Privacy Policy for Null Vector Studios
Updated Oct 19th 2026
This Privacy Policy describes how Null Vector Studios Oy (“we”, “our”, “us”) collects, uses, and protects personal data in relation to our newsletter, the comments on our website, website accounts, signing in to our games, purchases in our store, bug reports, translation reviews, playtest game data, the game Astro Protocol, and associated playtests.
1. Data We Collect
Email address: provided voluntarily when you subscribe to our newsletter, sign up for a playtest, leave a comment on our blog, or create an account on our website.
Account record: your email address, a display name, the sessions you are signed in on (date, IP address and browser user agent), your Discord user id if you sign in with Discord or connect it, and your Steam ID if one of our games signed you in through Steam — in which case the display name may be your public Steam name (see section 5). An account is created when you confirm a newsletter subscription, when you sign in for the first time, or when a game signs you in through Steam for the first time. See sections 4 and 5.
Game sign-ins: for each install of a game signed in to your account, a renewal code — of which we keep only a one-way fingerprint — with when it was issued and when it expires. A game you sign in with a code also gets a session like a browser’s, recorded the same way. The name the game gives its device is shown to you when you approve the code, and deleted within ten minutes. See section 5.
Purchases: when you buy a game in our store, Xsolla, who handle the payment, tell us the order number, the product and quantity, the date, the email address you gave at checkout, whether it was a test purchase, and later whether it was refunded or cancelled. Your card and other payment details stay with Xsolla and never reach us.
Game servers: if you list a server you host in a game’s server browser, its name, address and port, game version, mods, game settings and open seats, and which account listed it. If you play in a game on one of our official servers or hosted over our relay, which account is in which game.
Sign-in attempts: when a sign-in link is emailed, we record the address it was sent to, the time, and the IP address it was requested from. This is what stops the sign-in form being used to send unwanted email to other people. These records are deleted automatically after 24 hours.
Subscription record: the date and time you subscribed and confirmed, the IP address you subscribed from, and which of our emails you have chosen to receive. This is kept as proof of your consent.
Comments: the display name, email address and comment text, together with the date and time, the IP address and the browser user agent the comment was sent from. The IP address and user agent are kept as spam and abuse protection.
Bug reports: what you write in the report, the game, version and operating system you chose, and — if you attach them — your save file and your log file, together with the date and time, the IP address and the browser user agent the report was sent from. An email address only if you choose to give one, or the address on your account if you were signed in. The IP address and user agent are kept as spam and abuse protection.
Translation reviews: your verdict on a string, and the comment and suggested wording you write, together with the date and time and the IP address it was sent from. On the website a review is made from your account. A report sent from inside the game also records the game version, the Steam branch and the operating system it was sent from. Who sent it is checked with Steam, but your Steam ID itself is not kept: we keep only a code computed from it with a secret key (a keyed hash), which lets us recognise further reports from the same player and cannot be turned back into your Steam ID. No account is created for you, no email address is involved, and we do not ask Steam for your name. The report is shown as “In-game report”, not under any name.
Playtest game data: if you choose to share it from inside one of our games, the games you host send us a record of each turn: the game version, and for each player — human or computer — the actions they took and how the turn went, including the computer players’ reasoning. Players appear in it only as numbers. It contains no names, no chat or message text, and no Steam ID of anyone in the game. If other people play in a game you host, their actions are included the same way, as numbers. The upload carries a Steam ticket, which we check with Steam to confirm it comes from a real copy of the game; we then store only a pseudonymous code computed one-way from your Steam ID, never the Steam ID itself, so that we can tell which games came from the same host and delete them together if you ask. We do not store the IP address it was sent from.
Turn notifications: if you turn them on from your account page, which games you want to hear about, whether by email or by Discord, your quiet hours and time zone, and — if a Discord message could not be delivered — why. If you connect a Discord channel, we keep the webhook Discord gives us for it (stored encrypted, because anyone holding it could post to that channel) and the names of the server and channel. When one of our official game servers tells us a turn is ready or a deadline is near, we keep the game’s name, the turn number and deadline, and which accounts are playing it, for 30 days.
A save file and a log file contain game data — what you had built, what the game was doing, and technical details about your computer. They are not searched for anything else, and neither is ever published.
We do not collect any other personal data.
2. How We Use the Data
To send you the newsletter you subscribed to: studio and game news, and — if you choose it — an email with the release notes when a game updates.
To send invitations and instructions for playtests.
To let a moderator review comments before they are published, and to tell you when someone replies to yours.
To find and fix the bug you reported, and to ask you a follow-up question about it if you left us a way to reach you. Bug reports and their attachments are read by us and by automated triage tools, which may include AI models that help us sort the reports and turn them into tasks for our developers.
To sign you in, if you have chosen to create an account, and to show you which browsers and games are signed in.
To let you play our games online with your account — on our official servers, in games other players host over our relay, and in the list of your own games — and to list the servers players host, so that others can find them.
To show you what you have bought, and to keep the records our bookkeeping requires.
To improve the game's translations: reviews and in-game reports are read by us and fed into the next revision of the translated text. Your comment and suggestion are shown publicly next to the string, under your display name for a review on the website and as “In-game report” for a report from the game; the code computed from your Steam ID and your IP address never are. That code is used only to keep one report per person per string and to limit abuse, including refusing further reports from someone who abuses them.
To improve the computer opponents in our games: we compare how they play with how people play, across many games. Playtest game data is read by us and by automated analysis tools, which may include AI models that help us find weaknesses in the computer players. It is never published, and never used to identify or contact you.
To tell you, if you asked for it, when a turn is ready or a deadline is near in a game you play on our official servers. On Discord, that is either a direct message from our bot to the Discord account you connected — which works while you are a member of our Discord server and accept messages from its members — or a post into a channel you picked on Discord’s own screen. Every such email carries a link that stops them.
We do not use your email address for unrelated marketing or sell it to third parties.
3. Comments
Leaving a comment requires an account (see section 4). There is still no password — you sign in with a link sent to your email. Your comment is stored with the display name and address on your account, and nothing is published until a moderator has reviewed it.
Only your display name and the text of your comment are ever shown publicly. Your email address is never displayed and never published. It is used to tell you when someone replies to you, which you can turn off from any such email, and for nothing else unless you separately join the newsletter from your account page.
You can ask us to delete a published comment, or every comment you have ever left, at any time. Deleting your account does not delete your comments — they stay under the name you used, because a conversation involves the people who replied to you; ask us if you want them removed as well.
4. Accounts and signing in
Confirming a newsletter subscription also creates an account for that address, so that you can change what you receive without digging out an email. Leaving a comment requires an account. You are never required to have one in order to stop receiving email: every message we send carries an unsubscribe link that works on its own, and subscribers we imported from our previous provider have no account at all.
There are no passwords. You sign in by entering your email address and opening a link we send to it; the link works once and expires after five minutes. We store the address, a nickname (the one you chose when you subscribed, or an anonymous placeholder such as “Anonymous 481502” until you pick one — we never derive it from your email address), the date you created the account, and a record of each browser you are signed in on — its date, IP address and browser user agent — so that you can see and end those sessions yourself.
You can also sign in with Discord, or connect a Discord account to your account from your account page. Discord then tells us your Discord user id, your Discord display name, and the email address on your Discord account and whether Discord has verified it. We use the verified address the same way as one you typed in: if you already have an account with it, you sign in to that account. We keep the Discord user id, so that you can sign in with Discord again; a new account takes your Discord display name as its nickname, which you can change. We do not keep your Discord profile picture. The access tokens Discord issues are stored encrypted and not used for anything else. We never see your Discord password or your messages. Unlinking Discord on your account page deletes the Discord user id and tokens we hold.
Signing in — on the website or in a game — is not consent to anything else. Proving your address does not subscribe you to the newsletter; that remains a separate opt-in on your account page, with the same confirmation step as the public form.
When you sign in with an address you have used before, comments and any newsletter subscription at that same address are linked to your account, so that you can manage them in one place. Nothing about them changes: comments are not republished, and a subscription keeps whatever status it already had.
If you change the address on your account, we email a confirmation link to the new address and a notice to the old one. Your newsletter subscription does not move with it — consent was given for one address — so the old subscription is ended and you are invited to opt in again at the new address.
You can delete your account at any time from your account page, confirmed by a link we email you. This deletes the account, its sessions, its sign-in records and anything linked to it, and signs out every game signed in with it. Purchases are the exception: see section 10. Comments you have already posted stay published under the name you used, because a conversation involves other people too; you can ask us to remove those separately, as described below.
5. Games: signing in, game servers and purchases
Some of our games let you sign in to your account, so that you can play on our official servers and in games other players host, and find your games again. There are two ways. With a code: the game shows a short code and the name of the device it runs on, and you approve it on our website while signed in. Only approve a code you started yourself — approving someone else’s signs their copy of the game in to your account. Or, when you play on Steam, without doing anything: the game sends us a ticket from Steam, and we ask Steam which Steam account it belongs to, whether that account may play the game (and whether through Steam Family Sharing), and whether we have banned it on Steam. We then sign in the account that holds that Steam ID. If no account does, we create one for it, with no email address. We also ask Steam for your public Steam name (the “persona name” your Steam profile shows) and use it as your display name; if Steam does not give us one we can use, the account gets an anonymous placeholder such as “Anonymous 481502” instead. For an account created this way, the display name is kept in step with Steam: each time a game signs you in, it takes your current Steam name. If your account has an email address — one you created on our website and later connected to Steam — it keeps the display name you chose, and your Steam name never replaces it. We do not receive your Steam profile, friends or library.
A signed-in game holds a pass (a “game token”) that lasts one day and is renewed automatically while you keep playing. It carries your account id — a random code that says nothing about you — and your display name, and nothing else: never your email address, your Steam ID or your IP address. Who sees it: our official game servers and our relay (the service that connects players to a game another player hosts) see the token. When you join a game another player hosts over our relay, that player’s game sees your account id and display name, confirmed as genuine, and nothing else. Community servers — servers other people run on their own machines — never receive your token or any of your account data; you join them with a password, not an account.
Your account page lists every game signed in to your account, and you can sign any of them out there. A game you sign out can no longer renew its pass, so it stops working within a day. Deleting your account signs out every game in the same way.
An account created through Steam has no email address, so we never email it, and it cannot be signed in to on the website. To see what it holds or to have it deleted, email us and tell us your Steam ID.
Signing a game in is not consent to email. If a game ever offers to sign you up to the newsletter while you sign in, that is a separate box, unticked until you tick it, followed by the same confirmation as any other signup.
If you list a server you host, the details listed in section 1 are shown to everyone who opens the game’s server browser, for as long as it is listed — for a server at home, its address is your IP address. The account that listed it is never shown.
Purchases in our store are processed by Xsolla (xsolla.com). Xsolla takes the payment and tells us what was bought and the email address it was bought with; we show the purchase on the account with that confirmed address, or on the account you later create with it.
6. Bug Reports
Reporting a bug does not require an account, and an email address is optional — leave it out and the report is anonymous to us apart from the technical details listed in section 1. If you do leave one, we use it to ask about that bug and nothing else; it is never added to the newsletter.
Reports are read by us and by the automated triage tools described in section 2, which see what you wrote, the game, version and operating system you chose, and your attachments — never your email address, IP address, user agent or account. What a report says may be quoted in a task in our issue tracker. Reports are never published. You can ask us to delete a report and its attachments at any time, but please tell us roughly when you sent it and about what — without an address on it, that is the only way we can find it.
7. Cookies
When you sign in, we store a session cookie so that you stay signed in. It is signed so it cannot be altered, and you can end it at any time from your account page or by signing out. We do not use advertising or tracking cookies.
Our spam protection (Cloudflare Turnstile) sets its own cookies on the sign-in form and the bug report form, in order to tell people apart from bots.
If you start writing a comment without being signed in, your browser keeps the draft locally so that it is still there after you sign in. That draft never reaches us, and your browser discards it after a day.
8. Service Providers
Our emails are delivered by Resend (resend.com), our website and its database are hosted on Railway (railway.app), signing in with Discord goes through Discord (discord.com), which tells us who you are there when you choose to use it, the sign-in and bug report forms are protected against automated abuse by Cloudflare Turnstile (cloudflare.com), a translation report, playtest upload or game sign-in sent from a game while Steam is running is checked with Valve's Steam Web API (steampowered.com), which confirms which Steam account sent it (and, for a game sign-in, tells us that account’s public Steam name), payments in our store are processed by Xsolla (xsolla.com), which tells us what was bought, the automated analysis of bug reports and playtest game data uses Anthropic's Claude AI models (anthropic.com), and the tasks that come out of it are kept in Linear (linear.app), our issue tracker. All of them process your data on our behalf and only for the purposes described here. A turn notification you asked to receive on Discord is delivered by Discord (discord.com) — as a direct message from our bot, or into the channel you connected — and from then on is also subject to Discord’s privacy policy.
9. Legal Basis
Under the EU General Data Protection Regulation (GDPR), our legal basis for processing your email address is your consent, given when you subscribe to the newsletter, sign up for a playtest, submit and confirm a comment, create an account, or turn on turn notifications. For a bug report and anything you attach to it, our legal basis is your consent, given when you send the report. For a translation review or report, our legal basis is your consent, given when you send it. For playtest game data, our legal basis is your consent, given when you choose to share it from inside the game; you can withdraw it at any time, which stops further uploads. For signing in to our games — the Steam ID that does it, the Steam name taken as your display name, the game tokens and the record of which account is in which game — our legal basis is providing the service you asked for when you signed the game in (performance of a contract). For a purchase, it is the contract of the purchase, and keeping the record afterwards is our legal obligation under accounting law. For a server you list, it is providing the listing you asked for. For the IP address and user agent stored with a comment, a bug report or a translation review, and the code computed from the Steam ID of an in-game report, our legal basis is our legitimate interest in preventing spam and abuse.
10. Data Retention
We will retain your email address only as long as necessary for the purposes stated above, or until you unsubscribe or request deletion. If you unsubscribe, we keep your address on a suppression list so that we do not accidentally email you again; you can ask us to delete it entirely instead.
Published comments are kept for as long as the post they belong to, or until you ask us to remove them.
Sign-in attempt records are deleted automatically after 24 hours, and immediately if you delete your account.
Translation reviews are kept while the string they are about is in the game, and afterwards as the record of why it changed. You can ask us to delete your reviews at any time; for reports sent from the game, tell us your Steam ID (we compute the same code from it to find them) or roughly when and about which string you sent them.
The turn-by-turn record of a playtest game is deleted automatically 90 days after we receive it. A short summary of the game — its version, the number of players, how many turns were played, who won and when it ended — is kept afterwards. You can ask us to delete every game uploaded from your Steam account at any time: tell us your Steam ID, and we delete everything stored under the code computed from it.
A game’s renewal code expires 60 days after it was last used and is deleted then; the pass it renews lasts a day. A device sign-in code is deleted within ten minutes. A server listing is deleted within an hour of the server going quiet, together with the record of who was playing on it.
Purchases stay on your account while it exists. If you delete your account, the purchase record — what was bought, when, the order number and the address it was bought with — is kept, no longer linked to any account, for as long as Finnish accounting law requires (six years after the end of the year of the purchase), and is then deleted. If you create a new account with the same address in the meantime, the purchase is linked to it again.
Turn notification records are deleted automatically 30 days after the turn they are about. Your notification settings are deleted with your account.
Bug reports are kept while the bug is open and for as long as they are useful afterwards, and their attachments are deleted with them.
11. Your Rights
You have the right to:
Request access to your personal data.
Request correction or deletion of your data, including any comment you have left, any bug report you have sent, any playtest game data uploaded from your Steam account, and an account a game created through Steam.
Withdraw your consent at any time — every email contains an unsubscribe link and a link to change which emails you receive.
Lodge a complaint with your local supervisory authority.
To exercise your rights, contact us at: [email protected].
12. Changes
We may update this Privacy Policy from time to time. The date at the top indicates the latest version.
13. Contact
Jaakko Ojalehto
Null Vector Studios Oy
Email: [email protected]