Privacy & your pilot
Updated 27 September 2026. For questions or a data request, contact hello@nightmarespace.com.
What the game stores
We store your pilot’s callsign, progress, ships, cargo, discoveries, account identifier, saved preferences and feedback. Optional profile information you choose to enter is part of your pilot record. Amazon Cognito handles email verification, sign-in and account passwords; the game does not store your Cognito password.
Guest recovery passwords, if enabled, are stored as salted hashes. Session cookies authenticate your pilot. Browser storage remembers interface preferences. Clearing browser data can remove access to an unlinked guest pilot.
Why we use it
We use this information to save and run the game, authenticate requests, support multiplayer, investigate bugs and abuse, and respond to feedback. Pilot names, ships, discoveries and activity may be visible to other players as part of multiplayer gameplay. Feedback reports are visible to you and authorised game staff.
Infrastructure & logs
The service uses Amazon Web Services for hosting, authentication and delivery, and Cloudflare for DNS. These providers process technical information needed to operate the service. Hosting and delivery can involve processing outside your country. Server access logs may contain IP addresses, request paths and browser information. They are used for operations and security. We do not add advertising trackers or third-party analytics to the game.
Retention & deletion
Game saves remain until you delete your account or request removal. Registered players can use Delete account in their pilot profile after finishing captain and crew battles. This deletes the Cognito sign-in and removes private pilot progress, hired crew, preferences and feedback. Inert anonymous records remain where needed to preserve shared discoveries and completed trades; historical callsigns or interactions already recorded in other pilots’ logs may remain.
Database backups are scheduled for removal after 14 days. Deleted data can remain in those protected backups until they expire. Operational logs rotate automatically and are kept separately from gameplay saves. Contact us for access, correction or deletion requests, including guest saves you can identify. We may need to verify ownership before acting.
Cookies
Authentication cookies are essential for playing and are not available to game-page JavaScript. They are sent over HTTPS. OAuth cookies protect sign-in; short-lived account tokens are refreshed within a bounded game session. Local browser storage holds interface preferences and is not a substitute for a linked account.