The short version
- We store only what the games need: your email, your username and your game results.
- No ads, no analytics, no tracking cookies, and we never sell your data.
- Your username and scores are public on the leaderboards. Your email is never shown.
- You can delete your account and all of your game data yourself, at any time, on the Account page.
Who is responsible
NULLWIRE (https://nullwire.org) is a free, non-commercial fan project run by the NULLWIRE team, based in the Netherlands. They are the "controller" of your data under the GDPR (AVG). For anything about your data, email contact@nullwire.org.
What we store and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, password (stored only as a one-way hash; we can't read it), username, and 2FA setup if you turn it on | Your account: logging in, resetting your password, keeping it secure | Providing the service you signed up for (art. 6(1)(b) GDPR) |
| Game data: every breach run (the puzzle, each pick and its timing, your score), duels (moves, timings, results), ratings, your cyberdeck, XP, level and Creds | Running the games, the leaderboards and the rankings | Providing the service (art. 6(1)(b)) |
| Anti-cheat results: a suspicion score and the reasons for it, per run | Keeping the leaderboards fair | Legitimate interest in fair play (art. 6(1)(f)) |
| Technical data: IP address, browser type, times of requests | Security, bot protection and fixing errors. These end up in our providers' server logs. | Legitimate interest in a secure site (art. 6(1)(f)) |
We do not ask for your real name, address, date of birth or payment details.
What other people can see
- Everyone: your username, your best scores and your duel ratings on the public leaderboards.
- Your duel opponents: your username and your moves in the duels you play against them.
- Nobody else: your email address, your individual runs and your anti-cheat results. Only you and the site operator can see those.
The anti-cheat ("the referee")
The server automatically checks every score, for example whether your picks came at humanly possible speeds. It gives each run a suspicion score. Clearly human runs go straight onto the leaderboard. Suspicious runs are hidden until a person has looked at them. Only runs that are practically impossible for a human are rejected automatically.
Bans are only ever given by a person, never by the computer alone. If you think a run was wrongly hidden or rejected, email us and a person will look at it again.
Cookies and browser storage
We don't use tracking or advertising cookies, and there is no analytics. Your browser stores only what the site needs to work:
- your login session, so you stay logged in;
- small preferences such as sound on/off and the tab or game mode you picked last.
When you sign up or log in, Cloudflare Turnstile may run a short check to stop bots. Because all of this is strictly necessary, the site doesn't need a cookie banner.
Who processes your data for us
| Company | What for | Where |
|---|---|---|
| Supabase | Accounts, database and the game servers. Stores all of the data above. | Frankfurt, Germany (EU) |
| Cloudflare | Bot check at sign-up and login (Turnstile): sees your IP address and browser signals. Also runs this domain's DNS and forwards emails you send to our addresses. | Global network |
| Resend | Sends the site's emails (sign-up confirmation, password reset). Sees your email address and the email's content. | Ireland (EU) |
| Netlify | Hosts the website files. Sees your IP address in its access logs. | Global network |
| jsDelivr | Delivers the Supabase code library to your browser. Sees your IP address. | Global network |
| Google (Gmail) | Our mailbox: emails you send us are stored there. | Global |
Some of these companies are based in the United States. Where data leaves the EU, they protect it under the EU–US Data Privacy Framework and/or the EU's standard contractual clauses, as set out in their data processing agreements. The site's fonts are hosted on the site itself, so no data goes to Google.
How long we keep it
- Account and game data: until you delete your account.
- Server logs (IP addresses): kept by our providers for a short time, usually days to a few weeks, then deleted automatically.
When you delete your account, your profile, runs, scores, deck, Creds and duels are deleted straight away. Your duels also disappear from your opponents' history.
Your rights
Under the GDPR you can ask to see your data, correct it, delete it, receive a copy of it (data portability), limit how we use it, or object to how we use it. You can delete everything yourself on the Account page. For anything else, email contact@nullwire.org. We reply within one month.
If you're not happy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
Age
You must be at least 16 to create an account. If you're younger, you need permission from a parent or guardian. If we find out that a child under 16 signed up without that permission, we delete the account.
Security
Passwords are hashed, all traffic is encrypted (HTTPS), the database only lets each player reach their own data, and you can turn on two-factor authentication on the Account page. Found a security problem? See Report a vulnerability.
Changes
If we change this policy, we'll update the date at the top. If the change is important (for example, new kinds of data), we'll also announce it on the site.