Legal
Privacy Policy
Effective 13 October 2026
Nebula Kings is a free-to-play space strategy game for iPhone. This policy explains what personal data the game and this website collect, why, who sees it, how long we keep it, and what you can do about it. We have tried to keep it plain and specific.
1. Who we are
The controller of your personal data is com1 coding Sdn. Bhd., a company in Malaysia (“we”, “us”). You can reach us at support@nebula-kings.com.
2. What we collect, and why
Nebula Kings creates an account for you automatically when you first open the app. You do not have to type anything, and you can play without ever giving us an email address. The tables below list everything we hold.
Account and sign-in
| Data | Why | How long |
|---|---|---|
| Account ID, display name, language setting, platform, last-seen time | To run your account and show the game in your language. | Until your account is deleted. |
| Email address and password (stored only as a salted bcrypt hash), if you choose to add them | So you can recover your account and sign in on another device. | Until your account is deleted. |
| Apple sign-in identifier and Apple refresh token, if you use Sign in with Apple | To recognise you when you sign in with Apple, and to revoke the link with Apple when your account is deleted. We receive an email address from Apple only if you choose to share it. | Until your account is deleted. The link is revoked with Apple at deletion. |
| Game Center player identifier, if you use Game Center | To recognise you silently on a device where you are signed in to Game Center. | Until your account is deleted. |
| Device sign-in tokens, with the device model and a random install ID | To keep you signed in on each device and to help with support. Only a hash of the token is stored, and the install ID is never used to authenticate you. | Until you sign out of that device or your account is deleted. |
| Notification settings | To remember which push notifications you want. | Until your account is deleted. |
Security log
| Data | Why | How long |
|---|---|---|
| Login log: time, how you signed in (device, email, Apple, Game Center or starting a play session), IP address and the first 200 characters of the app’s user-agent | Account security, support, and spotting banned players who return on new accounts (which accounts share an address). | 90 days, then deleted automatically. Removed earlier if your account is deleted. |
| Rate-limit counters keyed on your IP address | To slow down abuse of sign-up and sign-in. | Held in server memory only; lost on restart. |
Gameplay
| Data | Why | How long |
|---|---|---|
| Your commander nickname (visible to other players), worlds, buildings, research, fleets, battles, alliance membership, inbox messages and scores | This is the game itself. Nickname, rank and alliance are visible to other players in your universe. | For the life of the universe and your account. On deletion your commander is anonymised (see section 6). |
| Economy ledger: every change to a world’s resources, tied to your commander | To investigate bugs and cheating. | 70 days, then deleted automatically. |
| Expiring inbox messages | Game messages and reports. | Only the newest messages per commander are kept; older ones are removed automatically. |
Chat and moderation
| Data | Why | How long |
|---|---|---|
| Chat messages (public rooms, alliance rooms and direct messages), with the sender’s nickname and rank at the time | To provide chat. Messages pass a word filter. Chat is not end-to-end encrypted, and our operators can read it when handling a report. | Each room keeps only its latest messages (500 for rooms, 200 for a private conversation); older ones are removed automatically. |
| Reports you file about a message, with a copy of the reported message, and blocks you set | To moderate abuse. A report keeps a copy because the room may trim the original before anyone looks. | Kept while needed for moderation. |
| Bans: reason and end date | To enforce the rules of the game. | While the ban applies. |
| Operator audit log: what an operator did to an account or message, naming the operator | Accountability for our own staff. | Kept as a record of our own administration. |
Purchases
| Data | Why | How long |
|---|---|---|
| App Store transactions: product, transaction IDs, purchase, expiry and refund dates, linked to your account | To deliver what you bought (for example the Season Pass), to restore it, and to reverse it if Apple refunds it. Apple processes the payment; we never see your card or Apple ID payment details. | Until your account is deleted. |
Push notifications
| Data | Why | How long |
|---|---|---|
| Apple push notification token for your device | To tell you when a build finishes, a fleet arrives or you are attacked. Only if you allow notifications; you can turn them off in iOS Settings or in the app. | Until Apple reports the token as no longer valid, or your account is deleted. |
Crash reports
| Data | Why | How long |
|---|---|---|
| Error reports from the app and our server through Sentry: the error, a technical stack trace, app version, device and OS type, and recent log breadcrumbs. We do not turn on Sentry’s collection of default personal data, and the app does not attach screenshots. | To find and fix crashes. | According to Sentry’s retention settings for our project. |
This website
| Data | Why | How long |
|---|---|---|
| Email address you enter in the waitlist form, and whether you ticked the beta box | To tell you when the game launches and, if you asked, to invite you to the TestFlight beta. It is sent as a message to a private Telegram chat that we own, and nowhere else. | Until launch, or until the beta invitation is sent if you asked for one, or until you ask us to remove it (Telegram message history is kept by us and Telegram). |
| Standard web request data (IP address, browser) at Cloudflare | To deliver and protect the site and the game servers. | According to Cloudflare’s retention. |
On your device
The app stores your sign-in token in the iOS keychain. If iCloud Keychain is on, Apple syncs it to your other devices so a new phone opens on the same account; we do not receive anything from that sync. The app asks for permission to send notifications. In development builds only, iOS may ask for local network access to reach a test server.
3. What we do not do
- We do not sell your personal data.
- The game contains no advertising and no advertising SDK, and we do not track you across other companies’ apps or websites.
- We use no third-party analytics SDK. Our only third-party diagnostics tool is Sentry, described above.
- We do not ask for your contacts, photos, camera, microphone or precise location.
4. Who processes your data
| Processor | What for |
|---|---|
| Amazon Web Services | Hosts the game servers and databases in Kuala Lumpur, Malaysia (region ap-southeast-5). |
| Cloudflare | Sits in front of our website and game servers (DNS, security, delivery) and hosts this website. It sees the IP address of each request. |
| Sentry (Functional Software, Inc.) | Receives crash and error reports. Our projects ingest in the United States. |
| Apple | Sign in with Apple, push notifications, Game Center, App Store purchases and TestFlight. Apple acts under its own privacy policy. |
| Telegram | Delivers waitlist sign-ups to us as a private message. |
We may also disclose data if the law requires it, or to protect the game and its players from fraud and abuse.
5. Where your data is stored
Our database and servers are in Malaysia. Some processors above (Sentry in the United States, Cloudflare and Apple globally, Telegram) handle data in other countries, so your data may be transferred outside your own country. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses or the processor’s own transfer mechanism.
6. How long we keep it, and what deletion does
We keep data only as long as the tables above say. You can delete your account at any time:
- In the app, tap your avatar to open the account sheet and choose Delete account. Deleting your Apple Account’s link to the game has the same effect. You can also email us.
- Deletion has a 7-day grace period. During it you can cancel in the app and nothing is lost.
- After 7 days we permanently delete your account, email, password hash, Apple and Game Center links, device tokens, push tokens, purchase records and login log entries, and we revoke the Sign in with Apple link with Apple.
- Your commander is not deleted but anonymised: it loses its nickname (it becomes “Derelict” plus a random code), is detached from your account, leaves its alliance, and its inbox is erased. Its worlds stay in the game so that other players’ universe is not broken. Chat lines you already posted may remain, with your old nickname, until the room trims them (see the chat table above); email us if you want them removed sooner.
- Purchases made through Apple remain in Apple’s own records.
7. Your choices and rights
Under Malaysia’s Personal Data Protection Act 2010 (PDPA) you may ask to access and correct your personal data, withdraw consent, and limit how we process it. If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to complain to your local data protection authority. To use any of these rights, email support@nebula-kings.com from the address on your account, or contact us about the account ID shown in the app. We may need to confirm that the account is yours.
In the app you can also change your notification settings, sign out, and delete your account.
Legal bases (EEA and UK users)
- Contract: running your account, the game, chat and purchases.
- Legitimate interests: security, the login log, fraud and ban-evasion prevention, moderation, crash reports and keeping the game fair.
- Consent: push notifications, the waitlist sign-up, and optional sign-in with Apple or Game Center. You can withdraw consent at any time.
- Legal obligation: where the law requires us to keep or disclose records.
8. Children
Nebula Kings is not meant for children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has an account, email us and we will delete it.
9. Security
Connections are encrypted in transit. Passwords are stored only as salted hashes, and device tokens only as hashes. No system is perfectly secure, so please choose a strong password if you add one.
10. Changes to this policy
If we change this policy in a way that matters, we will update the effective date above and, for significant changes, tell you in the app or by email if we have one. Earlier versions are available on request.
11. Contact
com1 coding Sdn. Bhd., Malaysia
support@nebula-kings.com