Legal
Privacy Policy
The short version
- We collect what the game needs to run: an account, your save, your display name, and what you write in chat.
- We don’t sell your data, share it for advertising, show ads, or track your location.
- If you buy something, Stripe (on the website) or Google Play (in the Android app) takes the payment. We never receive your card number, and we keep an order record that stays even after you delete your account.
- Other players can see your display name, title, faction, online status, chat messages (with a badge if you own Preem or the Neonyx Insignia), and market listings. Your friends also see when you were last online, and your friends and faction mates get a short notice of some of your in-game milestones (see What other players can see).
- Public, faction, and direct chat messages are deleted automatically 48 hours after they are sent.
- You can ask us for a copy of your data by emailing ekchelp@easternkc.com. You can ask us to delete your account in the game (Settings > Legal > Delete My Account) or by email. See Account & Data Deletion.
- Who we are
- What this policy covers
- Information we collect
- How we use it and our legal bases
- What other players can see
- Service providers
- Payments and purchases
- When we share information
- Where your data is stored
- How long we keep it
- Deleting your account
- Your rights
- Additional information for US state residents
- Children and teens
- Security
- Cookies and local storage
- Changes to this policy
- Contact us
01Who we are
Neonyx Idle is operated by EKC Studios, the games studio run by Eastern KCrew, LLC, a North Carolina limited liability company (“we”, “us”). We are the controller of the personal information described in this policy.
Email: ekchelp@easternkc.com
02What this policy covers
This policy covers the Neonyx Idle game in a web browser and in the Android app (com.neonyxidle.app), and this website at neonyxidle.com. It does not cover services run by other companies that you choose to use alongside the game, such as Discord, Reddit, Google Play (including its purchase screen), or Stripe’s checkout page. Those services have their own privacy policies.
This website itself sets no cookies, runs no scripts, and loads nothing from other companies. Our hosting provider processes standard request data (such as your IP address) to deliver the pages.
03Information we collect
We collect information in three ways: you give it to us, it is created as you play, or your device sends it when it connects to our servers.
| Category | What it includes | Source |
|---|---|---|
| Account and sign-in | A random account ID. If you sign in with email, your email address and, if you choose to set one, a password. A password is held only by our sign-in provider, Supabase, as a one-way hash (we cannot read it, and it never reaches our game servers). If you sign in with Discord, the account ID, username, email address, and avatar Discord shares with us. Sign-in session tokens. You can also play as a guest, in which case we hold only the account ID until you link email or Discord. | You, and Discord if you use it |
| Profile | Display name (we assign one like “Runner-1234” until you choose your own), previous display names, equipped title, faction membership and role, and when you were last online. | You, and created as you play |
| Game data | Your save: skills, items, currency, equipment, progress, and settings stored on our servers. Records of trades, transfers, market listings and sales, duels, contracts, achievements, and faction contributions. | Created as you play |
| Messages | Public chat, faction chat, direct messages, Territory War chat, and your list of blocked players. Each chat message also records whether you owned Preem or the Neonyx Insignia when you sent it, so the badge can be shown beside your name. | You |
| Friends and notices | Your friends list: who you sent a friend request to, who sent you one, and when each was accepted. Short notices about you that are sent to your friends and faction mates (see What other players can see), and friend request notices, each with your display name. A count of how many times you have cleared each dungeon, used to tell your friends about clear milestones. | You, and created as you play |
| Uploaded images | Faction logo and banner images uploaded by a faction’s leader or co-leader. These are stored in public storage and shown to every player. | You |
| Moderation records | Reports you file or that are filed about you, including a snapshot of the surrounding chat messages at the time. Chat restrictions and other moderation actions on your account. | You, other players, and our moderators |
| Security and anti-cheat | The IP address your account was created from. Flags our systems raise when accounts appear to be linked or funnelling resources to each other. Short-lived logs of game requests and their results, and rate-limit counters. | Your device, and our systems |
| Purchases | If you buy something: what you bought, when, and the order reference (a Stripe payment reference for website purchases, a Google Play order number for Android app purchases). For website purchases we also keep the amount, currency and tax, and the confirmations you gave at checkout. See Payments and purchases. Card details are collected by Stripe or Google, not by us. | You, created as you buy, and Stripe or Google |
| Error reports | When a game action fails on our servers: your account ID, the action attempted, and the error returned. | Our systems |
| 3D map diagnostics | When the Territory page’s 3D map starts, stops or fails: the graphics chip name, screen size and pixel ratio, browser version, the map’s quality setting, frame rate and the error message. No account ID or name is stored with it. We use it only to make the map work on more devices. | Your device |
| Usage and performance | Vercel Web Analytics and Speed Insights in the game record page views, referring page, browser and device type, country (derived from IP address), and page-load performance. Vercel states that these tools do not use cookies. Before a page address is sent to them, the game cuts it down: everything after a # sign is dropped, and so is every query parameter except the five campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content), so an order reference or a sign-in code in the address is not recorded. This applies to what these two tools record. It does not change the ordinary request data our hosting provider processes to deliver the pages (see What this policy covers). These two tools run on the website only. The Android app does not load them. | Your device |
We do not collect your password in readable form (a password you choose is stored only as a one-way hash by Supabase, our sign-in provider), precise location, contacts, photos (other than faction images you upload), microphone or camera access, or advertising identifiers. We do not receive payment card details either: if you buy something, your card details go to Stripe on its own checkout page (website) or to Google on Google Play’s purchase screen (Android app) and never reach our servers (see Payments and purchases). The Android app requests Internet access and the Google Play billing permission, and Google’s billing library adds a network-status permission. None of them shows a prompt, and the app asks for nothing else.
04How we use it and our legal bases
We use personal information only for the purposes below. If you are in the European Economic Area (EEA) or the United Kingdom, the legal basis for each is shown in brackets.
- To run the game and your account: signing you in, saving and syncing your progress, delivering messages, and running trades, the market, parties, factions, and PvP. (Performance of our contract with you.)
- To keep the game fair and safe: detecting multiple accounts and resource funnelling, preventing cheating and abuse, rate limiting, and handling player reports. (Our legitimate interests in a fair game and a safe community.)
- To fix problems and improve the game: error reports, performance measurement, and aggregate usage. (Our legitimate interests in a working product.)
- To take payment and deliver what you buy: creating your order, delivering the item to your account, and handling refunds and billing questions. (Performance of our contract with you.)
- To prevent payment fraud and handle disputes: spotting stolen cards and refund or chargeback abuse, and answering a dispute with your bank. (Our legitimate interests in preventing fraud.)
- To keep tax and accounting records, and proof of your checkout confirmations: (Legal obligation, and our legitimate interests in being able to show what you agreed to.)
- To communicate with you: replying to support requests and sending sign-in links. We do not send marketing email. (Performance of contract, and our legitimate interests.)
- To meet legal obligations: responding to lawful requests and keeping records the law requires. (Legal obligation.)
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see Your rights). We do not make decisions about you using only automated processing that has legal or similarly significant effects. Anti-cheat flags are reviewed by a person before any action is taken on an account.
05What other players can see
Neonyx Idle is a multiplayer game. Other players can see:
- your display name, equipped title, and faction;
- whether you are currently online;
- if you and another player have accepted each other as friends: when you were last online (for example “Last online 3h ago”) and your faction tag, unless either of you has blocked the other;
- your friends and the members of your faction: a short notice with your display name when you forge a Masterwork weapon, craft a Perfect Masterwork module, find a Masterwork Catalyst or Socket Bore in a cache, reach a dungeon clear milestone (your 1st, 10th, 50th, 100th, 250th, 500th or 1000th clear of a dungeon), complete an Elite or Legendary achievement, or reach Mastery level 99 or 120 in a skill. A player you have blocked, or who has blocked you, is not sent these notices. Each player can turn friend and faction notices off in Settings;
- a player you send a friend request to, or who accepts yours, sees your display name in a notice;
- a player who sends you a duel or trade request while you are away is told roughly how long ago you were last online;
- anything you post in public, faction, or Territory War chat, and direct messages you send to them;
- a small badge beside your name on your chat messages if you own Preem or the Neonyx Insignia (both are Store items), which shows other players that you own them;
- the text of a Community Canon lore entry you submit, with your display name as its author, once it is approved and published in the Lore Codex;
- your market listings, and trades, duels, or transfers you take part in with them;
- faction logos and banners, which anyone can view.
Our moderators, who may include trusted members of the player community that we appoint, can see reports, chat snapshots attached to reports, and moderation history. They can also open a moderator-only player list that shows each account’s display name, when it was last online, and whether it is a guest account. They are bound by our instructions and may only use this information to moderate the game. Moderators cannot see IP addresses. Sign-up IP addresses are accessible only to the company’s owner, and only to investigate accounts flagged as possibly linked.
06Service providers
These companies process personal information for us so the game can run. They may only use it to provide their service to us, with one difference for Stripe and Google, explained in Payments and purchases.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, authentication, file storage, real-time messaging, and server functions. Holds your account, save, messages, and uploaded images. | United States (Virginia) |
| Render | Runs our game servers. Processes game requests, including your sign-in token and IP address, on their way to the database. | United States (Virginia) |
| Vercel | Hosts the game and this website, and provides Web Analytics and Speed Insights. | Global network, United States company |
| Discord | Sign-in, only if you choose Sign in with Discord. | United States |
| Stripe, Inc. and the Stripe entity that serves your region | Takes payment for website purchases on its own checkout page, calculates sales tax or VAT, and screens payments for fraud. See Payments and purchases: Stripe is also an independent controller of some of this data. | United States, and other countries where Stripe operates |
| Distributes the Android app through Google Play, takes payment for purchases made in the Android app, and tells our servers whether a purchase is genuine. See Payments and purchases: Google is also an independent controller of the payment data it holds. | Global |
07Payments and purchases
Optional digital items can be bought in the web version of the game and in the Android app. On the website, payments are taken by Stripe, Inc. and the Stripe company that serves your region (together, “Stripe”), on a checkout page that Stripe hosts. In the Android app, payments are taken by Google through Google Play, on Google Play’s own purchase screen. We never receive your card number, expiry date, or security code. They go directly to Stripe or Google.
Stripe’s role. Stripe handles payment data for us, and it also decides for itself how to use some of it, for example for fraud prevention, to meet its own legal duties, and to improve its services. For that part Stripe is an independent controller under its own privacy policy: stripe.com/privacy. Please read it. Cookies on Stripe’s checkout page are covered in our Cookies page.
| Who | What they hold |
|---|---|
| Stripe, on its checkout page | The details you enter to pay: card or other payment method details, name, billing address or postal code where required, and email address. Device and browser information, including IP address, that Stripe uses for fraud prevention and security. Stripe’s own records of the payment, tax calculation, and any refund or dispute. What exactly is collected depends on your payment method and location and is set by Stripe. |
| Google, on Google Play | The details you enter to pay and your Google account details, held under Google’s own terms and privacy policy: policies.google.com/privacy. The Android app tags each purchase with a one-way code made from your account ID (not your name or email), so we can tell which account it was bought for. Google can also tell us if it refunds, charges back or cancels a purchase. |
| Us, in our database | An order record for a website purchase: the Stripe checkout session ID, your account ID, the item and quantity, the amount, currency and tax amounts, the Stripe payment reference, and the order’s status and timestamps. A record of the checkout confirmations you gave (immediate delivery and loss of the right to withdraw, and your age or your parent’s permission and your right to use the card) with the time and the version of the wording shown. A log of what was delivered to your account. A list of the Stripe notifications we have already processed, so none is processed twice. Any refund or dispute notice from Stripe, kept so a person can review it. |
| Us, in our database, for Android purchases | An order record: your account ID, the item and quantity, Google’s order number, the time Google says the purchase completed, a country code Google reports, and whether it was a test purchase. A one-way fingerprint of Google’s purchase token (the token itself is not kept in the order record), which lets us make sure the same purchase is never delivered twice. A log of what was delivered to your account. Any refund, chargeback or cancellation notice from Google, kept so a person can review it. |
We do not store your IP address with payment records, and we do not store your card details. Stripe tells us whether the payment succeeded and the amounts, not your card number. Google tells our servers whether a purchase is valid and what it is for, not your card number or your Google payment details. We use your account ID, not your name, to link an order to you in our records.
Why, and on what basis. We use this information to take your payment and deliver your item (performance of our contract with you); to prevent fraud and answer chargebacks and other disputes (our legitimate interests); and to keep tax, accounting, and consumer-law records, including proof of what you confirmed at checkout (legal obligation, and our legitimate interests). We do not use payment data for marketing and we do not sell it.
How long. We keep order and payment records for as long as the law requires, generally up to seven years, for legal, tax, accounting, fraud-prevention, and dispute purposes. These records are kept even if you delete your account (see Deleting your account). Stripe and Google keep their own records for the periods set out in their privacy policies.
Where it goes. Stripe and Google are United States companies that operate in many countries, so your payment data may be processed outside your country. They describe the safeguards they use for transfers in their privacy policies. Our own order records are stored in the United States with our other data (see Where your data is stored).
Who may buy. You must be at least 18, or at least 13 with a parent or guardian’s permission, and the payment card or other payment method must be yours or its owner must have authorised you to use it. Google Play applies its own rules about who can buy, and they apply to you as well. See Children and teens. For refunds, see our Refund Policy.
08When we share information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only:
- with the service providers listed above, including Stripe and Google, which receive what they need to take your payment and to handle refunds and disputes;
- with other players, as described in What other players can see;
- when required by law, or when we believe in good faith that disclosure is needed to protect someone’s safety, investigate fraud, or enforce our Terms of Service;
- as part of a merger, acquisition, or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.
09Where your data is stored
Our servers and database are in the United States. If you play from outside the US, your information is transferred there. For transfers from the EEA, UK, or Switzerland, we rely on the safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses, or on the provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it holds one. You can ask us for more information about these safeguards. Payments are covered separately in Payments and purchases.
10How long we keep it
We keep information only as long as we need it. Periods that are enforced automatically are marked as such.
| Information | How long |
|---|---|
| Public, faction, and direct chat messages | Deleted automatically 48 hours after being sent. |
| Territory War chat | Deleted automatically after 60 days. |
| Game request logs | Deleted automatically after 7 days. |
| Friend and faction notices, and friend request notices | Deleted automatically once older than 7 days (old notices are removed whenever a new one is written). |
| Friends list and dungeon clear counts | While your account exists, or until you or your friend removes the friendship. Removed when you delete your account. |
| Rate-limit counters | Deleted automatically after 2 hours. |
| Linked-account and funnelling flags | Deleted automatically after 90 days. |
| Account, profile, save, email, sign-in links, and sign-up IP address | While your account exists. Removed when you delete your account. |
| Account deletion request (your account ID and the date you asked in the game) | Until we have carried out the deletion, or you cancel the request. After a deletion it remains as a number with no name, email, or other detail, so we can see the request was handled. |
| Trades, transfers, market sales, duels, and faction records | While the game runs, because they are also part of other players’ history. When you delete your account, your name on them is replaced with an anonymous tag. |
| Order and payment records (what you bought, amount, tax, Stripe or Google Play order reference, checkout confirmations, delivery log) | For as long as the law requires, generally up to seven years, including after you delete your account. Stripe and Google keep their own records under their own policies. |
| Community Canon lore entries you submit | The text stays in the Lore Codex, including after you delete your account. After deletion, your name on it is replaced with an anonymous tag. |
| Player reports (with their chat snapshot) and moderation actions | As long as needed to enforce our rules and prevent repeat abuse, including after account deletion. |
| Error reports | Deleted automatically after 30 days. You can ask us to delete yours sooner at any time. |
| 3D map diagnostics | Deleted automatically after 30 days. They hold no account ID, so they cannot be matched to you. |
| Support emails | As long as needed to resolve your request and keep a record of it. |
11Deleting your account
You can ask us to delete your account at any time. When we delete it:
- your save and game data are deleted;
- your profile is cleared, including your sign-up IP address;
- your friends list (in both directions), every friend and faction notice you sent or received, and your dungeon clear counts are deleted;
- your email address, Discord link, and active sessions are removed, and the account is permanently disabled;
- your name on records shared with other players (trades, duels, chat, faction history) is replaced with an anonymous tag, so their history still makes sense without identifying you;
- if you lead a faction, leadership passes to a co-leader or the longest-serving member, or the faction is disbanded if you are its only member.
Chat messages that are still within their automatic deletion window expire on the normal schedule. Reports and moderation records are kept as described above. A Community Canon lore entry you submitted stays in the Lore Codex: only your name on it is replaced.
Payment records are kept. If you bought something, we keep the order and payment records for as long as the law requires, generally up to seven years, even after your account is deleted. We keep them for legal, tax, accounting, fraud-prevention, and dispute purposes. The law allows this despite a deletion request. After deletion they are no longer linked to your email address, only to the anonymous ID of the disabled account. Stripe and Google keep their own records and we cannot delete those. Deleting your account also removes the items you bought and does not by itself entitle you to a refund. Full instructions are on the Account & Data Deletion page.
12Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it in a portable format;
- correct information that is wrong;
- delete your information;
- object to or ask us to restrict processing based on legitimate interests;
- withdraw consent where we rely on it, without affecting processing that has already happened;
- complain to your local data protection authority. In the UK, that is the Information Commissioner’s Office. In the EEA, it is the supervisory authority in your country.
To use any of these rights, email ekchelp@easternkc.com from the address linked to your account. If your account uses Discord or guest sign-in, include your in-game display name. We may ask for more information to confirm the account is yours before acting. This protects you from someone else requesting your data. We respond within one month (45 days for requests under US state laws), and will tell you if we need longer where the law allows. We do not charge for requests unless they are clearly unfounded or excessive.
13Additional information for US state residents
This section applies to residents of California and other US states with consumer privacy laws, such as Virginia, Colorado, Connecticut, Oregon, and Texas.
Categories collected in the last 12 months: identifiers (account ID, email, display name, IP address); commercial information (records of items you buy from us, without card numbers); internet or other electronic network activity (gameplay, requests, and usage data); approximate location in the form of country derived from IP address; and inferences limited to anti-cheat flags. We do not collect sensitive personal information as defined by California law, other than account login credentials issued through email links or Discord, which we use only to sign you in.
Sources, purposes, and recipients are described in Information we collect, How we use it, and Service providers.
Sale and sharing: we have not sold or shared personal information, as those terms are defined in California law, in the last 12 months, and we do not knowingly sell or share the information of consumers under 16. Because we do not sell or share, there is nothing to opt out of. We still treat a Global Privacy Control signal as a valid opt-out request.
Your rights: you may request to know, access, correct, or delete your personal information, and you may use an authorized agent to make a request for you, subject to verification. If we deny your request, you may appeal by replying to our decision. If the appeal is denied, you may contact your state attorney general. We will not discriminate against you for exercising these rights.
14Children and teens
You must be at least 13 years old to play Neonyx Idle. If you are under 18, or under the age of digital consent where you live, a parent or guardian must agree to our Terms of Service for you. To buy anything you must be at least 18, or at least 13 with a parent or guardian’s permission, and the payment card or other payment method must be yours or its owner must have authorised you to use it; the website checkout asks you to confirm this, and Google Play has its own rules for its buyers. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email ekchelp@easternkc.com and we will delete it.
15Security
Connections to the game and this website are encrypted in transit. Access to your save data is restricted to your own account and enforced by the database. Game actions that affect your progress are checked on our servers rather than trusted from your device, and staff access to personal information is limited to people who need it. No system is perfectly secure. If you find a vulnerability, please report it as described on our Support page. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
16Cookies and local storage
The game stores a sign-in session and a local copy of your save in your browser or device so it can start quickly and keep you signed in. It does not use advertising or tracking cookies. The Cookies & Local Storage page lists every entry and how to clear them, and explains the cookies that Stripe’s own checkout page sets if you buy something.
17Changes to this policy
If we change this policy, we will update the dates at the top of this page. If a change is significant, we will announce it in the game or on our Discord before it takes effect.
18Contact us
EKC Studios
Eastern KCrew, LLC
ekchelp@easternkc.com