NodesDot Privacy Policy / Dasar Privasi

1. Overview & Data Controller

NodesDot ("we", "us", "our") is a strategy board game platform published and operated in Malaysia. This Privacy Policy governs how we collect, use, process, and protect your personal data across web and mobile platforms in full compliance with the Personal Data Protection Act 2010 of Malaysia (PDPA) and the Personal Data Protection (Amendment) Act 2024.

2. Personal Data We Collect

• Account Credentials: Email address, hashed credentials, authentication tokens, and third-party provider IDs (Google Sign-In, Apple Sign-In). Anonymous guest tokens are used for guest sessions.
• Profile & Customization: Chosen username, display name, nationality country code, custom avatar image, and equipped cosmetic themes/stone skins.
• Gameplay & Ratings: Move history, match timestamps, starting/ending ELO ratings, leaderboard metrics, and victory/defeat outcomes.
• Social & Moderation: Friends list, friend requests, user blocklists, user safety reports (reason, category, reporter/reported IDs), and privacy preference toggles (match history visibility, chat toggle, friend requests).
• Ephemeral In-Game Chat: Real-time match chat and emoji reactions transmitted over encrypted WebSockets during active matches. Match chat is ephemeral and not permanently archived.
• Technical & Push Notifications: IP address, device model, operating system version, crash diagnostics, and Firebase Cloud Messaging (FCM) push tokens.
• Optional Permissions: Photo library access is requested only if you choose to upload a custom profile avatar. Contacts permission is requested only if you choose to invite friends, processed entirely on-device without server scraping.

3. Purposes of Data Processing

• Providing online multiplayer matchmaking, board game synchronization, and rank calculation.
• Managing user profiles, saved visual themes, and game records.
• Maintaining community safety, preventing cheating/botting, and investigating user reports.
• Delivering opt-in push notifications for match invites and friend activity.
• Complying with Malaysian legal and regulatory obligations.

4. Third-Party Processors & Cross-Border Transfers

We do not sell your personal data. Data is processed exclusively with trusted cloud infrastructure providers strictly necessary to deliver the service:

• Supabase Inc.: PostgreSQL cloud database, authentication, file storage, and real-time infrastructure.
• Google LLC: Firebase Cloud Messaging (push notifications) and Google OAuth sign-in.
• Apple Inc.: Apple Sign-In authentication and iOS distribution.
• Vercel Inc.: Global CDN and web application hosting.

Cross-Border Transfer (PDPA Section 129): Cloud servers are hosted in secure data centers outside Malaysia (including Singapore and the United States). By using NodesDot, you consent to the cross-border transfer, storage, and processing of your data with industry-standard encryption.

5. Retention & Account Deletion

• Data is retained while your account remains active.
• In-App Deletion: You can permanently delete your account at any time in-app via Settings > Delete Account.
• Upon deletion, your email, profile, avatar image, and authentication credentials are permanently deleted. Historical games are anonymized to preserve match statistics for opponents.

6. Your Rights Under Malaysian Law (PDPA)

Under the Malaysian PDPA (2010/2024), you have the right to:

• Access: Request confirmation and access to your personal data (Section 30).
• Correction: Correct inaccurate or incomplete data (Section 34).
• Withdraw Consent: Withdraw consent for data processing at any time (Section 38).
• Data Portability: Obtain a structured, machine-readable copy of your personal data.
• Prevent Processing: Prevent processing likely to cause unwarranted damage or distress (Section 42).

7. Children's Privacy

NodesDot is intended for users 13 years of age and older. In line with the Malaysian Age of Majority Act 1971, players under 18 must have parent or guardian consent before using the platform.

Notis Ringkas Privasi (Bahasa Malaysia)

Selaras dengan Akta Perlindungan Data Peribadi 2010 (APDP) dan Akta Pindaan 2024:

• Data Yang Dikumpul: Maklumat akaun (e-mel, nama pengguna, avatar), rekod perlawanan, penarafan ELO, senarai rakan/sekatan, dan token notifikasi (FCM).
• Tujuan: Menyediakan perlawanan papan dalam talian, pengurusan profil, keselamatan sistem, dan notifikasi perlawanan.
• Pemindahan Luar Negara: Data anda disimpan secara selamat di pelayan awan (termasuk Singapura/AS) dengan enkripsi penuh mengikut Seksyen 129 APDP.
• Pemadaman Akaun: Anda boleh memadamkan akaun anda secara kekal bila-bila masa melalui Settings > Delete Account.
• Hak Anda: Hak untuk mengakses, membetulkan data, menarik balik persetujuan, meminta kebolehalihan data, dan menghalang pemprosesan data yang memudaratkan.

Contact & Inquiries / Hubungi Kami

For questions or data protection inquiries under Malaysian law:

Email: support@nodesdot.com

Platform: NodesDot (Malaysia)