Nexcell
Status

Last Updated: 2026-09-14

Privacy Policy

This Privacy Policy explains how Nexcell collects, uses, and protects information in connection with your use of our websites, game, and related services.

  • We collect only what we need to operate the game and improve your experience.
  • We do not sell your personal data.
  • This document explains what data we collect, how we use it, and your choices.

Controller & Contact

Nexcell is responsible for the processing described in this policy. For privacy requests or questions, contact:

support@nexcell.app

Please include enough information for us to identify your account and request. We may need to verify your identity before acting on a data-protection request.

Information We Collect

Information Collected Automatically

  • IP address
  • Device information (operating system, browser type)
  • Request, security, and error data needed to deliver and protect the service
  • Gameplay data and preferences (e.g., controls, settings)

Information You Provide

  • Nickname (in-game name)
  • Email address and account/profile information
  • Chat messages you send
  • Images and content you upload (skins, emotes, profile pictures and banners) including their names and tags

    • We remove embedded metadata, including EXIF GPS coordinates, camera information and timestamps, before sending processed images to OpenAI moderation and storing the final images. Information visible in the image itself is not removed.

Information From Third Parties

  • Account information from third-party services you use to sign in (currently Discord or Google), such as an account identifier, display name, email address, and profile image, depending on the provider and permissions you approve

Cookies and Similar Technologies

What Are Cookies

Cookies, localStorage, and sessionStorage let a website store information on your device. Nexcell uses these technologies where needed to provide requested features.

Why We Use Cookies

  • Remember preferences (settings, keybinds)
  • Keep you authenticated
  • Remember interface and privacy-notice choices

How We Use Cookies

Necessary sign-in, security, and consent storage remains active to provide the services you request. Functional preference storage and Vercel Web Analytics are optional and stay off until you explicitly accept their category. Both choices are off by default. Rejecting optional services does not block the game. Closing the notice or continuing to browse is not consent.

Your choice applies to this browser for 180 days. You can withdraw as easily as you accept using Cookie preferences, available on every page. Withdrawal stops future analytics events and removes optional saved preferences from this device; settings already in use may remain in memory until reload. Anonymous reports already recorded cannot be linked back to your browser for deletion. A new purpose or provider requires a new choice. If browser storage is unavailable, your choice applies only to this visit.

Necessary · Always active

Keeps sign-in secure, connects you to the game, and remembers your privacy choices. These essentials are always active because the services you request cannot work reliably without them.

Sign-in and account security

Nexcell · Better Auth / Convex

Session credentials identify your signed-in account and protect access to your profile. Sign-in state can contain a session identifier and account information; it is not anonymous. Google or Discord is contacted when you choose that sign-in provider.

Better Auth cookies (including better-auth.session_token and secure variants); localStorage: better-auth_cookie and better-auth_session_data. Session credentials normally expire after 7 days and may renew while you use the service. Locally cached account data remains until refreshed, sign-out, or browser data removal; expired credentials are not used to authenticate requests.

Your consent record

Nexcell

Remembers your accept or reject choice on this browser, along with its date and the notice version. It does not contain an account ID. Without it, we would need to ask on every visit.

localStorage: nexcell:consent. Valid for 180 days, then we ask again. Invalid, expired, or older notice versions never enable optional services.

Image upload safety checks

Nexcell · OpenAI

When you submit a skin, emote, profile picture or banner, our server sends the processed image to OpenAI moderation to speed up safety checks. Embedded metadata is stripped first; usernames, emails, filenames and tags are not included. Visible image content remains visible. Skins and emotes needing review go to our team; profile media requires a successful check. Do not use image uploads if you do not want this processing.

No OpenAI browser storage or direct browser requests. OpenAI lists no training, abuse-monitoring retention or application-state retention for its moderation endpoint. API data is not used for training by default; see the provider's current data controls for details. The notice acknowledgement is a functional preference, stored only when that category is allowed.

OpenAI API data privacy details

Delivering and protecting Nexcell

Nexcell · Cloudflare · Vercel · Convex

Delivers pages and game assets, supports real-time account/game requests, and prevents abuse. These providers receive connection information such as your IP address. Necessary service requests and security logs continue when you reject optional services.

Network requests and any security storage required by an active protection challenge. No advertising permission is granted. Provider security storage, when issued, expires according to the challenge; normal site delivery does not enable optional analytics.

Functional preferences · Optional

Remembers your game controls, nickname, recent server, and interface choices on this device. With this off, you can still play and change settings, but new choices stay in memory for the current page visit.

Game and interface preferences

Nexcell only

Saves keybinds, graphics and mobile controls, nickname and squad tag, recent region/server, private-room shortcuts, panel layout, and cloud-settings sync preferences. These are not sent to an advertising provider. Manually saving settings to your account is a separate feature you request.

localStorage: settings, lastPlayerName, lastSquadTag, lastClanIdentityActive, nexcell_last_*, nexcell_private_server, nexcell.mobile-controls.v1, nexcell:settings-owner, nexcell:cloud-settings:v1:*, nexcell.overlay.*, nexcell.admin.sidebar.compact, nexcell.upload-moderation-notice (shared upload notice acknowledgement), and the optional nexcell.mirrorBridgeUrl tool setting. Kept until you clear them, withdraw this permission, or consent expires and you next visit.

Panel filters

Nexcell only

Remembers asset-panel filter selections while a tab is open.

sessionStorage: nexcell.overlay.filters.*. Ends when the tab session ends, or earlier when you withdraw this permission.

Analytics · Optional

Helps us understand visits to public pages so we can improve Nexcell. Vercel Web Analytics loads only after you explicitly allow this category. Refusing it does not affect gameplay or account access.

Vercel Web Analytics

Vercel

Measures public page views, referring sites, approximate location (country, region, and city), and browser/device information. Vercel derives a short-lived visitor hash from the incoming request; it does not use third-party analytics cookies or track you across websites. We exclude account, authentication, gameplay, and individual player/asset pages and remove query strings and fragments from page URLs.

No analytics cookies or localStorage entries. The visitor hash lasts up to 24 hours. Aggregated reports are retained by Vercel according to the project's analytics retention period. Withdrawing stops future events; it cannot undo anonymous totals already recorded.

Vercel analytics privacy details

Purposes & Legal Bases

Security & Abuse Prevention

  • Preventing attacks (e.g., DDoS, fraud, abuse)
  • Monitoring for cheating or violations
  • Protecting against security breaches

Legal basis: our legitimate interests in keeping Nexcell secure, reliable, and fair (Article 6(1)(f) GDPR).

Authentication & Personalization

  • Authentication and account access
  • Storing game preferences and settings
  • Enabling chat features and social interactions

Legal basis: performing our agreement with you and taking steps you request before entering it (Article 6(1)(b) GDPR). Optional storage of device preferences uses your consent (Article 6(1)(a) GDPR).

Performance & Improvements

  • Improving game performance and responsiveness
  • Developing new features and gameplay modes
  • Measuring usage to optimize the experience

Optional Web Analytics uses your consent (Article 6(1)(a) GDPR). Essential operational diagnostics use our legitimate interests in running a secure and reliable service (Article 6(1)(f) GDPR).

Compliance & Enforcement

  • Enforcing our Terms of Service
  • Complying with legal obligations
  • Responding to legal claims and protecting rights

Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) and our legitimate interests in establishing, exercising, or defending legal claims (Article 6(1)(f) GDPR).

Information Sharing and Disclosure

We understand the importance of protecting your privacy. We share information only as needed to operate our services.

Service Providers

  • Vercel: website hosting and aggregated Web Analytics
  • Convex: database, application backend, and authentication
  • Cloudflare R2/CDN: storage and delivery of uploaded media
  • OpenAI: safety moderation of processed image uploads; see the image upload safety details above
  • Upstash: rate limiting and abuse prevention
  • Discord and Google: optional sign-in providers
  • Resend: transactional account email delivery

These providers process only the data needed for their role. Their own processing and any optional account you maintain with them are also governed by their privacy notices.

Data Retention

We keep personal data only for as long as it is needed for the purpose described above. The exact period depends on the data and the reason for processing it:

  • Account, profile, social, and gameplay records are generally kept while your account is active and removed or anonymized after a valid deletion request, unless an exception below applies.
  • Security, rate-limit, and technical logs are kept for the shortest configured period needed to detect abuse, investigate incidents, and maintain the service. Incident-related records may be kept longer while a claim or investigation is active.
  • Support and legal correspondence may be retained until the request is resolved and for the applicable limitation period.
  • Records subject to tax, accounting, or other statutory duties are kept for the period required by applicable law.
  • Approved public user content may remain available under the license in our Terms, but associated personal data is removed or anonymized where required. Moderation evidence may be kept where necessary to prevent repeat abuse or defend claims.
  • Data stored only in your browser remains until it expires or you clear it. Residual copies in backups are deleted on the applicable provider's normal backup cycle.

There is no general two-year GDPR retention period. We set and review periods by purpose, legal obligation, and necessity.

International Transfers

Some providers or their subprocessors may process data outside the European Economic Area, including in the United States. Where Chapter V GDPR applies, we use an applicable adequacy decision (including the EU-US Data Privacy Framework where the recipient participates) or appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request information about the safeguards by emailing us.

Security

Our Measures

  • Regular security assessments and updates
  • Access controls and authentication requirements
  • Monitoring for suspicious activity
  • Incident response procedures

Limitations

While we implement strong measures, no system is completely secure. Please practice good security habits and contact us immediately if you suspect unauthorized access to your account.

Your GDPR Rights

Data Subject Rights

  • Access your personal data and receive a copy
  • Correct inaccurate or incomplete personal data
  • Request erasure or restriction where the law permits
  • Receive portable data where Article 20 GDPR applies
  • Object to processing based on legitimate interests; we will stop unless compelling grounds or legal claims justify it
  • Withdraw consent at any time for future processing where we rely on consent

You can export available account data from your profile or contact support@nexcell.app. We do not sell personal data and do not use solely automated decisions that produce legal or similarly significant effects.

Right to Complain

You may complain to a data-protection supervisory authority with jurisdiction where you live or work, or where you believe an infringement occurred.

Children's Privacy

Nexcell is not directed to children under 13. If you are under the age at which you can consent to data processing in your country, a parent or guardian must authorize consent-based processing. If you believe a child's data was provided without the required authorization, email support@nexcell.app and we will take appropriate action.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or for operational, legal, or regulatory reasons. We will update the “Last Updated” date and notify users where appropriate.