comply with law or legal process, or as part of a merger, financing, acquisition, or transfer of the service.

Those providers may process information in the United States or other locations where they operate. Privacy and data-protection rules may differ from those where you live.

Nova does not currently sell personal information, share it for cross-context behavioral advertising, or use an advertising SDK. Nova will update this Policy before materially changing that practice.

Nova is intended for users age 13 and older. Account creation requires the user to confirm that they are at least 13. Nova does not knowingly allow an under-13 child to create an account. If Nova learns that it collected personal information from a child under 13 without legally valid parental permission, Nova will disable the account and take reasonable steps to delete the information. A parent or guardian can contact Nova at the address below.

Nova uses HTTPS where provided by its hosting and service providers, password hashing, and other reasonable safeguards. However, no browser storage, database, peer connection, or online service is perfectly secure, and Nova does not promise that every record or user-created game can be accessed only by its intended audience. Keep your password and device private, use a unique password, and do not send sensitive personal information through usernames, direct messages, support, uploads, or games.

Nova keeps account, social, support, project, publication, reservation, and multiplayer records while they are needed to provide the service, preserve user-requested content, protect the platform, resolve disputes, or meet legal obligations. Nova does not currently have an automatic deletion schedule for every Firestore record.

The Settings deletion control removes the core account and some current friend, invite, chat, and support records. It does not automatically remove every project, published game, reservation, older chat, lobby, signaling or relay record, provider backup, or browser-local item. To request a broader review and deletion, contact Nova. Some information may remain where required for security, legal compliance, dispute resolution, provider backup cycles, or content another user still possesses.

Depending on where you live, you may have rights to confirm processing; request access to, correction of, deletion of, or a portable copy of personal information; or object to or limit certain uses. Nova may need to verify the username and request before acting. Nova will not discriminate against a user for making a privacy request.

If Nova denies a request and local law gives you an appeal right, reply to the decision with the word Appeal and explain why you believe the decision should be reconsidered.

Send privacy, parent or guardian, account-data, correction, deletion, or policy questions to cmofficalbusiness@gmail.com. Include the Nova username and the request, but never send your password.