NanoRoom Privacy Policy

Kiyak Technologie, a French SASU (SIRET 108 710 690 00018), 23 Résidence du Parc de Petit Bourg, 91000 Évry-Courcouronnes, France. For questions or data-rights requests: support@nanoroom.io.

• Account and profile: player ID, display name, progress, gameplay statistics, preferences, collection and social relationships, including the friends list and friendship links between accounts.
• Authentication: a guest identifier or a token from a sign-in provider offered in the game. When you sign in with Google, the associated email address is stored in your NanoRoom account; NanoRoom never receives your Google password. If username and password registration is available, we store your login name, verified email address and a salted password hash, never a plaintext password. Temporary verification and recovery codes are stored as hashes.
• Online play: rooms, matches, actions, rankings and data required by the authoritative game server.
• Support and reports: subject, message, language, platform, client version and a pseudonymous player reference. A report may include a copy of the relevant chat text, stored with the support request.
• Security and operations: IP address and technical events that may temporarily appear in server logs.
• Advertising, if enabled: consent status; Google AdMob in the app and Google AdSense in the browser game may process IP address (and infer approximate location), advertising interactions, diagnostics and identifiers stored on your device according to your choices. Our AdSense integration does not send your player ID, messages or progression.

• Providing accounts, matches and social features, verifying your email address and recovering your account at your request: performance of the requested service. The sign-in email address is not used for marketing messages.
• Securing the game, preventing abuse, diagnosing incidents and answering support requests: legitimate interests.
• Personalised advertising and non-essential device access: consent where required by law.
• Legal compliance and handling your rights requests: legal obligation.

Game data and verification or recovery emails are hosted or routed by OVHcloud in the European Union. Google provides Google sign-in and, when advertising is enabled, AdMob, AdSense and its consent platform. Google may process data outside the European Economic Area under the safeguards described in its own policies. We do not sell your personal data.

Account and game data is retained for the life of the account and then only as needed for closure, security and legal duties. A 180-day expiry date is set for support messages, reports and any copies of chat text they contain. Their effective deletion takes place during service purges and may occur after that expiry date. Technical logs and backups follow short operational and security cycles. For a rights request, the operational account identifier is removed after completion; a pseudonymous reference may be retained to demonstrate fulfilment. The email address and password hash are deleted with the account. Verification codes expire after 15 minutes; expired requests are purged when the authentication service receives subsequent requests. Resetting a password revokes previous sessions.

You may request access, correction, erasure, restriction, objection and, where applicable, portability. Use “Privacy & data” in the app or follow the outside-app deletion procedure. We normally respond within one month. You may also complain to the CNIL. Account deletion is irreversible once completed and may exclude records we must retain by law.

Mobile ads are requested only after checking the applicable consent. When required by Google, the app’s advertising privacy choices let you change or withdraw your decision. The browser game may display a Google AdSense unit on large screens, outside the game area. In regions where consent is required, you can accept, refuse or customise your choices in Google’s message. No display ad is requested while your choice is unknown or refused. Use “Privacy choices” below the game or the advertising choices in its settings to change or withdraw consent. The game remains accessible if you refuse, withdraw or encounter a consent error.

NanoRoom’s European launch is intended for people aged at least 16. If you believe a child’s data was processed without valid authorisation, contact us so we can delete it.

The presentation pages use the functional “NEXT_LOCALE” cookie to remember your language for 180 days; it is not used for advertising tracking. The game under /play also uses data needed to operate and, when you permit ads, Google AdSense. Google and the partners listed in the consent message may then use cookies or identifiers to serve and measure ads. The consent message lists partners and purposes; the privacy choices link below the game lets you revisit your decision.