NodeX Privacy Policy

Last updated: October 8, 2026

This privacy notice explains how Daniele Francesco Solinas ("we", "us", or "our"), the developer and data controller of NodeX, processes information when you use NodeX, its Android beta, or the privacy webpage associated with it. The Android application identifier is com.dfs.nodex.

This notice covers the beta without advertising. Beta reporting and cloud collection depend on the features enabled in the test build. In a local-only test build, gameplay reports remain on your device unless you choose to export and send them. In a test build with cloud collection enabled, the relevant information is transmitted through the Firebase services described below. This distinction does not change the purposes, recipients, safeguards, or retention rules explained in this notice.

For questions or privacy requests, contact daniele.f.solinas@gmail.com.

Summary of key points

• No registration is required to play. NodeX does not ask you to create a username, password, or social media account.
• Gameplay and technical information are used to evaluate the beta and improve the game. This includes level results, attempts, time spent, interactions, rewards, settings, and error information.
• Notes are voluntary. Comments you write about levels can be included in beta reports. Please do not include confidential information about yourself or anyone else.
• Google provides the cloud services. These are Google Analytics for Firebase, Firebase Crashlytics, Cloud Firestore, and Firebase Authentication. The privacy webpage uses Firebase Hosting.
• Installation identifiers are pseudonymous, not fully anonymous. They can link sessions and reports to the same installation without identifying you by name.
• Complete beta reports are deleted within 90 days after the beta closes. This includes developer-held downloaded copies. Other services have their own retention rules, explained below.
• This beta does not show ads or use reports for personalised advertising. A future advertising-supported edition will require an updated notice before those practices begin.
• You can contact us about your data and applicable rights. Requests are handled through the email address above.

Contents

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share your information?
5. What about external websites and sharing apps?
6. Do we use accounts, social logins, or installation identifiers?
7. How long do we keep your information?
8. How do we keep your information safe?
9. What are your privacy rights?
10. What collection choices and device controls apply?
11. Is NodeX intended for children?
12. Are data transferred internationally?
13. Do we update this notice?
14. How can you contact us?
15. How can you access, correct, or delete your information?

1. What information do we collect?

Information stored on your device

NodeX stores game progress, settings, and rewards locally. Test builds with beta reporting enabled also keep records of sessions and level attempts, including notes you choose to write. A local record is not automatically a cloud upload: transmission depends on the cloud features enabled in the build or on your decision to share an exported report.

Gameplay and beta reports

Beta reports can contain:

• Levels opened and played, level characteristics, attempts, successes, failures, restarts, abandoned attempts, scores, and progress.
• Session and event timestamps, time spent reading and playing, pauses, time in the background, visits to screens, return visits, and interactions with game nodes.
• Rewards earned or viewed, reward-related interactions, and game preferences such as music, sound, shadows, and reflections.
• App version, build identifier, platform, level catalogue revision, test group, and report metadata.
• Session references and technical installation identifiers used to organise records from the same installation.
• Level notes and feedback you voluntarily enter.

Cloud Firestore reports contain the detailed beta report, not only a small selection of statistics. The report includes the relevant session and attempt history, summaries, settings, rewards, and notes. We may download copies to analyse the beta. Complete notes are not included in the custom Analytics event parameters or custom Crashlytics logs prepared for NodeX.

Analytics, device, and diagnostic information

When the corresponding cloud collection is enabled, Google Analytics for Firebase processes usage events and an app-instance identifier. Firebase Crashlytics processes error and crash information, diagnostic traces, app and operating system versions, device characteristics, and technical identifiers. NodeX can attach the current screen, level, and test context to help investigate a problem.

Google Analytics can derive approximate geographic information, such as country, from a masked IP address. Service providers also process network information to receive requests and protect their services. NodeX does not request GPS access or collect precise GPS coordinates for these purposes.

This beta does not request access to your contacts, calendar, microphone, camera, or social media accounts. It does not ask for financial information or intentionally request health data, biometric data, or other sensitive personal information. Information you include voluntarily in a note or email may nevertheless identify you; please limit it to what is needed for your feedback or request.

Information you send directly

If you contact us, we process your email address, message, and any attachments you send. If you share a beta report with us by email or another communication service, we receive the report and the contact information made available by that service.

Visits to this privacy webpage

This page uses Firebase Hosting. Google processes connection data, including IP addresses, to deliver and protect the hosting service. We have not added advertising, visitor analytics, forms, or analytics cookies to this page.

2. How do we process your information?

We use information for the following purposes:

We do not sell your personal information or use this beta's data for targeted advertising. We do not use it to make automated decisions that produce legal or similarly significant effects about you.

3. What legal bases do we rely on?

Where the GDPR, UK GDPR, or similar requirements apply, the legal basis depends on the purpose and the applicable rules:

• Providing the service you request: processing necessary to provide gameplay, retain progress, apply settings, or respond to a service request is based on performing that service or taking steps at your request.
• Consent where required: non-essential analytics, tracking, or other storage of or access to information on your device is subject to prior consent where the applicable law requires it. We do not treat downloading the app, reading this notice, or the presence of a Store disclosure as consent. Consent-dependent processing must not begin before valid consent has been obtained.
• Legitimate interests where legally available: we may process information to review feedback you send, investigate reported problems, secure our services, and administer the test, where necessary and proportionate and where your rights do not override those interests. This basis does not replace consent where consent is required for the collection method or purpose.
• Legal obligations: we process information when necessary to comply with applicable obligations, including handling data protection requests.

Writing notes and contacting us are voluntary. Local information necessary for requested gameplay is needed to provide that functionality. If you do not provide optional feedback, we will not receive it. Where a processing activity requires your consent and you do not give it, that activity must remain inactive. You can withdraw consent or object to processing based on legitimate interests by contacting us as explained in sections 9 and 15.

4. When and with whom do we share your information?

Information is available to the developer and, where needed, authorised persons assisting with the stated purposes under appropriate confidentiality and data protection arrangements.

We use Google's Firebase and Analytics services for the cloud functions described in this notice:

• Google Analytics for Firebase: usage measurement and analysis.
• Firebase Crashlytics: crash and error diagnostics.
• Cloud Firestore: storage of detailed beta reports.
• Firebase Authentication: a technical identity to protect and associate report uploads; no named player registration is required.
• Firebase Hosting: publication of this privacy webpage.

Google processes information according to the terms applicable to each service. Details are available in Firebase Privacy and Security, the Google Privacy Policy, and the Firebase Data Processing and Security Terms.

Reports and notes are not published for other players to browse. We may disclose information where legally required or necessary to establish, exercise, or defend legal claims, subject to the applicable safeguards.

IronSource/Unity LevelPlay and advertising networks are not used to serve ads in this beta. Their possible use in a future edition is not represented here as current advertising activity.

5. What about external websites and sharing apps?

Links to service-provider policies lead to independently operated websites. Those websites' own privacy notices apply when you visit them.

The manual export function lets you share a report through an application and with a recipient you choose. The chosen communication service processes the transfer under its own terms. If you send the report to us, we handle it under this notice. We do not automatically receive a report merely because you export it to your own device or send it to someone else.

6. Do we use accounts, social logins, or installation identifiers?

You do not need to create a named account, provide a password, or use a social login to play NodeX.

When cloud report uploads are enabled, Firebase Authentication can create an anonymous technical account for the installation. "Anonymous" is the name of this authentication method; it does not mean that the associated reports are legally anonymous. Its identifier, Analytics app-instance identifiers, and diagnostic identifiers can link activity to an installation.

Reinstalling or clearing app data can change some identifiers and does not necessarily erase earlier server-side records. These technical identities are separate from your Google Play account. We do not receive your Google account password.

7. How long do we keep your information?

We retain information only for the stated purposes and applicable legal requirements, using the following periods and criteria:

• Detailed beta reports and notes: deleted within 90 days after the beta closes, including reports in Cloud Firestore and copies downloaded or otherwise kept by the developer. This also applies to reports received manually. We may retain genuinely anonymous statistics that no longer contain notes or identifiers that could reasonably be linked to a player.
• Crashlytics: Google documents a 90-day retention period for crash traces and associated identifiers before beginning their removal from active and backup systems.
• Analytics: retention of user- and event-level records follows the property's retention setting. Standard Google Analytics properties provide 2- or 14-month periods; deletion is processed on Google's schedule. An identifier's period may restart with new activity if that setting is enabled. Standard aggregated reports are not covered by that setting. We assess continued retention using the need to evaluate gameplay and return visits, the age and detail of the information, and whether identifiable records remain necessary; records no longer needed are deleted or made genuinely anonymous. The 90-day beta-report rule is not a statement that all Google services automatically delete all data after 90 days.
• Technical authentication identity: maintained while needed for the cloud reporting service and deleted when no longer needed. Firebase documents removal of authentication information from active and backup systems within 180 days after a deletion request, and retention of authentication IP logs for a few weeks.
• Local game data and reports: remain until removed through available app functions or your operating system's app-data controls. User-created exports and system backups may remain separately.
• Support and privacy correspondence: retained for the time needed to resolve and document the request, and longer only where necessary for an applicable legal obligation or claim.
• Hosting connection data: Google documents retention of Hosting IP data for a few months.

The developer's deletion of beta reports and downloaded copies is separate from Google's service-specific retention and deletion processes. Deleting the app or its local data does not automatically delete information already received online.

8. How do we keep your information safe?

We use technical and organisational measures appropriate to the information and the risks, including encrypted connections for cloud transfers and restricted administrative access. Developer-held report copies are used for the purposes of the test and kept in access-controlled storage.

No internet transmission or storage system can be guaranteed completely secure. We handle incidents and any required notifications under the applicable law.

9. What are your privacy rights?

Depending on the law that applies to you, you may have rights to access and receive a copy of your information, correct inaccurate information, request deletion, restrict processing, obtain data portability, and object to processing based on legitimate interests.

Where processing is based on consent, you can withdraw it without affecting the lawfulness of earlier processing. These rights are subject to the conditions and exceptions in the applicable law.

You can exercise your rights by emailing daniele.f.solinas@gmail.com. You may also complain to your local data protection authority. In Italy, this is the Garante per la protezione dei dati personali.

Where an applicable regional privacy law provides additional rights, including an authorised-agent request or an appeal against a refusal, you can use the same contact address. We handle requests within the time limits required by the applicable law and explain any permitted refusal or extension. We do not condition the exercise of your legal rights on giving marketing consent.

10. What collection choices and device controls apply?

You choose whether to write notes, contact us, or manually share an exported report. You can remove local app data through your device's operating system, subject to any separate backups and exported copies.

Cloud features are not active in local-only test builds. In builds that use them, any consent required by law must be obtained before the relevant collection. This notice does not assert that NodeX currently provides a particular popup or a settings switch for every category of data.

Contact us to withdraw consent, object, or request deletion as described in section 15. Uninstalling the app stops future collection by that installed copy, but it does not erase previously uploaded records. A browser's Do Not Track signal does not, by itself, change the configuration of the mobile app or replace a privacy request.

11. Is NodeX intended for children?

NodeX is intended for people aged 13 and over, as specified for the beta's Store audience. It is not directed to children under 13.

This audience designation does not override local rules on a minor's capacity to consent. Where parental or guardian authorisation is required for consent-based processing, it must be obtained before that processing begins. If you believe a child has provided information in circumstances that should not have occurred, please contact us so that we can investigate and take appropriate action.

12. Are data transferred internationally?

Google's services can process information in countries outside your own, including the United States. A European location for a Firestore database does not mean that every other Firebase or Analytics service processes information only in Europe.

For transfers subject to European data protection rules, the applicable service terms provide transfer safeguards, including the EU-US Data Privacy Framework where the recipient and transfer fall within its scope, or the European Commission's standard contractual clauses, as applicable. See Google's transfer frameworks and the Firebase Data Processing and Security Terms. You can contact us for information about the applicable safeguards.

13. Do we update this notice?

We update this notice when the app's data practices or relevant requirements change. The date at the top identifies the current revision. Material changes will be communicated as required by applicable law.

Before introducing advertising in a future free edition, we will update the notice and Store disclosures to describe the actual advertising providers, identifiers, purposes, and applicable choices. A paid edition without advertising and a release without beta reporting will be described according to the features they actually retain. This beta notice does not authorise undisclosed future advertising or new uses of beta reports.

14. How can you contact us?

Data controller and developer: Daniele Francesco Solinas, Italy.

Privacy contact: daniele.f.solinas@gmail.com.

Please use "NodeX Privacy" in the subject line so that we can identify your request promptly.

15. How can you access, correct, or delete your information?

Email the privacy contact and explain your request. No separate form or named player account is required.

Because gameplay records use technical identifiers, your name or email alone may not identify a particular installation. If available, a session reference or information from your beta report can help us find the relevant records. We request only information reasonably necessary to locate your data and verify your authority to make the request. Please do not send identity documents or unrelated sensitive information unless specifically necessary for a lawful verification step.

Where a valid request applies to beta reports, we address the associated cloud records and developer-held copies, not just the visible summary. Requests concerning other Google service records follow the applicable deletion mechanisms and legal exceptions. We explain any information that must be retained and the reason for retaining it.

Clearing local data or uninstalling NodeX is not a substitute for requesting deletion of information already received by us. Conversely, deleting cloud reports does not erase copies you exported or backups controlled by you or another service.