NEBESA / PRIVACY

Privacy and cookie information

Effective date: October 13, 2026. This notice describes the current alpha, not a guarantee of complete legal compliance.

Account and gameplay data

Nebesa stores your email, password hash, verification state, call sign, previous call signs, security/account records and authoritative gameplay state. Passwords are not stored as readable text. Email is used for verification and account recovery. Previous call signs support moderation and account administration, are not public, and are retained for the lifetime of the account. Call signs may be changed once every 30 days.

Cookies and local browser storage

First-party authentication cookies keep you signed in, and antiforgery cookies protect account forms. These are required for requested account functionality; declining optional analytics does not disable them. Authentication tickets currently have an eight-hour lifetime and may renew during use. Remember-me can make the ticket persistent. Antiforgery cookies are session cookies. Cockpit preferences are stored locally in your browser and are not account-authoritative. No advertising or third-party analytics cookies are intentionally installed.

Aggregate analytics and your choice

First-party server analytics count recognized page requests, account funnel events and HTTP error categories. No analytics visitor identifiers, IP addresses, raw user-agent strings, query parameters, email addresses or individual navigation trails are stored. Counts are not unique visitors and may include bots, reloads and prefetches. Daily analytics totals are retained for 90 days. Do Not Track and Global Privacy Control signals suppress request analytics. These safeguards do not establish that consent is unnecessary in every EU jurisdiction.

Disable optional aggregate request measurement. The preference cookie lasts 180 days and stores only on/off, not a visitor identifier. DNT/GPC overrides an enabled preference. Account and gameplay aggregate totals derived from essential service records are separate from optional page measurement.

Operational records and recipients

Hosting, DNS and mail systems process network metadata necessary to deliver and protect the service. Operational access/security/mail logs may contain IP addresses, request URLs and email delivery metadata; they are distinct from aggregate analytics. Backup and log retention depend on server operations and have not all been standardized. Administrators can access account/gameplay records for operations and abuse prevention. Cryptocurrency donations occur on public blockchains; Nebesa does not collect private wallet keys or automatically attach payments to accounts.

Purposes, rights and limitations

Account and game processing supports the service you request. Security and aggregate measurement support legitimate operational interests, subject to applicable law and balancing. Where legally required, optional measurement must rely on valid consent rather than this notice alone. Applicable rights may include access, correction, erasure, restriction, objection and complaints to a supervisory authority. Automated self-service export and account deletion are not currently implemented.

The operator has not published controller identity, location or a privacy contact. This is an unresolved transparency and rights-request gap; this page must not be treated as a complete GDPR Article 13 notice. Hosting jurisdiction, international-transfer safeguards and detailed retention schedules also require legal/operational review before broad EU release.

Security

Access controls, server-side validation and transport encryption reduce risk but cannot guarantee security. Never share verification/reset links or passwords. Significant changes to data processing will require an updated notice and, where applicable, a renewed choice.