Privacy

This summary highlights the main points. The numbered sections below provide the complete Notice.

• Information: Nova processes account, social, support, creator, gameplay, multiplayer, tournament, trophy, reservation, browser-storage, and technical information depending on the features you use.
• Sensitive information: Nova does not ask you to provide sensitive personal information. Do not place sensitive information in usernames, messages, uploads, projects, games, or support requests.
• Sharing: Nova uses service providers and peer connections to operate the Services. Some usernames, content, multiplayer, and tournament information is visible to other users as described below.
• No targeted advertising sale: Nova does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use qualifying automated profiling.
• Age: Nova is intended for users age 13 and older and does not knowingly permit children under 13 to create accounts.
• Your choices: You can use browser controls, account controls, and privacy requests to exercise the choices and rights described below.

Nova collects information you provide, information created automatically when you use the Services, information other users provide when they interact with you, and limited information received by the providers that operate the Services.

• Account and profile: username, a client-created password hash, account creation, login and last-seen dates, policy acceptance dates and versions, and the date you confirmed the 13+ requirement. Standard signup does not ask for an email address, phone number, legal name, birth date, or precise location.
• Social and support: username searches, friends and friend requests, game invites, follow-party membership, direct messages, support messages, recipients, status, and timestamps.
• Creator content: projects, source code and HTML, images, audio, game titles, cover art, settings, creator username, and published games.
• Gameplay and multiplayer: settings, tutorials and game or demo progress, lobby and session membership, player IDs and usernames, room IDs, roles, readiness, game state and messages, results, and operational timestamps. Gameplay or creator-analytics records, when present, may include usernames, project or game identifiers, session duration, and timestamps.
• Tournaments and trophies: tournament creator, title, game, schedule, format, team size, bot-fill settings and ststrationatus; regis, entrants, teams and bot participants; matchups, ready or continue responses, scores, wins, losses, eliminations, forfeits and champions; and related dates. Nova may create account-level tournament statistics and trophy records.
• Game reservations: a game reservation can include username, project ID and name, player count, reservation date, and operational timestamps. Reservation records may be stored in Firestore and a limited recent copy may be stored in browser storage.
• Technical and network: browser-storage identifiers, session and room IDs, WebRTC signaling and relay data, IP address, request headers, browser or connection information, and operational timestamps. The TURN credential service may use and briefly hash an IP address together with room and player identifiers for rate limiting.

These sources include you, your browser or device, other users who interact with you, network peers, and the service providers listed in Section 10.

Nova's standard account system creates a deterministic SHA-256 hash from the username and password in the browser and stores that hash in Google Firestore. Nova does not intentionally store the plain password. This design is not the same as a slow, randomly salted password-hashing system. Standard Nova accounts are not protected by Firebase Authentication, and there is no email-based password recovery. No account system is perfectly secure.

Nova processes information to:

• create and authenticate accounts, record policy acceptance, and maintain login state;
• remember settings, tutorials, projects, assets, game or demo progress, and other requested preferences;
• provide friends, messages, invites, support, creator tools, published games, multiplayer, tournaments, statistics, trophies, and game reservations;
• organize rooms, teams and matches; maintain peer connections; determine results; and display appropriate lobby, tournament, profile, creator-analytics, and trophy information;
• publish, display, or promote content you choose to make public inside Nova;
• operate, maintain, troubleshoot, secure, and improve the Services;
• prevent misuse, enforce the Terms, respond to legal process, resolve disputes, and protect Nova, users, and others.

Where applicable law requires a legal basis, Nova relies on one or more of the following, depending on the feature and context: providing the Services you request and performing the user agreement; Nova's legitimate interests in operating, securing, troubleshooting, and improving the Services where those interests are not overridden by your rights; your consent when Nova specifically asks for it; compliance with legal obligations; and protection of the rights, safety, and vital interests of Nova, users, or others.

If processing depends on consent, you may withdraw that consent through the available feature control or by contacting Nova. Withdrawal does not affect processing already completed and may prevent the affected optional feature from working.

Nova uses local storage, session storage, client-created cookies, and service-worker caches to remember a username, login state, policy version, settings, tutorial state, game and demo progress, room or session information, projects, assets, recent reservation records, and cached files.

Login cookies contain the username, login status, login time, and policy version. They accompany same-origin requests and can therefore be received by Nova's hosting provider. They are session cookies and generally remain until the browser session ends or they are cleared or replaced. A separate signed-out marker may remain for up to one year. Other browser-stored information generally remains until it expires, is overwritten by the feature, or is cleared through the browser or device.

You can clear browser data through browser controls, but doing so may sign you out or remove unsynced projects, assets, settings, progress, reservations, or other local data. User-created games may use additional storage or third-party resources as described in Section 9.

Usernames are searchable. Friends and invite recipients can see the related username, game, room, party, and status information. Message recipients can see message content, and Nova support administrators can see support conversations.

Lobby members and network peers may receive player names, roles, readiness, game state, messages, room or session IDs, and WebRTC connection information. Direct peer connections can reveal network information to peers or relay providers. Do not place personal or sensitive information in usernames, messages, room data, or gameplay content.

When a designated organizer creates or manages a tournament, or when you join or play in one, participant usernames, teams, roles, readiness, matchups, scores, results, and status may be visible to other entrants, the designated organizer, and lobby members as needed to run and show the event. The organizer can also view live tournament data through the organizer's authorized spectator view. Nova-created bot participants may appear in a tournament.

When a tournament finishes, Nova writes a separate tournament record under each participating account. Nova uses those records to calculate tournament entries, match wins, and titles and to show earned trophies and their game names and dates in the account's profile and Trophy River. The organizer-retained tournament record may remain as a past event until it is manually or otherwise removed; non-retained tournament records may be deleted after account records are archived.

You may provide project names, code, images, audio, cover art, game settings, and other content. Nova may store that content in browser storage or Firestore, including chunked project code. Published games can display your creator username and selected project content to other users.

When you create or play a user-created game, its HTML and code may run inside a game frame, access same-origin browser information where the runtime permits it, load third-party resources, make network requests, use additional browser storage, or request browser capabilities. Those third parties may receive connection and browser information. Treat creator games as user-provided code, review browser permission prompts, and do not include or enter credentials, hidden tracking, malicious code, or personal information you do not want shared.

Nova uses service providers and network connections for these purposes:

• Google Firebase and Firestore: account records, policy acceptance, social and support data, creator and game records, game reservations, lobby and tournament records, and anonymous authentication used by the character tool.
• Netlify: website and function hosting, which processes HTTP requests and related IP, request-header or connection information, and any data sent to a Nova function. Nova's TURN credential function also uses short-lived IP-based rate-limiting information.
• Google Fonts and Google STUN: font requests and connection information used to deliver fonts and help establish WebRTC multiplayer connections.
• Cloudflare Realtime TURN: connection and relay metadata and multiplayer traffic that must be relayed when a direct peer connection is unavailable.
• Other WebRTC players: room, player, game, and connection information needed to establish and operate a direct multiplayer connection.

These providers may process information under their own terms and privacy policies. Nova may also disclose information at your direction; to protect users, Nova, or the Services; to investigate misuse; to comply with law or legal process; or as part of a merger, financing, acquisition, reorganization, or transfer of the Services.

Nova does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use an advertising SDK. Nova will update this Notice before materially changing that practice.

Nova and its providers may process information in the United States and other locations where they operate. If you use the Services from another country, your information may be transferred to a place with privacy and data-protection rules that differ from those where you live. Nova handles that information as described in this Notice and as applicable law requires.

Nova keeps account, policy-acceptance, social, support, creator, publication, gameplay, creator-analytics, reservation, tournament, and multiplayer records while they are needed to provide the Services, preserve user-requested or shared content, protect the platform, resolve disputes, or meet legal obligations. Nova does not have an automatic deletion schedule for every Firestore record. Retention depends on the feature, whether a record remains active or shared, safety and legal needs, and provider backup cycles.

Browser storage remains until it expires, is overwritten, or is cleared. The TURN credential service's in-memory IP rate-limit entries generally expire after about five minutes. Records created by retired or unsupported features may remain until they are manually reviewed or removed.

The Settings deletion control removes the core user document; the account's current friend and friend-request links, game invites, game-demo progress, tournament records used to generate statistics and trophies, support conversation, and chat threads found through the account's current friend list; and related account login markers on that browser. When an active party is identified, Nova first routes through the lobby to leave it.

That control does not automatically remove every creator project, published game, game reservation, creator-analytics record, creator-retained or active tournament, older or undiscovered chat, lobby, gameplay, signaling or relay record, copy held by another user, provider backup, or browser-local project, setting, asset, or cache. To request a broader review and deletion, contact Nova. Some information may remain where needed for security, legal compliance, dispute resolution, provider backup cycles, or shared content another user still possesses.

Nova uses HTTPS where provided by its hosting and service providers, password hashing, access controls provided by the relevant services, and other reasonable safeguards. However, no browser storage, database, peer connection, user-created code, or online service is perfectly secure, and Nova does not promise that every record or user-created game can be accessed only by its intended audience. Keep your password and device private, use a unique password, and do not send sensitive personal information through usernames, messages, support, uploads, projects, or games.

Nova is intended for users age 13 and older and is not directed to children under 13. Account creation requires the user to confirm that they are at least 13; Nova does not ask for a birth date. Nova does not knowingly allow a child under 13 to create an account. If Nova learns that it collected personal information from a child under 13 without legally valid parental permission, Nova will disable the account and take reasonable steps to delete the information. A parent or guardian can contact Nova using the email in Section 18.

You can delete the core account through Settings, clear browser-stored data through browser controls, choose whether to publish creator content, and leave social or multiplayer features. Depending on where you live, you may also have rights to confirm processing; request access to, correction of, deletion of, or a portable copy of personal information; withdraw consent; or object to or limit certain uses.

Nova may need to verify the username, account access, and request before acting. Where applicable law permits an authorized agent to act for you, Nova may request proof of that authority and may still need to verify your identity. Nova will respond as required by applicable law and will not discriminate against a user for making a privacy request.

If Nova denies a request and local law gives you an appeal right, reply to the decision with the word Appeal and explain why you believe the decision should be reconsidered.

For residents whose state privacy law applies, the categories Nova may have processed during the preceding 12 months include identifiers; internet or other electronic-network activity; communications and user content; gameplay, profile, social, creator, reservation, and tournament activity; and audio or visual content users upload. The sources, purposes, and recipients for those categories are described in Sections 2, 4, and 7 through 10.

Nova does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use qualifying automated profiling. Nova does not knowingly sell or share personal information of users under 16. Nova does not intentionally request sensitive personal information or use sensitive personal information to infer characteristics.

Because Nova does not currently engage in the sale, targeted-advertising sharing, or qualifying profiling addressed by common opt-out signals, Global Privacy Control and Do Not Track signals do not change how Nova's own platform code operates. You can still use the controls in Section 16. User-created games and third-party resources may have separate practices.

Nova may update this Notice as the Services, data practices, or legal requirements change. Material updates will change the effective or last-updated date and may require account users to review the new Terms and Privacy Notice through the normal sign-in or Home flow.

Send privacy, parent or guardian, account-data, correction, deletion, appeal, or policy questions to cmofficalbusiness@gmail.com. Include the Nova username and the request, but never send your password.