Nexorion Privacy Policy

Version 3 — effective 5 October 2026

Türkçe sürüm: privacy-policy.tr.md

This policy explains what personal data Nexorion collects, why, who else sees it, how long we keep it, and what rights you have. We have tried to write it so that a player can actually read it. If anything is unclear, write to privacy@nex-orion.com.

The short version

• You sign in with Steam on a computer, or with Sign in with Apple on an iPhone. We never ask for your password, e-mail address, real name, phone number or payment details.
• To run the game we store your Steam ID and/or Apple user ID, your account name, your game progress (items, gems, level, worlds, friends, guild) and, from version 1 of these documents on, your age (kept as a birth year) and which version of our Terms and this policy you accepted.
• To keep the game fair and safe we record your IP address when you connect and sign in, keep short-lived server logs (which include public chat), and use Easy Anti-Cheat.
• We do not sell your data, show ads, use advertising or analytics trackers, or let other players see your IP address.
• Players under 13 may not play. Players aged 13 up to 18 (or the age of majority where they live) need a parent or guardian to agree.
• You can delete your account yourself in the game (Settings → Account → Delete account), or ask us for a copy of your data, to correct it, or to delete your account at any time: privacy@nex-orion.com.

1. Who is responsible for your data

The controller of your personal data (in Turkish law, the veri sorumlusu) is:

Nexorion, an independent game made in Türkiye E-mail: privacy@nex-orion.com

Nexorion is made by one independent developer. There is no company group behind it and no data protection officer (see section 12).

2. What this policy covers

• The Nexorion game client (currently distributed through Steam for Windows and macOS, including the Steam Playtest).
• The Nexorion game server and its database.
• The website nex-orion.com, the news site news.nex-orion.com and the volunteer translation site translate.nex-orion.com.
• E-mails you send us.

Steam, Discord and Epic Games are separate companies with their own privacy policies. This policy explains what we receive from them and send to them, not everything they do.

3. What we collect, and why

3.1 Steam sign-in

When you start the game, the client asks Steam for a one-time sign-in ticket and sends it to our server. Our server asks Steam whether the ticket is genuine. From that check we receive and use:

The ticket is cancelled right after you sign in. We do not get your Steam password or payment details.

3.2 Your account and game progress

Stored in our database for as long as your account exists:

• Account name you chose (shown to other players), account number, when the account was created and when you were last seen.
• Game state: inventory, worn clothing, gems, circus coins, level and experience, progress counters, achievements, daily quests, the last world you were in, your staff role (if any).
• Friends: who you are friends with (a friendship is stored on both sides). Pending friend requests and guild invitations are kept only in memory for a short time.
• Guild: which guild you belong to, your rank, when you joined, when you were last online, and whether you share your location with the guild. A guild itself has a name, statement, home world, emblem, level and a short history log.
• Bans: if you are banned, until when and the reason given.

3.3 Age check and acceptance records

When you first sign in, and again whenever these documents change, we ask you how old you are (once — it is not asked again) and to accept the current Terms of Service and this Privacy Policy. We store:

• your age, kept as the year you were born in and the month you told us (so it goes up by one each year) — never a full date of birth;
• the version of the Terms and Privacy Policy you accepted, and when you accepted;
• if you are between 13 and the age of majority, that a parent or guardian confirmed their agreement.

We use this to keep under-13s out of the game, to make sure younger players have a parent's or guardian's agreement, and to be able to show which version of the rules applied. We do not collect the name, e-mail or any other details of the parent or guardian. If the date you enter shows that you are under 13, we do not create an account and we do not keep the date you entered.

3.4 What you create and say in the game

• Worlds and what is in them: blocks, items, signs, notice board messages (with the name of whoever posted them, unless the owner hides names), door and entrance settings, lock access lists, world ban lists, display cases, vending machines and donation boxes.
• Guild names and statements.
• Chat: Nexorion has public chat only — there are no private messages. Every line you say in a world is sent to everyone in that world and also written to our server logs (see 3.6). Chat is not stored in the database, except as part of a report (below). Chat, signs, notice boards and names pass through a filter that hides abusive words.

• Reports and blocks: if you report a player, we store your account name, theirs, the reason, any details you write, the world, and their last few chat lines (as they typed them), so staff can judge what happened. If you block a player, the block is stored with your account until you lift it.

Most of this is public by design: anyone visiting a world sees what is in it.

3.5 Connection, device and security data

• Your IP address, when you connect. Players connect through Cloudflare (see section 5), which passes your real IP address on to our server.
• A sign-in record each time you sign in: account, IP address, Steam ID, library owner's Steam ID, app and time.
• Your device's region setting (a two-letter country code, for example "de"). It is used to show a flag next to your name and is not stored after you disconnect. It comes from your system settings, not from your location.
• The game version and build, your language choice, your platform (Windows, macOS, Linux) and which panels your game version can draw.
• Anti-cheat signals: our server checks every movement for things like walking through walls, flying or teleporting, and may pull you back or disconnect you. Results can appear in server logs and as alerts to online moderators.
• Easy Anti-Cheat (see 3.8).
• Rate-limit counters per IP address (for example, failed sign-ins), held in memory only.

3.6 Server logs

The server writes a running log that we keep for 30 days. It contains connection events (with IP address), sign-ins and sign-outs, the account name attached to gameplay events (placing and breaking blocks, trades, drops, purchases with gems, crafting and similar), public chat lines with the world and account name, moderation actions and anti-cheat results. We use it to investigate cheating, item duplication, abuse reports and bugs.

3.7 Steam Inventory items

Some items (currently only Leaf Wings) can be moved from the game to your Steam inventory. If you ask for this:

• We keep a transfer record: your account, Steam ID, the item, the request's status, your IP address at the time of the request, who decided on it, a note, and timestamps.
• We keep an item ledger for the items that can reach Steam and what they are made from: every time such an item enters or leaves your bag, with the reason (crafting, trade, pickup, and so on), the other player involved and the world.
• Before approving, the developer runs a background check. It shows your account age, level and play time, your recent sign-in IP addresses, other Nexorion accounts that signed in from the same IP addresses, Family Sharing use, and data fetched from Steam at that moment: your Steam account's creation date, whether your profile is public, your Steam display name and any VAC, game, community or trade bans. The Steam data is shown to the reviewer and not stored.

This exists because Steam items can be traded and sold on Steam, and an item that was duplicated or stolen cannot be taken back once it is sold.

3.8 Easy Anti-Cheat (Epic Games)

Nexorion uses Easy Anti-Cheat, a service of Epic Games, Inc., through Epic Online Services. When you play:

• The game signs you in to Epic Online Services with your Steam account (no Epic account is needed). Epic creates an anonymous product user ID for you, and our server checks it with Epic.
• Easy Anti-Cheat runs while the game is running. To detect cheats it examines the game process and your computer — for example running programs, loaded modules, memory and files related to the game — and sends results to Epic and, through the game, to our server. On Windows, Easy Anti-Cheat uses a system service that is installed together with the game.
• If the protected client is not running or reports a cheat, our server may disconnect you.

Epic processes this data under its own Easy Anti-Cheat and privacy terms. See Epic's privacy policy at epicgames.com/privacypolicy.

3.9 Steam rich presence, invites and friends

On Steam, the game shows your Steam friends that you are playing Nexorion and — unless you turn it off — which world you are in, and lets them join you. The game also shows your Steam friends list, their avatars and invites inside the game. The Steam friends list is read from the Steam app on your computer and is not sent to our server.

The setting "Show my world to friends" (on by default) controls this. When it is off, Steam, Discord and your in-game friends see that you are playing but not where, and friends cannot warp to you.

3.10 Discord (only if you use it)

If the Discord app is running on your computer, the game uses Discord's Social SDK to show "Playing Nexorion" on your Discord profile with the world name, how many players are there, and a Join button (unless your world is hidden), and to let friends invite each other. There is no Discord account linking: we never receive your Discord account, name or friends. The data goes from the game to the Discord app on your computer and from there to Discord under Discord's privacy policy. If Discord is not running, nothing is sent.

3.11 Data stored on your device

The game stores on your computer: your settings (language, frame rate, motion, sounds, chat drawer, "show my world"), key bindings, inventory favourites, pins and sort order, recently visited worlds, and the clothing you last wore (for the loading screen). It does not write a player log file. This data stays on your device and is removed when you delete the game's data. Steam, Discord, Epic Online Services and Easy Anti-Cheat may keep their own files on your device.

3.12 Unity engine

The game is built with the Unity engine. We have turned off Unity Analytics, Unity Ads, Unity in-app purchases, cloud diagnostics and performance reporting. The Unity engine may still send limited technical information about your device (such as hardware and operating system) to Unity Technologies under Unity's own privacy policy (unity.com/legal/privacy-policy). We do not receive this data.

3.13 Websites

• nex-orion.com is a static website. It sets no cookies, has no analytics and no forms. It is served by Cloudflare, which processes your IP address to deliver the pages and protect the site.
• news.nex-orion.com carries our news and patch notes. Reading it sets no cookies and runs no scripts; it is served by Cloudflare like the main site. Only the people who write the posts sign in there (a username, a hashed password, a strictly necessary session cookie, and counts of failed sign-ins by username and IP address).
• translate.nex-orion.com is for volunteer translators only. If you are one, we store your username, a hashed password, a session cookie (strictly necessary, expires on its own), the translations you submit with your username and time (so a bad edit can be rolled back), and counts of failed sign-ins by username and IP address to block password guessing.

3.14 The hub: videos, news pictures and links

The world menu (the "hub") shows our news and some YouTube videos. To draw them, your game downloads pictures directly: each video's thumbnail from YouTube (i.ytimg.com, run by Google) and each news post's cover from news.nex-orion.com. Like any download, this lets Google and Cloudflare see your IP address; the game sends nothing else with these requests and no cookies. The video's title and channel are looked up by our server, not by your game. When you tap a video, a post or any other link, the game first asks whether to open it in your web browser — once you do, the site you open (for example YouTube) applies its own privacy policy.

3.15 When you contact us

If you write to support@nex-orion.com or privacy@nex-orion.com, we keep your e-mail address, your message and our reply, and any account details needed to help you.

3.16 What we do not collect or do

• No real-money purchases happen in our game, so we hold no payment data. If you buy the game on Steam, Valve handles that.
• No advertising, no advertising IDs, no analytics or tracking SDKs, no profiling for marketing.
• No precise location, no microphone, no camera, no contacts.
• No sale or sharing of personal data for money or for advertising.
• No private messages exist, so there are none to read.

4. Why we use your data, and our legal bases

For players in the EU, EEA and UK, here is the legal basis under the GDPR / UK GDPR for each purpose. (For Türkiye, see the Turkish version, which includes the KVKK Aydınlatma Metni.)

Where we rely on legitimate interests, we have weighed them against your rights. You can object (section 9).

Providing the data in 3.1–3.3 is needed to play; without it we cannot create an account.

5. Who we share data with

We only share what each recipient needs:

If Nexorion is ever transferred to someone else (for example a publisher or a company), your data may be transferred too; we will tell you before that happens.

6. International transfers

Our server and database are in Germany (EU). We, the controller, are in Türkiye. Valve, Epic, Cloudflare, Discord, Google and Unity are based in the United States.

• For transfers from the EU/EEA or UK to the United States, we rely on the EU–US Data Privacy Framework (and its UK extension) where the recipient is certified, and otherwise on the Standard Contractual Clauses (and the UK addendum) included in the provider's data processing terms.
• Türkiye does not have an EU adequacy decision. When you play from the EU or UK, you send your data directly to us; we protect it with the safeguards described in this policy.
• For transfers out of Türkiye, see the Turkish version (KVKK Article 9).

You can ask us for more information about these safeguards.

7. How long we keep data

8. Security

Game traffic is encrypted end-to-end between your game and our server, inside Cloudflare's encrypted connection. Our database is not reachable from the internet; the server is accessed only with keys; secrets are kept outside our code. Only the developer has full access. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy;
• correct data that is wrong;
• delete your data / your account;
• restrict how we use it;
• object to our use based on legitimate interests;
• data portability — get the data you gave us in a machine-readable form;
• withdraw consent where we rely on consent (we currently do not rely on consent for core processing);
• complain to a data protection authority.

To use any of these rights, e-mail privacy@nex-orion.com from any address. To protect your account, we will ask you to prove it is yours — usually by signing in to the game with your Steam account and confirming a code we give you, or by other reasonable means. We answer within one month (we may extend by two months for complex requests, and will tell you why). Requests are free unless they are clearly unfounded or excessive.

A parent or guardian can make these requests for a child; we will ask for reasonable proof.

Complaints. You can complain to the supervisory authority where you live or work, or where an issue happened — in the EU, any national data protection authority (list at edpb.europa.eu); in the UK, the Information Commissioner's Office (ico.org.uk); in Türkiye, the Personal Data Protection Authority (kvkk.gov.tr). We would be grateful if you contacted us first so we can try to fix it.

10. Automated decisions

Our server automatically refuses impossible movements and can disconnect a player whose movement keeps breaking the rules; Easy Anti-Cheat can have a player removed from a session. These are disconnections, not bans. Bans are always decided by a person. If you think an automated disconnect was wrong, write to support@nex-orion.com.

11. Children

• Nexorion is not for children under 13. The age check at sign-in stops under-13s from creating an account. We do not knowingly collect personal data from children under 13. If we learn that we have, we delete the account and its data. If you believe a child under 13 is playing, write to privacy@nex-orion.com.
• Players from 13 up to the age of majority where they live (18 in Türkiye, the EU and the UK) may play only if a parent or guardian agrees to the Terms of Service. The game asks for that confirmation and records that it was given.
• We do not show ads, do not profile players for marketing and do not sell data — for anyone, including younger players.
• Chat is public. Parents should talk with younger players about not sharing personal information (real names, addresses, schools, social media) in chat, on signs or in world names.

12. Data protection officer

We are a one-person studio and, in our assessment, not required to appoint a data protection officer under Article 37 GDPR. All privacy questions go to privacy@nex-orion.com, which the developer reads personally.

13. US state privacy rights (California and others)

This section applies to residents of US states with consumer privacy laws, such as the California Consumer Privacy Act as amended by the CPRA, to the extent those laws apply to us.

Notice at collection. In the last 12 months we collected these categories of personal information, for the purposes and with the retention described in sections 3, 4 and 7:

• Identifiers: Steam ID, Apple user ID, account name, IP address, Epic product user ID.
• Characteristics of protected classifications: age (as a birth year), only to apply our age rules.
• Internet or other electronic network activity: gameplay events, chat, server logs, anti-cheat results.
• Approximate location: the two-letter region setting of your device (not stored), and what can be inferred from an IP address (we do not geolocate it).
• Inferences: none.
• Sensitive personal information: we do not collect it for the purpose of inferring characteristics, and do not use it beyond what is permitted.

Sources: you, your device and game, Steam, Epic. Disclosures for business purposes: to the service providers and parties listed in section 5.

We do not sell or share your personal information (as "sell" and "share" are defined in the CCPA), have not done so in the last 12 months, and have no actual knowledge of selling or sharing data of consumers under 16. We do not use personal information for cross-context behavioural advertising.

Your rights: to know/access, delete, correct, and to not be discriminated against for using these rights. You may use an authorised agent; we will verify the request with you. To make a request, e-mail privacy@nex-orion.com.

14. Changes to this policy

Each version of this policy has a number. When we change it in a way that matters, we raise the number and the game will ask you to read and accept the new version the next time you sign in. Small fixes (typos, clearer wording) that do not change what we do may be made without a new version. Past versions are available on request.

15. Contact

• Privacy: privacy@nex-orion.com
• Everything else: support@nex-orion.com