Privacy Policy

Last updated November 10, 2026

The short version

You never need an account to play. Guests are identified by a random ID in one cookie — no name, email or birthday.
We don't sell your data and we don't share it for advertising. There are no ads or third-party trackers on Nexora Play today.
Accounts are optional and need an email, a display name and a password (or Google). You can download or delete everything from your Account page at any time.
Children: accounts are for ages 13 and up. Younger players can play every game as guests.
Games can't see who you are. They run on a separate domain and only get your display name and whether you're a guest.

Who we are

Nexora Play (nexoraplay.games) is a free browser-games website run by Avaz Store LLC, a limited liability company registered in New Jersey, USA. We are the “controller” of the personal data described here. Questions or requests: [email protected].

What we collect

When you play as a guest

A random guest ID (stored in the np_gid cookie) and a generated guest name such as “Guest 7F3A”.
Your play: which games you start and finish, when, the type of device (desktop, phone or tablet), scores you submit, your game saves, achievements and XP.
Basic usage events, for example “game launched” or “game failed to load”, so we can fix problems and rank games by plays.

When you create an account

Your email address, the display name you choose, and your password — stored only as a salted scrypt hash, never as the password itself.
Your birth month and year are checked once when you sign up. We don't store them: we keep only the date you turn 18, so we know whether you're an adult.
Sign-in sessions: a hashed session token, your browser's name and version, and a hashed (not readable) version of your network address, so you can see and end your sessions.
If you use “Continue with Google”: your Google account ID, email address and name. We never get your Google password.
What you choose to add: favorites, friends and friend requests, tournament entries, and reports you send about games.

Multiplayer

Online matches use your display name, the room you join and the results of the match. In-game chat is limited to preset phrases and emoji — there is no free-text chat — and match results are saved to show history and rankings.

If you publish games (Developer Studio, adults only)

Your developer or studio name, optional website, the time you accepted the developer agreement (with a hashed network address as a record), the games, files and descriptions you upload, and review notes. Your developer name is shown on your games' pages.

If you buy Premium

Premium isn't on sale yet. When it is, payments are handled by Stripe: we never see or store your card details. We keep whether your subscription is active, its renewal date and Stripe's customer reference. Premium must be bought by an adult.

Technical data

Like every website, our servers receive your network (IP) address and browser details with each request. We use the address briefly to protect the site (for example, limiting how many sign-in attempts can come from one network) and store it only in hashed form. Error logs may contain technical details of a failed request.

Cookies and storage on your device

We only use cookies and storage that the site needs to work or that remember your own choices. There are no advertising, analytics or other third-party cookies, so there is no cookie banner.

Name	What it's for	How long
`np_gid` (cookie)	Your guest ID, so your saves and scores stay with you without an account.	1 year
`np_sid` (cookie)	Keeps you signed in.	30 days, or until you sign out
`np_oauth` (cookie)	Protects a “Continue with Google” sign-in while it's in progress.	10 minutes
`np_age` (cookie)	Set only if a sign-up was refused because of age, so a different birth year can't be tried straight away. Holds no birth date.	1 day
`nexora:*` (local storage)	On your device only: light/dark theme, sound on/off, recently played, favorites and progress shown before you sign in.	Until you clear your browser data

Our fonts are served from our own servers, so loading a page doesn't contact Google Fonts or any other font service.

Why we use it (legal bases)

To run the service you ask for (performance of a contract): guest play, saves, scores, accounts, multiplayer, friends, the Developer Studio and Premium.
Our legitimate interests, balanced against yours: keeping the site secure and free of cheating and abuse, fixing errors, and understanding which games are played so we can improve and rank them. We use this data in aggregate and never to build advertising profiles.
Legal obligations: for example keeping payment records, or answering lawful requests.
Your consent, only where the law requires it. You can withdraw consent at any time.

Games and game developers

Every game runs in a sandbox on a separate domain (games.nexoraplay.games). Games talk to Nexora Play only through our game SDK, which gives them your display name and whether you're a guest — never your email, account ID or network address. Games made by outside developers are checked automatically and by a person before they go live, and must not contain trackers, ads or links out of the game.

Advertising

There are no third-party ads on Nexora Play today. Sometimes, between games, we may show a short promotion for another Nexora game; these are our own and use no tracking or cookies. If we add advertising, we will update this policy first and ask for your consent where the law requires it before any ad cookies are used. Personalised ads will never be shown to guests or to anyone under 18.

We don't sell or rent personal data, and we don't “share” it for cross-context behavioural advertising. We use a small number of service providers that process data only on our instructions:

Hosting and database: Runs the website, game servers and database that store everything described on this page.
Email delivery: Sends account emails (address verification and password reset). Receives your email address and the message.
Google — Google LLC: Only if you choose “Continue with Google”: Google confirms who you are and tells us your Google account ID, email address and name.
Payments — Stripe: Only if you buy Premium: Stripe handles the payment. We never see or store your card number; Stripe tells us whether your subscription is active.
AI game generation — Anthropic: Only for the AI Game Factory, and only when it is switched to use Claude: receives the game designs staff or developers write. Player data is never sent.

Other people see only what you choose to show: your display name and scores on leaderboards, your profile if you make it public (profiles are private by default), and your friends list to your friends. We may disclose data if the law requires it, to protect people's safety, or as part of a sale or merger of the service (you'd be told first).

Children's privacy

Nexora Play is a general-audience site for players of all ages, and we know some children use it. We designed it so that children can play without sharing personal details:

No accounts under 13. Sign-up asks for a birth month and year first. If someone is under 13, no account is created and nothing they typed is kept — they can carry on playing every game as a guest. (In some countries the age for consenting to online services is up to 16; we don't rely on consent to run accounts, and we won't use consent-based features such as personalised ads for anyone under 18.)
Guests share nothing personal. Guest play uses only a random ID to keep saves and scores, which is used to run and secure the site — never for advertising profiles.
No contact details in reports. Anyone, including guests, can send a report or feedback about a game. We ask people not to include personal details, and our servers remove email addresses and phone numbers from the message before it is saved.
Safe by default for teens: profiles are private by default, chat is limited to preset phrases and emoji, there is no location tracking, and the Developer Studio and Premium are for adults only.
Parents and guardians: if you think your child under 13 has given us personal information, contact [email protected] and we will delete it. You can also ask us what we hold about your child's account, or have it deleted.

How long we keep data

Accounts: until you delete the account. Deleting it removes your profile, saves, scores, favorites, friends and sessions straight away; usage events that were linked to you are kept only without your ID.
Guest data: deleted automatically after 13 months without playing a game.
Sign-in sessions: deleted when they expire (after 30 days, or when you sign out).
Email links: a password-reset link expires after 1 hour and an address-verification link after 24 hours; both are deleted a day later.
Usage events: deleted after 25 months.
Security and admin records: the hashed network address is removed after 24 months; the record of what was changed is kept to protect the site.
Payment records: kept for as long as tax and accounting law requires.

Your rights and choices

Wherever you live, you can:

Download your data — Account page → “Download my data” (a JSON file).
Correct it — change your display name on the Account page, or ask us.
Delete it — Account page → “Delete account” deletes it permanently. Guests can clear their browser's cookies and storage for this site.
Ask what we hold, object to or restrict a use, or withdraw consent — email [email protected]. We reply within one month (45 days in some US states), and we may need to confirm it's really you.

If you're in the EEA or UK you can also complain to your data protection authority (in the UK, the ICO). Residents of California and other US states have the right to know, delete and correct their data, and to opt out of the sale or sharing of personal data — we don't sell or share it. We won't treat you differently for using any of these rights.

How we protect it

Connections are encrypted (HTTPS). Passwords are hashed with scrypt, session tokens are stored only as hashes, two-step codes for staff are encrypted, and network addresses are hashed. Staff need two-step verification to reach admin tools, and every admin change is logged. Games run isolated on their own domain. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Where data is stored

Data is stored by our hosting provider and may be processed in other countries, including the United States. Where data from the EEA, UK or Switzerland leaves those areas, we rely on adequacy decisions or the standard contractual clauses approved for this.

Changes to this policy

We will update the date at the top whenever this policy changes. If a change is significant, we will tell signed-in players on the site, or by email, before it takes effect.

Contact us

Privacy questions and requests: [email protected]. Everything else: see our contact page.