Draft. Not yet in force. Items in [brackets] are still to be filled in.
Privacy Policy — Nimis: Legacies Beyond
Last updated: [date]
This policy explains what information we collect when you sign up for, download or play Nimis: Legacies Beyond (“the game”), why we collect it, how long we keep it, and what you can ask us to do with it.
1. Who we are
The game is made and operated by [first and last name], an independent developer based in Portugal (“we”, “us”). We are the controller of the data described here.
Contact for anything in this policy: privacy@playnimis.com
2. What we collect and why
| What | When | Why | Legal basis |
|---|---|---|---|
| Account identifier (a player ID issued by our sign-in provider; on PC it is linked to your Steam ID) [closed beta: a random identifier created on your device] | When you sign in | To load your characters and keep your account separate from others | Performance of our agreement with you |
| Email address | If you fill in the beta signup form [or sign in with an email-based account, which is held by the sign-in provider, not by us] | To invite you to test sessions and send news about the game | Your consent, which you can withdraw at any time |
| Game data (characters, names you choose, progress, inventory, faction, match and combat records) | While you play | To run the game | Performance of our agreement with you |
| IP address and connection times | Every time you connect | To operate and protect the servers, and to investigate cheating and abuse | Our legitimate interest in a secure, fair service |
| Chat messages and player reports | When you write in chat, or report or are reported | Moderation and safety | Our legitimate interest in a safe service |
| Moderation records (warnings, mutes, bans and the reason) | If action is taken on your account | To enforce the rules consistently | Our legitimate interest in a fair service |
| Device and crash information (device model, operating system, game version, error details) | When the game crashes or reports an error | To find and fix faults | Our legitimate interest in a working game |
| Age confirmation (only whether you passed; not your date of birth) | At first launch | To keep the game to players aged 16 and over | Legal obligation and legitimate interest |
| Purchase records (what was bought and a transaction reference; never card details) [from the day the shop opens] | When you buy something through Steam | To deliver what you bought and handle refunds | Performance of our agreement with you; legal obligation |
We do not collect your postal address, phone number, contacts, location, or payment card details. The game shows no advertising and contains no advertising trackers.
3. What we do not do
- We do not sell your data.
- We do not use it for advertising.
- We do not make decisions about you by automated means alone. Bans are reviewed by a person.
4. Who else handles your data
We use a small number of service providers, who process data on our instructions:
- Server hosting: [provider, country] — runs the game servers and stores game data and logs.
- Sign-in: [Unity Gaming Services (Unity Technologies)] — issues account identifiers [and holds your email if you use an email-based account].
- Crash reporting: [provider] — receives crash and error reports.
- Steam (Valve Corporation): distributes the PC game, signs you in on PC and processes purchases. Valve is an independent controller under its own privacy policy.
- Discord and [form tool]: our community server and the beta signup form, each under its own privacy policy.
Some of these providers are outside the European Economic Area. Where data is transferred outside it, the transfer relies on [the provider’s standard contractual clauses or an adequacy decision].
We may disclose data if the law requires it.
5. How long we keep it
| Data | Kept for |
|---|---|
| IP addresses and connection logs | [30 days] |
| Chat messages | [30 days], or longer only where attached to a report under review |
| Player reports and moderation records | For the life of the account, and for [12 months] after a permanent ban so it cannot be evaded |
| Crash reports | [90 days] |
| Game data and account identifier | Until you ask us to delete your account, or after [24 months] without signing in |
| Beta signup answers | Until the beta ends, or until you ask us to delete them |
| Closed-beta game data | Deleted at the end of the beta, before launch |
| Purchase records | As long as tax law requires |
6. Your rights
You can ask us to: tell you what data we hold about you and give you a copy; correct it; delete it; restrict or object to our use of it; and give it to you in a portable form. Where we rely on your consent, you can withdraw it at any time.
To use any of these, write to privacy@playnimis.com from the email address linked to your account, or include your account identifier (shown in the game under [Settings]). We answer within one month.
Deleting your account removes your characters and game data permanently. Records we must keep by law, and the record of a permanent ban, are kept for the periods above.
If you are unhappy with how we handle your data you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority in your own country.
7. Children
The game is for players aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a younger child has an account, tell us and we will delete it.
8. Security
Connections to the game servers are encrypted [from launch; the closed beta uses an encrypted sign-in and an unencrypted gameplay connection, as stated in the tester agreement]. Backups are encrypted. Access to the servers is limited to the developer. No system is perfectly secure; if a breach affects your data we will tell you and the authority as the law requires.
9. Changes
When this policy changes we will update the date at the top and, for significant changes, announce it in the game or on our Discord before the change takes effect.