1. Controller and contact
Nemes1s determines how account and licensing data is used for this service. Privacy, account, security and data-rights requests may be sent to support@nemes1s.com.
2. Data collected
Account data may include a verified email address, account and database provider user ID, display name, avatar URL, preferred language, account dates, password status, connected-provider identifiers, authenticator-factor status and notification choices.
Public-profile data may include a chosen handle, biography, avatar, visibility setting and optional X or Bluesky handles. Public information is visible to anyone who opens the profile URL.
Security data may include session and device identifiers, Windows installation fingerprints stored as keyed hashes, device category, browser and platform details, timestamps, event type, truncated user agent, login outcome and a keyed hash of the IP address. Raw IP addresses are not intended to be stored in account tables. Security alerts may be emailed to the operator and, for important account changes, to the affected user.
Licensing data may include product ownership, source, itch.io verification result, last key characters, a one-way key fingerprint, an encrypted copy of a successfully claimed itch.io key for periodic purchase-status revalidation, entitlement status and expiry, device fingerprints, program version, launch and check counts, last access, refund or fraud status, appeals and administrative actions.
Cloud-save data may contain the JSON content submitted by a supported program, its product, slot, revision and timestamps. Users should not place passwords, payment details or sensitive third-party data in cloud saves. Blacklist records may contain keyed hashes of identifiers, the reason, evidence notes, dates and review actions.
When the Throne integration is used, signed webhook events may include the Throne gifter username, gift message, item name and thumbnail, amount, currency, event type, event ID and timestamp. Nemes1s may associate non-anonymous events with an account after one-time message verification or a manual administrator association, and may derive totals, ranks, levels, streaks, achievements and objective progress from those events.
Throne leaderboard participation, exact public totals, profile rank or crowns, and display-name use in live website activity are optional settings. Anonymous Throne events are not attributed to a Nemes1s account. Different currencies are stored and ranked separately rather than combined into one amount.
3. Purposes and legal bases
Account creation, authentication, recovery, settings, ownership claims, device authorization, cloud saves and support are processed to provide the requested service and perform the account agreement. Security, fraud prevention, rate limiting, abuse detection, audit records, key revalidation and service integrity may rely on legitimate interests balanced against user privacy interests. Optional promotional email and Discord notifications rely on consent and remain disabled by default. Legal retention or disclosure may rely on a legal obligation where applicable.
4. Providers and recipients
The service uses specialist providers for hosting, server functions, authentication, databases, email delivery, support mail, bot protection, optional social connections, optional Discord messages, aggregate analytics, performance monitoring and purchase verification. Each provider processes only the information needed for its role under its own terms and privacy documentation.
Access is limited to Nemes1s and providers that need the data for their role. Administrative actions are logged. Personal data is not sold to advertisers.
5. International data handling
Some infrastructure or support providers may process data outside the European Economic Area. Where this happens, Nemes1s relies on the provider's documented transfer mechanism, such as an applicable adequacy decision, contractual safeguards or another lawful transfer basis, and reviews those arrangements when providers or processing locations change.
6. Retention
Active account, preference, profile, entitlement and current-device data is kept while needed to operate the account. Routine login and security events are normally retained for about 180 days; critical security events for up to two years; device-replacement history for about 400 days; completed one-time authorization requests for about seven days; and rate-limit buckets for about two days. Purchase claims, entitlement history, license-use records, administrative actions, refund/fraud evidence and blacklist records may be kept longer where needed to prove ownership, prevent repeated abuse, handle appeals, resolve disputes or meet legal obligations.
Minimal unsubscribe suppression data is retained as long as needed to honour an opt-out. Provider logs and backups follow separate schedules and may persist temporarily after deletion. Retention should be reviewed and shortened where the operational or legal need ends.
Accounts that never verify their email are removed after seven days. Historical paid-link records may retain an encrypted buyer email, a one-way email match, order reference, item, amount, purchase date, refund state and ownership-claim state where needed to restore purchases and handle disputes.
Disconnecting a Throne username stops future automatic attribution but does not automatically erase signed historical event records. Account-linked progress rows and preferences are removed with the account where configured to cascade; signed provider events may be retained for audit, duplicate prevention, dispute handling and leaderboard integrity for as long as those purposes reasonably require.
7. Optional notifications and withdrawal
Optional categories are unchecked by default. Users may change email and Discord choices in Account Preferences. Optional emails contain preference and unsubscribe controls. Withdrawal affects future optional messages and does not stop necessary verification, recovery, security, transaction or licensing messages.
8. Local storage, analytics and anti-bot tools
Local storage may hold age confirmation, language, account-session data, pending onboarding choices, wheel discoveries and random device or installation identifiers. Hoster analytics and performance telemetry provide aggregate usage and performance information. Anti-bot checks may process browser and network signals to distinguish people from automated abuse.
9. Security
Controls include HTTPS, managed authentication, verified email, optional TOTP two-factor authentication, Row Level Security, server-only secrets, same-origin checks, strict validation, database-backed rate limiting, anti-bot checks, security headers, keyed hashes, encrypted claimed-key storage, device controls, signed provider webhooks and audit logs. Suspicious events may trigger automatic alerts. No system or device fingerprint can be guaranteed impossible to bypass, and controls are reviewed as risks change.
10. Requests and choices
Users may contact support@nemes1s.com to request access to, correction of, or deletion of account information, to change communication choices, or to raise a privacy concern. Some requests may require reasonable identity verification, and certain records may be retained where needed for security, ownership, disputes or legal obligations.
11. Account deletion
Self-service account deletion removes the active login account and account-linked profile, preferences, connections, active devices and cloud saves from the active database where configured to cascade. Some purchase, entitlement, fraud-prevention, blacklist, security, unsubscribe, dispute and backup records may remain for the limited periods and purposes described above. Deleting an account may make account-bound programs unusable unless ownership is restored after a supported review.
12. Adults only, blacklisting and changes
Accounts are intended only for adults aged 18 or older. When credible evidence shows that an account belongs to a minor, it may be banned and keyed identifiers may be blacklisted to prevent repeated registration. Material changes to this notice will be dated and may be announced through the website or required account messages. Renewed consent will be requested where legally required.