← back to NOMZ

Privacy Policy

Effective date: August 29, 2026 · Last updated: September 2, 2026

NOMZ ("we," "us") is a browser game operated by Mily & Co., LLC. This policy explains what we collect, why, who we share it with, and your choices. We built NOMZ to collect as little personal information as possible.

1. Information we collect

Information you provide

• Display name. You start with a randomly generated name (e.g. "GrumpyCell42") and may change it.
• Sign-in info (only if you choose to sign in). If you create a permanent account via a provider like Google, we receive an account identifier and, where provided, your email. You can play entirely as a guest without this.

Created as you play

• Gameplay data: your score/points, games played, owned cosmetics, and saved preferences.
• Activity timestamps: when your account was created and last active.

Technical information (privacy-preserving)

• Network fingerprint (not your IP). We convert your IP into a salted one-way hash and store only that hash — never the raw IP. It helps us estimate unique networks and detect abuse.
• Country. Derived from your IP at connection, then the IP is discarded. We store only the two-letter country code — never precise location.
• Device profile. A coarse device type, operating system, and browser name from your browser's User-Agent.
• Device fingerprint (first-party). A random identifier stored in your browser; we keep only a salted hash. It counts real unique devices and distinguishes players from automated abuse. It is not derived from your hardware and can't track you on other sites.
• Language and timezone, for localization and audience understanding.
• Acquisition source. If you arrive via a tagged link or another site, we record the tag or the referring site's host name (never the full URL).

When you make a purchase (once enabled)

• Purchases are processed by our payment provider Xsolla, acting as merchant of record, under its own privacy policy. We receive only what we need to deliver and support your purchase — a transaction/order ID, the items bought, and limited billing metadata such as your billing country. We do not receive or store your full card number.

What we do not collect

• Your raw IP address, or precise/GPS location.
• Payment card details. When purchases launch, our payment provider (Xsolla), acting as merchant of record, will handle them; card data will never touch our servers.

2. How we use it

• Run the game and save your progress across sessions and devices;
• Keep you signed in and secure your account;
• Prevent, detect, and investigate cheating, abuse, and automated account creation;
• Understand our audience and improve the game (usage, where players come from, when they play, retention);
• Plan capacity, including regional servers;
• Process purchases and deliver the virtual items you buy, and provide purchase support (once purchases are enabled).

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, our legal bases for processing are:

• Performance of a contract — creating your account, saving your progress, and delivering the items you buy.
• Legitimate interests — securing accounts, preventing cheating and automated abuse, planning capacity, and understanding our audience in aggregate. We balance these interests against your rights.
• Consent — the optional acquisition analytics (how you found us) and any future non-essential features. You can withdraw consent at any time; see "Cookies and local storage" below.
• Legal obligation — retaining purchase and tax records once purchases are enabled.

3. Who we share it with

We do not sell your personal information. We share it only with service providers who help us run NOMZ:

• Hetzner — application and server hosting, in the European Union (Helsinki, Finland).
• Neon — managed database (hosted in the United States) where account and gameplay data are stored.
• Google — only if you choose to sign in with Google.
• Xsolla — our payment provider and merchant of record for purchases (once enabled); it processes payments and handles tax under its own privacy policy.
• Content delivery / security provider — if enabled, to protect and speed up the service.

We may also disclose information if required by law, to enforce our terms, or to protect NOMZ, our players, or others. Notably, our database provider stores data in the United States, so account and gameplay data leaves the EEA/UK. Where required for such transfers, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, where applicable, the EU-U.S. Data Privacy Framework).

4. Cookies and local storage

NOMZ does not use cookies at all — no first-party cookies, and no third-party advertising or tracking cookies. Instead we use your browser's local storage (data saved on your own device). Under EU/UK ePrivacy rules, local storage is treated like cookies, so we disclose it here and ask for consent where required. Here is everything NOMZ stores on your device:

What	Why	Category	Kept for
Session & refresh token	Keeps you signed in and preserves guest progress across sessions	Essential	Until you sign out or clear storage
Device identifier	Counts unique devices and blocks automated abuse (only a salted hash is kept on our servers)	Essential	Until you clear storage
Age confirmation	Remembers that you confirmed you meet the minimum age	Essential	Until you clear storage
Privacy choice	Remembers your analytics choice so we don't ask again	Essential	Until you change it or clear storage
Game state & preferences	Your skin, owned cosmetics, cached coin balance, sound and display settings	Functional	Until you clear storage
Acquisition source	Recorded once — a link tag or the referring site's host name — to understand how players find NOMZ	Optional	Only if you consent; deleted if you decline

The acquisition analytics is the only non-essential item. For visitors in the EEA/UK it is off by default and recorded only after you choose "Accept." Elsewhere it may be recorded unless you opt out.

Managing or withdrawing your choice

You can change or withdraw your choice at any time using the "Cookie settings" link at the bottom of the game. Choosing "Essential only" stops the acquisition analytics and deletes any acquisition data already stored — withdrawing is as easy as giving consent. Essential and functional storage is required to run the game and cannot be switched off from within NOMZ, but you can clear all NOMZ storage in your browser settings at any time; doing so signs you out and, for guests, may make progress unrecoverable.

5. How long we keep it

• Accounts are kept until you delete them or request deletion.
• Sessions expire automatically (currently 30 days) and can be revoked by signing out.
• Aggregate analytics (e.g. concurrency samples) are kept only briefly and aren't tied to your identity.
• Once purchases are enabled, purchase and transaction records are kept as required for tax, accounting, and legal purposes.

6. Your rights

Depending on where you live (e.g. under GDPR/UK GDPR or CCPA/CPRA), you may have the right to access, correct, delete, or port your information, and to object to certain processing. To make a request, email privacy@nomz.gg. Because much of our data is stored as one-way hashes and coarse codes, some information cannot be linked back to you even by us.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know, delete, and correct the personal information we hold, and to opt out of its "sale" or "sharing." We do not sell or share your personal information as those terms are defined, and we do not use it for cross-context behavioral advertising. We honor browser Global Privacy Control (GPC) signals as an opt-out of the optional analytics, and we will not discriminate against you for exercising any of these rights. To make a request, email privacy@nomz.gg.

7. Children

NOMZ is not directed to children under 13 (or the minimum age of digital consent in your country, which may be higher). We do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, contact privacy@nomz.gg and we will delete it.

8. Security

We protect your information by storing IP-derived data and session tokens only as salted one-way hashes, keeping payment data off our servers, and limiting administrative access. No system is 100% secure, but we take reasonable steps to protect your data.

9. Changes

We may update this policy and will revise the "Last updated" date above. Material changes will be communicated as required by law.

10. Contact

The data controller for your information is Mily & Co., LLC, a North Carolina company in the United States. Questions or requests: privacy@nomz.gg. We are a U.S.-based service; if you are in the EEA or UK and we cannot resolve your concern, you also have the right to lodge a complaint with your local data protection authority.