Privacy Policy

This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have over it. We collect as little as the service can work with.

1. Who is responsible

The data controller is NautiForge, EU.

For any privacy question, write to legal@nautiforge.cc.

2. What we collect

Data you give us

• Email address — needed to create an account, log in, send licence keys and contact you about the service.
• Password — stored only as a bcrypt hash. We cannot read your password and could not tell it to you if asked.

Data created by using the service

• Account timestamps — when the account was created and when it last logged in.
• Licence information — which licence you hold, its key and its expiry date.
• Server logs — our web server records IP address, timestamp, requested page and browser user-agent, as web servers do.
• Failed login counters — to limit brute-force attempts we count recent attempts per network address. The address is stored as a one-way hash, not in readable form, and the counter is discarded after ten minutes.

What we do not collect

• No card or bank details ever reach our servers — payments are processed entirely by our payment provider.
• No advertising or analytics trackers.
• No data about your gameplay, and no contents of your computer.

3. Cookies

We use exactly one cookie, nautiforge_sess. It holds a random session identifier so the site knows you are logged in. It contains no personal data, is marked HttpOnly, Secure and SameSite=Strict, and it expires when you close your browser.

It is strictly necessary for the service to function, so under the EU ePrivacy rules it does not require consent. We set no analytics, advertising or third-party cookies, which is why you see no cookie banner.

4. Why we process it, and on what basis

Purpose	Data	Legal basis (GDPR)
Running your account and supplying the Software	Email, password hash, licence data	Art. 6(1)(b) — performance of a contract
Taking payment and issuing licences	Email, payment reference from the provider	Art. 6(1)(b) — performance of a contract
Keeping the service secure, preventing abuse	Server logs, hashed address counters	Art. 6(1)(f) — legitimate interests
Meeting accounting and tax obligations	Transaction records	Art. 6(1)(c) — legal obligation
Answering support requests	Email and the message you send	Art. 6(1)(b) / 6(1)(f)

5. Who else sees it

We do not sell your data. We share it only with:

• Our payment provider — to process payments. They act as their own controller under their own privacy policy.
• Our hosting provider — the servers that run the site.
• Authorities — only where the law requires it.

Our servers are in the European Union. If a provider processes data outside the EU, we rely on an adequacy decision or the European Commission's standard contractual clauses.

6. How long we keep it

• Account data — while your account exists, then deleted within 30 days of closure.
• Transaction records — five years, as Polish accounting law requires. This obligation overrides a deletion request for those specific records.
• Server logs — 30 days, then deleted.
• Login attempt counters — 10 minutes.

7. Your rights

Under the GDPR you may:

• Access the personal data we hold about you;
• Rectify anything inaccurate;
• Erase your data, subject to the retention periods above;
• Restrict processing in certain circumstances;
• Port your data — receive it in a machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent where processing relies on consent.

Write to privacy@nautiforge.cc. We answer within 30 days and may ask you to confirm your identity first so that we do not disclose your data to someone else.

8. Security

All traffic runs over HTTPS. Passwords are stored as bcrypt hashes with a per-password salt. Database access is restricted to the minimum privileges the application needs. Session identifiers are regenerated on login to prevent session fixation.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will notify you and the supervisory authority as the GDPR requires.

9. Children

The service is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.

10. Changes

If we change this policy materially, we will notify registered users by email before the change takes effect. The date at the top always shows the current version.