Privacy policy
This policy explains what personal data Console Villa collects when you play Eternal Nexus: Echoes, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).
1. Who we are
Eternal Nexus: Echoes is made by Console Villa ([Registered business name], registered with the Corporate Affairs Commission under [CAC RC/BN number], of [Registered business address, Nigeria]). We are the data controller for the personal data described here. You can reach us about privacy at [data protection email address].
Owner to decide: whether Console Villa must register with the NDPC as a data controller of major importance and appoint a Data Protection Officer, and if so add the DPO's name and contact here.
2. What we collect
| Data | Where it comes from | Examples |
|---|---|---|
| Account data | You, when you sign up or sign in, through Firebase Authentication (a Google service) | Email address; an account ID; sign-in method. If you sign in with Google, Google also shares your name and profile photo link with Firebase. Passwords are handled by Firebase: we never see or store them. |
| Date of birth | You, when you sign up (or the first time you sign in after we started asking) | The date of birth you declare, and the date and time you declared it. Kept on our server only (your browser can't read it back), and used only to confirm you're 18 or over. |
| Your Legend | You, in the character creator | Legend name, class, race and appearance choices |
| Game progress | Our game server, as you play | Level, rank, stats, Nexium balance, skills, items and gear, and a record of each Nexium credit and spend |
| Chat | You, when you chat in the game | Messages pass through our game server, which filters them and shows them to players nearby. They are held only in the server's memory and are not saved, except when a player reports one (see below). |
| Reports | Players who report a chat message | The reported message as shown and as typed, the sender's and reporter's Legend names and account IDs, the reason and the time |
| Technical data | Your browser and our hosting providers | IP address, browser and device type, and error logs, which our hosting providers process to deliver the site and keep it secure |
| Purchase data | You and Paystack, our payment provider | Transaction reference, bundle, amount, status, date and the email used. Card and bank details go to Paystack only; we never receive them. You can see your own purchase receipts in the game. |
| Nexium transfers | You, when you send Nexium to another Legend | Who sent it to whom (Legend names and account IDs), the amount, the tax and the time, in both players' histories |
We do not use advertising trackers, sell personal data, or build advertising profiles. We do not currently use analytics cookies.
3. Why we use it, and our lawful bases
- To run your account and the game (sign-in, saving your Legend and progress, showing your Legend to other players): necessary to perform our agreement with you, our terms of service.
- To keep the game fair and safe (checking movement and purchases on our server, filtering chat, handling reports, preventing cheating, fraud and abuse): our legitimate interests in a safe, fair game, and protecting other players.
- To process purchases (when the store opens) and keep financial records: to perform our agreement with you, and to meet our legal obligations.
- To reply when you contact us: our legitimate interest in helping you, or performing our agreement with you.
- To keep the game for adults (your date of birth, and the short-term records that stop an under-18 signing straight back up): our legitimate interest in, and legal responsibility for, not processing children's data without the safeguards the NDPA requires.
- Where we rely on consent: you can withdraw it at any time by contacting us.
4. Adults only (18+)
Eternal Nexus: Echoes is for adults aged 18 and over. Under the NDPA a child is anyone under 18, and we do not knowingly collect or keep children's personal data.
- Age is self-declared. We ask for your date of birth when you sign up (or once, the next time you sign in, if your account is older than this rule). We store it on our server with the date and time you declared it, and use it only to confirm you're 18 or over. We don't ask for identity documents.
- If you declare you're under 18, we don't create an account for you. If an account already exists (for example after signing in with Google), we close it straight away and delete its data, including the date of birth you entered. To stop an immediate re-signup, we keep only:
- a one-way scrambled code (a "hash") made from the email address, for 30 days, which can't be turned back into the address; and
- a note in that browser, for 24 hours.
- If we learn an account belongs to someone under 18, we close it and delete its data: the sign-in account, the date of birth, the Legend, game progress and Nexium, and chat reports they sent or that quote them. A parent or guardian who believes their child has an account can tell us through the contact page, and we will act on it.
Chat also blocks links and hides email addresses and phone numbers, and players can mute and report others.
5. Who we share it with
We share personal data only with service providers that help us run the game, under contracts that protect it:
- Google (Firebase Authentication and Cloud Firestore): sign-in and storing accounts, Legends, progress and reports.
- Vercel: hosting the website.
- Render: hosting the game server that runs the multiplayer town, chat and purchases.
- Paystack: processing payments.
Other players see your Legend's name, class, appearance and what you say in chat, but never your email address or account ID. We may also disclose data where Nigerian law requires it, or to protect players' safety.
6. Data stored outside Nigeria
Some of our providers store or process data on servers outside Nigeria (for example in Europe or the United States). Where we transfer personal data out of Nigeria, we do so as the NDPA allows, relying on the protections those providers offer (such as their data processing terms and standard contractual clauses).
Owner to decide: list the Firestore database location chosen in the Firebase console, and the Render region.
7. How long we keep it
- Account, Legend and progress data, and your declared date of birth: while your account is open. If you ask us to delete your account, we delete it within [30 days].
- Accounts of under-18s: closed and deleted as soon as we know. The scrambled email code that stops an immediate re-signup is deleted after 30 days.
- Chat: not stored, except reported messages, which we keep for up to [12 months] to handle the report and any repeat behaviour.
- Purchase records: for as long as Nigerian tax and company law requires ([6 years]).
- Server logs: kept by our hosting providers for their standard periods, usually a few weeks.
8. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, or its use restricted, in the cases the law allows;
- object to processing based on our legitimate interests;
- receive your data in a common machine-readable format, and have it sent to another controller where technically feasible;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you.
To use any of these rights, email [data protection email address] from the address you sign in with. We may need to confirm it's you. We will respond within the time the law requires, and without charge in most cases.
9. How we protect it
- All traffic to the site and the game server is encrypted (HTTPS and secure WebSockets).
- Your Nexium, items and progress can only be changed by our game server; database security rules stop anyone else, including your own browser, from changing them.
- Chat reports, purchase records and dates of birth can only be read by Console Villa.
- Secret keys are kept out of our code, in our hosting providers' protected settings.
If a personal data breach puts your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, and tell you without delay where the law requires.
10. Storage on your device
The game stores a few things in your browser so it works properly. These are not used for advertising or tracking:
- Firebase sign-in data, so you stay signed in;
- whether you've already seen the opening gate in this visit;
- the list of players you've muted in chat;
- for 24 hours, a note that someone in this browser said they were under 18 (no personal details).
11. Changes to this policy
We will update this policy when what we collect changes (for example when the Nexium store opens), and show the date at the top. If a change significantly affects you, we will tell you in the game or by email.
12. Contact and complaints
Questions or requests: [data protection email address], or see our contact page.
If you're unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC), at ndpc.gov.ng.