Privacy

This page explains what NOVA NETWORK stores, why, and for how long. The short version: as little as we can, nothing that we sell, and nothing that goes to advertisers.

Your account

Sign-in goes through Discord. We ask Discord for two things only: your basic profile and your membership of our server. When you sign in we store your Discord id, username, display name and avatar, whether you are a member of our server and which roles you hold there, and the time and network address of your last sign-in. That address is kept as it is, replaced at every sign-in and used only for the security of your account. We do not ask Discord for your email address and we never see your Discord password.

While you use the site or the apps we ask Discord again from time to time whether your account is still a member and which roles it holds, and keep a short record of each check for 90 days.

An account made from an access pass signs in with a username and a password instead. We store the username, the password only as a one-way hash that cannot be read back, which pass made the account and when it ends, and the time and network address of the last sign-in. Screenshot records of such an account carry its account number instead of a Discord id.

Age

NOVA NETWORK is for people aged 13 and over. The first sign-in asks for your birth month and year; we keep only the fact that you passed, never the date.

The apps (NX3DX+ and Fileora)

This section covers the NX3DX+ app, and the Fileora app when it plays NOVA NETWORK data. Fileora in plain mode, playing data you imported yourself, uses no account and sends no personal data; it only fetches one public status file from our file host, as any web request does.

To work with NOVA NETWORK the app registers itself: it sends a random install id made by the app (not an advertising id), the platform, the app version, the system version and the device model (on iPhone and iPad only that word, on other phones the maker and the model), and, where the build and the device support it, a proof from Apple or Google that the app is genuine. The site keeps these with the times the install was first and last seen. This is needed for the app to work with the site and does not depend on the telemetry switch.

A copy of NX3DX+ taken as a file from the member area carries a hidden id that ties that copy to the account it was made for. The app sends it when it registers, so a copy that turns up on another account can be traced and blocked.

Current versions of the apps send nothing optional until you say yes: they ask once at the first start, and the switch is under OPTION, then PRIVACY, then TELEMETRY. Switched on, the app adds a line when a session starts, how smoothly each race ran (frame times only), and crash reports (where the app stopped, a short technical message and the call stack). Crash reports are sent today only by the build for phones other than iPhone and iPad; the iPhone and iPad builds send none. Until you link the app these carry only the install id; once it is linked they are tied to your account like the rest. Switching telemetry off later also deletes what that install sent before.

Versions of the apps from before that question existed send the session line, and on phones other than iPhone and iPad crash reports, without asking. Updating the app brings the question.

The apps have a "Report a problem" button. A report is sent only when you press Send, never by itself. It holds what you wrote and the category you picked, the app with its version and build, the device model and the system version, the install id, the game data set and the language in use, whether telemetry is on, the last lines of the app's own log and, if you add one, a single screenshot. If the app is linked, the report is tied to your account. The staff read it to find and fix the problem. A note of it (your text and the device and build line; never the log, the screenshot or the install id) is posted in the crew's private bug reports forum on Discord, where a linked member is named.

When you link the app to your account, that install is tied to your account so your cards (the cloud copies of your saves: garage, cars, tuning, progress and the name on the save), race results, the recording of each run and replay clips follow you. Race uploads have their own switch, Public, Private or Off, in your garage and in the app, separate from telemetry.

A race result carries the course, the car, the times and the name on your save, and for a time attack the recording of the run (your steering and pedal inputs), which lets other members race it as a ghost. With Public, your results and the name on your save are shown on the leaderboards and on your driver page. With Private they are kept for you only. With Off nothing is uploaded; what is already on the site stays as it was.

Race stills and replay clips are drawn by our server from the recording of a run. The apps never send pictures, video or sound. Stills and clips are shown to members only.

For a time on the leaderboards, our server also draws a picture of the car as it was raced, from the model, colour and parts the run recorded. Members can see it beside the run unless the driver turned off "Show my cars on the leaderboards" in the garage; visitors who are not signed in never see it.

When the app fetches game data, the site records which install and which account asked, for which data set, how many files and bytes, and when.

Country

When the app uploads a result, the site looks up the country of the network address it came from in a database held on our own server, stores the two-letter country code with that result and does not keep the address. Nothing finer than the country is kept: no city, no coordinates. The country is shown as a flag beside your results and is used for the regional leaderboards, regional ghosts and regional statistics. It is removed when you delete your account.

Versus

In online versus the relay server you play through receives your player name, your car and your network address for the length of the match. The list of open rooms, with the names of the players in them, is kept on the site only while a room is open and for a few minutes after. The outcome of each online race (the names of the players, whether each was a linked member, their places and times) is kept for the versus statistics. Versus on your own Wi-Fi or over Bluetooth goes from device to device and never reaches us.

Network addresses

Where the site keeps a trace of a network address, it is almost always a one-way hash that changes every day and cannot be turned back into the address: in the visit statistics, in the log of file links, in the screenshot records and in the audit log of sign-ins and account actions. The address itself is kept in two places only: with your account, for your last sign-in, and in the log of Shared drive links. From the address of an uploaded result only the country is kept.

Shared drive links are single files that staff share by link. When someone opens such a file, the site records the network address as it is, the country, the browser and the page the visitor came from, with the time.

Visit statistics

The site counts views of some of its pages with a one-way hash of your network address and browser that changes every day, the page you came from and, when you are signed in, your account number. Without a sign-in, visits can be counted but not followed from one day to the next. The raw address is never stored here. "Essential only" in the Advertising and privacy banner switches this off for you.

Cookies and local storage

• A session cookie that keeps you signed in.
• A cookie for your language.
• Your theme (light or dark) and your consent choice, in your browser's local storage, with a matching consent cookie so the server can honour it.

None of these identify you to anyone else, and none are read by third parties.

Advertising

There is no third-party advertising on this site today, and no advertising network receives your data. Should that change, the banner will ask again and this page will say which provider is involved and what it receives.

Your choice in the banner is kept in your browser to remember it; it is not used to identify you. You can change it at any time from the footer.

Screenshots

Members may take screenshots of the site. When your browser shows us that you pressed the screenshot key, a screenshot shortcut or Print on a page while signed in, we record the attempt: your Discord id, the time, the page and the browser. Screenshots taken with other tools are not seen and not recorded. Member pages may carry a faint watermark with your name and account number. For visitors who are not members, the page goes black instead. These records are deleted after 180 days.

Other companies involved

• Discord: the sign-in and the membership checks described above. Profile pictures are loaded by your browser from Discord's servers.
• Cloudflare: stores our files (game data, app builds, race stills and clips, backups of the database) and delivers them. When the app or your browser fetches a file through one of our short-lived links, that request goes to Cloudflare.
• Amazon Web Services: our hosting provider. The site, its database and the versus relay run on a server rented there, so it processes connection data such as network addresses on our behalf.
• Google Fonts: the typefaces of the site are loaded by your browser from Google.
• Apple: iPhone and iPad builds may be offered through Apple's TestFlight. Joining it is between you and Apple, under Apple's privacy policy; this site sends Apple nothing about you.

We sell nothing, and no data goes to advertisers or data brokers.

Retention

Visit statistics, the log of file links and the apps' session telemetry are deleted after 90 days, crash reports after 120 days. Problem reports are deleted, with their screenshot, after 180 days. The proofs that an app is genuine are deleted after 30 days (the verdict stays with the install) and the security records made from them after 180 days. Stills and clips of a run that is neither your personal best nor in a board's top 10 are deleted after 30 days.

Race results and the recordings of the runs stay as long as the leaderboards exist. Account data, cloud saves (the last 20 versions of each card) and linked devices stay until you delete your account.

The record of game data requests and the Shared drive log are not deleted on a schedule. The audit log is not deleted on a schedule. The outcomes of versus races are not deleted on a schedule. The record of which copy of the app was made for which account is not deleted on a schedule.

Your rights

On the Your data page (in the menu under your name once signed in) you can get a copy of the data we hold about you as one file (it leaves out secrets, the details of security checks and other members' information, and says so itself), and delete your account; the apps offer the same deletion under OPTION, then PRIVACY, then DELETE NOVA ACCOUNT. A deletion waits 7 days, during which you can restore the account on this site or in the app. Delete your account

A deletion erases your cards, stills and clips, follows, blocks and reports, your device links and device keys, the apps' telemetry, your visit lines, your file links and the record of your game data requests, and it empties the account record: no Discord identity, no network address, no roles. Your leaderboard times are your choice when you delete. Left as it is, they stay with the recordings of those runs and the pictures of the cars, without your name, your account or your country, so other drivers' ranks do not change (car pictures you had kept to yourself are removed). If you choose to remove them, they are taken off every board when the account is deleted, with the recordings, stills, clips, car pictures and crowns of those runs, and the boards close up; other drivers' records stay. The choice can be changed until the deletion date. Record announcements already posted on Discord and the copies of ghosts that other players' apps already keep cannot be called back. What stays in any case: the emptied account record, and the audit log, with a note that the account was deleted. An app that was never linked has no account: the same row in the app erases what that install sent, at once.

For a correction, or if you cannot sign in any more, write to contact@nova-net.work with your Discord username.

Changes

This page may change as the site does; the date at the top says when it was last revised.