Privacy Policy
Last updated: 27 October 2026
In short: you can play the free demo without an account. If you create one, we store your username, email and a scrambled (hashed) password to sign you in. We never ask for payment details. Your coins and progress are saved with your account on our servers; only display settings and your age confirmation stay in your browser. We do not sell your personal information. If the Google Ads tag is active (see below), it measures which ads lead to sign-ups.
1. Data controller
NAILS @ 1, INC., United States. Email: info@nightace.com.
2. Accounts (optional)
An account is optional: every game can be played as a free demo without one. When you sign up we process:
- Account data: your name (or nickname), email address, a salted hash of your password (we cannot see your password), the date you signed up and sign-in sessions (stored only as a hash of the session token).
- Game data: your free virtual coin balance, number of rounds played, biggest win, daily login streak, level, the time of your last free coin bonus, your bonus history, favorite and recently played games and your bet sizes. Coins have no monetary value.
- Security data: to stop automated sign-ups and password guessing we briefly keep counters linked to an email address or IP address. They expire after one hour at most. To limit Find your Ace picks we keep a counter linked to a one-way hash of your IP address for 24 hours.
- Find your Ace: when you spin, we store a random identifier of your browser, the number of bonus coins, the time of the spin and, once you sign up, the account they were added to. This lets us show you the same result again and add the coins to your account only once.
Purpose and legal basis: to provide the account and the game progress you asked for (performance of a contract, Art. 6(1)(b) GDPR) and to protect the Service against spam and abuse (legitimate interests, Art. 6(1)(f) GDPR).
Where it is stored: in our database on Cloudflare D1, run by Cloudflare, Inc. (USA) as our processor, and accessed only through our own server code on Cloudflare Workers. Cloudflare relies on the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework for transfers from the EU. Only we can access the database.
How long: account and game data until you delete your account; sign-in sessions for up to 30 days. To delete your account and all its game data, write to info@nightace.com from your account email and we will delete it within 30 days.
We do not collect dates of birth, payment card data or identity documents, and we do not sell personal data.
Contact form: when you write to us through the contact form, we store your name, email address, message, the time it was sent and, to block spam, a short-lived counter linked to your IP address. We use this only to answer you and keep messages for up to 12 months. The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
3. Data stored on your device
The site uses your browser's local storage (not cookies) only for the items below. Your coins and game progress are not stored on your device: they are kept with your account in our database. Demo play without an account keeps its demo coins in this browser only (see na_wallet below); nothing about it is sent to us until you choose to create an account. The items below are strictly necessary to provide the Service you request; you can delete them at any time by clearing your browser's site data.
| Key | Purpose | Duration |
|---|---|---|
| fz_token, fz_user | Keeps you signed in (session token, and your name and email for display). Only set if you sign in. | Until you sign out, max. 30 days |
| na_bar_closed (session storage) | Remembers that you closed the sign-up bar, so it stays hidden for the rest of this visit | Until you close the browser tab |
| na_wallet, na_wallet_seen | Your demo coin balance in this browser and whether the welcome note was shown. If you create an account, the balance is sent once so it can be kept | Until you clear site data |
| cx_device, cx_wheel_spin | A random identifier of this browser and your Find your Ace result, so the bonus coins can be added when you sign up | Until you clear site data |
| age_ok | Your answer to the “Are you 21 or older?” question, so it is asked only once | Until you clear site data |
| fz_lock_until, fz_reminder_min | Responsible play tools on this device | Until you clear site data |
| fz_side_collapsed, fz_slot_sound, fz_slot_turbo | Display and sound settings on this device | Until you clear site data |
We set one cookie ourselves: cx_welcome, a strictly necessary cookie that lets the one-time welcome page open right after you create an account. It holds no personal data, lasts at most 5 minutes and is removed when the page opens. Apart from the Google Ads tag described above (only when it is active), we set no other cookies. Fonts are hosted on our own server, so loading the site does not send your data to font providers.
4. Server logs
Like any website, our web hosting provider and Cloudflare, which delivers and protects the site, process technical data such as IP address, date and time, requested page and browser type to deliver the site and keep it secure. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Logs are kept only as long as needed for security and are then deleted.
5. Analytics and advertising
Cloudflare Web Analytics. Our site is delivered through Cloudflare (Cloudflare, Inc., USA), and we use Cloudflare Web Analytics to count visits and see which pages are used. It does not use cookies or local storage and does not follow you across other websites. It receives the page address, the referring page, browser and device type, page load timing and an approximate location (country) derived from your IP address; Cloudflare does not use this data to build profiles or for advertising. The legal basis is our legitimate interest in understanding and improving the Service (Art. 6(1)(f) GDPR).
Google Ads conversion tag. To measure whether our ads lead to visits and sign-ups we may use the Google Ads tag (Google LLC, USA). When it is active it sets Google advertising cookies (for example _gcl_au) and sends Google the pages you visit on this site, whether you created an account (a “conversion”), the ad click identifier, your IP address and browser and device data. We do not send Google your name, email address or account details, and we do not use the tag for remarketing. Google processes this data under its own policies (how Google uses information from sites that use its services). If your browser sends a Global Privacy Control (GPC) signal, the tag is not loaded. You can also turn off personalised ads at adssettings.google.com.
We do not use any other analytics, advertising or tracking tools.
6. Your privacy rights
United States. Depending on your state of residence (for example California, Colorado, Connecticut, Virginia and other states with consumer privacy laws), you may have the right to know what personal information we hold about you, to get a copy of it, to correct it and to delete it. We do not sell personal information, do not share it for cross-context behavioral advertising, do not use it for profiling and do not process sensitive personal information, so there is nothing to opt out of; we also honor Global Privacy Control signals. We will not discriminate against you for using your rights.
To make a request, email info@nightace.com from the email address of your account. We may need to verify your identity and will answer within 45 days. You can use an authorized agent; we may ask for proof of the authorization. If we decline your request, you can appeal by replying to our answer.
7. Children
The Service is not intended for anyone under 21. It is not directed to children, and we do not knowingly collect personal information from children under 13 (COPPA) or from anyone under 21. If you believe a minor has given us personal information, contact us and we will delete it.
8. Changes
We will update this policy when our processing changes. The date at the top shows the current version.