Privacy Policy for Null Vector Studios
Updated Oct 3rd 2026
This Privacy Policy describes how Null Vector Studios Oy (“we”, “our”, “us”) collects, uses, and protects personal data in relation to our newsletter, the comments on our website, website accounts, bug reports, translation reviews, playtest game data, the game Astro Protocol, and associated playtests.
1. Data We Collect
Email address: provided voluntarily when you subscribe to our newsletter, sign up for a playtest, leave a comment on our blog, or create an account on our website.
Account record: your email address, a display name, and the sessions you are signed in on (date, IP address and browser user agent). An account is created when you confirm a newsletter subscription, or when you sign in for the first time. See section 4.
Sign-in attempts: when a sign-in link is emailed, we record the address it was sent to, the time, and the IP address it was requested from. This is what stops the sign-in form being used to send unwanted email to other people. These records are deleted automatically after 24 hours.
Subscription record: the date and time you subscribed and confirmed, the IP address you subscribed from, and which of our emails you have chosen to receive. This is kept as proof of your consent.
Comments: the display name, email address and comment text, together with the date and time, the IP address and the browser user agent the comment was sent from. The IP address and user agent are kept as spam and abuse protection.
Bug reports: what you write in the report, the game, version and operating system you chose, and — if you attach them — your save file and your log file, together with the date and time, the IP address and the browser user agent the report was sent from. An email address only if you choose to give one, or the address on your account if you were signed in. The IP address and user agent are kept as spam and abuse protection.
Translation reviews: your verdict on a string, and the comment and suggested wording you write, together with the date and time and the IP address it was sent from. On the website a review is made from your account. A report sent from inside the game also records the game version, the Steam branch and the operating system it was sent from, and who sent it: your Steam ID (the numeric SteamID64, verified with Steam). It does not come with a name or an email address — the report is attributed to an anonymous placeholder such as “Anonymous 481502”.
Playtest game data: if you choose to share it from inside one of our games, the games you host send us a record of each turn: the game version, and for each player — human or computer — the actions they took and how the turn went, including the computer players’ reasoning. Players appear in it only as numbers. It contains no names, no chat or message text, and no Steam ID of anyone in the game. If other people play in a game you host, their actions are included the same way, as numbers. The upload carries a Steam ticket, which we check with Steam to confirm it comes from a real copy of the game; we then store only a pseudonymous code computed one-way from your Steam ID, never the Steam ID itself, so that we can tell which games came from the same host and delete them together if you ask. We do not store the IP address it was sent from.
A save file and a log file contain game data — what you had built, what the game was doing, and technical details about your computer. They are not searched for anything else, and neither is ever published.
We do not collect any other personal data.
2. How We Use the Data
To send you the newsletter you subscribed to: studio and game news, and — if you choose it — an email with the release notes when a game updates.
To send invitations and instructions for playtests.
To let a moderator review comments before they are published, and to tell you when someone replies to yours.
To find and fix the bug you reported, and to ask you a follow-up question about it if you left us a way to reach you. Bug reports and their attachments are read by us and by automated triage tools, which may include AI models that help us sort the reports and turn them into tasks for our developers.
To sign you in, if you have chosen to create an account, and to show you which browsers are signed in.
To improve the game's translations: reviews and in-game reports are read by us and fed into the next revision of the translated text. Your comment and suggestion are shown publicly next to the string under your display name; your Steam ID and IP address never are. The Steam ID is used only to keep one review per person per string and to limit abuse.
To improve the computer opponents in our games: we compare how they play with how people play, across many games. Playtest game data is read by us and by automated analysis tools, which may include AI models that help us find weaknesses in the computer players. It is never published, and never used to identify or contact you.
We do not use your email address for unrelated marketing or sell it to third parties.
3. Comments
Leaving a comment requires an account (see section 4). There is still no password — you sign in with a link sent to your email. Your comment is stored with the display name and address on your account, and nothing is published until a moderator has reviewed it.
Only your display name and the text of your comment are ever shown publicly. Your email address is never displayed and never published. It is used to tell you when someone replies to you, which you can turn off from any such email, and for nothing else unless you separately join the newsletter from your account page.
You can ask us to delete a published comment, or every comment you have ever left, at any time. Deleting your account does not delete your comments — they stay under the name you used, because a conversation involves the people who replied to you; ask us if you want them removed as well.
4. Accounts and signing in
Confirming a newsletter subscription also creates an account for that address, so that you can change what you receive without digging out an email. Leaving a comment requires an account. You are never required to have one in order to stop receiving email: every message we send carries an unsubscribe link that works on its own, and subscribers we imported from our previous provider have no account at all.
There are no passwords. You sign in by entering your email address and opening a link we send to it; the link works once and expires after five minutes. We store the address, a nickname (the one you chose when you subscribed, or an anonymous placeholder such as “Anonymous 481502” until you pick one — we never derive it from your email address), the date you created the account, and a record of each browser you are signed in on — its date, IP address and browser user agent — so that you can see and end those sessions yourself.
Signing in is not consent to anything else. Proving your address does not subscribe you to the newsletter; that remains a separate opt-in on your account page, with the same confirmation step as the public form.
When you sign in with an address you have used before, comments and any newsletter subscription at that same address are linked to your account, so that you can manage them in one place. Nothing about them changes: comments are not republished, and a subscription keeps whatever status it already had.
If you change the address on your account, we email a confirmation link to the new address and a notice to the old one. Your newsletter subscription does not move with it — consent was given for one address — so the old subscription is ended and you are invited to opt in again at the new address.
You can delete your account at any time from your account page, confirmed by a link we email you. This deletes the account, its sessions, its sign-in records and anything linked to it. Comments you have already posted stay published under the name you used, because a conversation involves other people too; you can ask us to remove those separately, as described below.
5. Bug Reports
Reporting a bug does not require an account, and an email address is optional — leave it out and the report is anonymous to us apart from the technical details listed in section 1. If you do leave one, we use it to ask about that bug and nothing else; it is never added to the newsletter.
Reports are read by us and by the automated triage tools described in section 2, which see what you wrote, the game, version and operating system you chose, and your attachments — never your email address, IP address, user agent or account. What a report says may be quoted in a task in our issue tracker. Reports are never published. You can ask us to delete a report and its attachments at any time, but please tell us roughly when you sent it and about what — without an address on it, that is the only way we can find it.
6. Cookies
When you sign in, we store a session cookie so that you stay signed in. It is signed so it cannot be altered, and you can end it at any time from your account page or by signing out. We do not use advertising or tracking cookies.
Our spam protection (Cloudflare Turnstile) sets its own cookies on the sign-in form and the bug report form, in order to tell people apart from bots.
If you start writing a comment without being signed in, your browser keeps the draft locally so that it is still there after you sign in. That draft never reaches us, and your browser discards it after a day.
7. Service Providers
Our emails are delivered by Resend (resend.com), our website and its database are hosted on Railway (railway.app), the sign-in and bug report forms are protected against automated abuse by Cloudflare Turnstile (cloudflare.com), a translation report or playtest upload sent from a game while Steam is running is checked with Valve's Steam Web API (steampowered.com), which confirms which Steam account sent it, the automated analysis of bug reports and playtest game data uses Anthropic's Claude AI models (anthropic.com), and the tasks that come out of it are kept in Linear (linear.app), our issue tracker. All of them process your data on our behalf and only for the purposes described here.
8. Legal Basis
Under the EU General Data Protection Regulation (GDPR), our legal basis for processing your email address is your consent, given when you subscribe to the newsletter, sign up for a playtest, submit and confirm a comment, or create an account. For a bug report and anything you attach to it, our legal basis is your consent, given when you send the report. For a translation review or report, our legal basis is your consent, given when you send it. For playtest game data, our legal basis is your consent, given when you choose to share it from inside the game; you can withdraw it at any time, which stops further uploads. For the IP address and user agent stored with a comment, a bug report or a translation review, and the Steam ID stored with an in-game report, our legal basis is our legitimate interest in preventing spam and abuse.
9. Data Retention
We will retain your email address only as long as necessary for the purposes stated above, or until you unsubscribe or request deletion. If you unsubscribe, we keep your address on a suppression list so that we do not accidentally email you again; you can ask us to delete it entirely instead.
Published comments are kept for as long as the post they belong to, or until you ask us to remove them.
Sign-in attempt records are deleted automatically after 24 hours, and immediately if you delete your account.
Translation reviews are kept while the string they are about is in the game, and afterwards as the record of why it changed. You can ask us to delete your reviews, and the Steam ID stored with them, at any time; for reports sent from the game, tell us your Steam ID or roughly when and about which string you sent them.
The turn-by-turn record of a playtest game is deleted automatically 90 days after we receive it. A short summary of the game — its version, the number of players, how many turns were played, who won and when it ended — is kept afterwards. You can ask us to delete every game uploaded from your Steam account at any time: tell us your Steam ID, and we delete everything stored under the code computed from it.
Bug reports are kept while the bug is open and for as long as they are useful afterwards, and their attachments are deleted with them.
10. Your Rights
You have the right to:
Request access to your personal data.
Request correction or deletion of your data, including any comment you have left, any bug report you have sent and any playtest game data uploaded from your Steam account.
Withdraw your consent at any time — every email contains an unsubscribe link and a link to change which emails you receive.
Lodge a complaint with your local supervisory authority.
To exercise your rights, contact us at: support@nullvectorstudios.com.
11. Changes
We may update this Privacy Policy from time to time. The date at the top indicates the latest version.
12. Contact
Jaakko Ojalehto
Null Vector Studios Oy
Email: support@nullvectorstudios.com