Privacy Policy | NoSpike

What NoSpike knows about you, why, who handles it for us and for how long, and what you can do about it.

Who we are

NoSpike (nospike.gg), in Denmark, decides how the data below is used, which makes us the "controller" under the EU's General Data Protection Regulation (GDPR). Who runs NoSpike, and the postal address, are in the imprint. Questions about your data: support@nospike.gg.

What we collect, and why

Your account: your email address and a securely hashed password (we never see the password itself). We use the email to sign you in, confirm your address and send password-reset links. We don't send newsletters or marketing. Legal basis: providing the service you signed up for (GDPR article 6(1)(b)).
Your country: the country your account was last used from, worked out from your IP address when you make an account, sign in, or your sign-in is renewed (the app renews it while it runs). The address itself isn't kept with it. When you make an account, it's also added to that day's count of new accounts from your country. We use this to see where our players are, so we know where relays are needed. Legal basis: our legitimate interest in placing the network where it's used (article 6(1)(f)).
Your PCs: each PC's name as Windows reports it, and the public half of its device key, so the app can connect through our relays. The private key never leaves your PC. Legal basis: providing the service.
Routes you use: which relays your PC has a place on, which game the last session was for, and when it was last used. Relays use this to know which PCs to accept, and we use it to run and size the network. Legal basis: providing the service.
Game servers ("Help map game servers"): this setting is on unless you turn it off in Settings. While it's on, the app reports the addresses of the servers a supported game connects to, never what is sent to them. Reports are linked to your account so that a server counts only once different players have seen it. Legal basis: our legitimate interest in routing games correctly for everyone (article 6(1)(f)); turning the setting off stops it.
Servers you add: for games whose servers players host, the address of each server you add and the name you give it, so the relays route it for you. Legal basis: providing the service.
Groups: when you make or join a group, the other members see the name you chose and your ping to each of the game's regions while you're in it. They never see your email address. A group nobody uses is removed after a day. Legal basis: providing the service.
Your plan: whether you have NoSpike Pro, which plan, and until when. If you subscribe, we also keep the ID of your customer record and subscription at Stripe, so we know when you've paid or cancelled. Legal basis: providing the service.
Payments: you give your card details and billing address to Stripe on its payment page, not to us. Stripe tells us whether a payment went through; we never see card numbers. Legal basis: providing the service, and bookkeeping law for the payment records.
Technical data: the IP address each request comes from, used to limit repeated attempts (for example sign-ins and password resets) and recorded in our server logs. Legal basis: our legitimate interest in keeping the service secure.
Email you send us: what you write to support@nospike.gg, kept so we can answer you. Legal basis: our legitimate interest in answering.

What stays on your PC and never reaches us: your settings, your History of sessions, your picture settings and shortcuts.

This website

The site sets no cookies and loads no advertising or third-party scripts. To know how many people visit and how they find us, each page tells our server as it opens which site linked to it (only that site's name, such as google.com, not the page there) and, if you're signed in on that tab, your sign-in, which our server only checks is one of ours: it doesn't look at whose it is. Our server then works out your country from your IP address and, so that each person counts once a day, a scrambled code made from your IP address and browser with a key that changes every day. Next to each code, until it's deleted, are only its country, whether it was signed in, and which sites it came from that day: not your IP address and not your account. The codes and the day's key are deleted once the day is over (midnight UTC) and are never in a backup. What we keep are each day's totals: how many people and page views, signed in or not, from which countries and which sites. No code, address or account is kept with them. Legal basis: our legitimate interest in knowing how the site is found and used (article 6(1)(f)).

When you sign in here, your sign-in is kept in that browser tab only and is gone when you close it. Artwork for Steam games is loaded from Valve's image servers (see below).

What the relays see

When you play through a relay, the relay sees your IP address and passes your game's traffic on to the game server. The traffic between your PC and the relay is encrypted (QUIC, with TLS 1.3). Relays only carry traffic for supported games, keep no record of your IP address or of what passes through, and count only the total traffic of each relay, not per player.

We don't sell your data, we don't show ads, and the app never reads what your games send, only where they connect.

Who processes data for us

Microsoft (Azure) runs the computers our servers and two of our relays are on, in Sweden and Denmark, and sends our emails (Azure Communication Services, with data kept in Europe). Microsoft handles this data only on our instructions.
Kamatera runs the computers our relays in Frankfurt, Amsterdam, Madrid and London are on. Kamatera, Inc. handles this data only on our instructions, under the data processing agreement that is part of its terms.
Stripe takes the payments for NoSpike Pro and sends your receipts. It takes the payments as the merchant of record (Stripe Managed Payments): your purchase is "Sold through Link", by Sold through Link, LLC, a Stripe company, which is responsible in its own right for the payment data. It processes your email address, billing address and payment details, partly in the United States (under the EU's Standard Contractual Clauses and the EU-US Data Privacy Framework); see Stripe's privacy policy.
Better Stack stores copies of our servers' logs and performance figures so we can spot problems. IP addresses are shortened before they're sent (the last part becomes 0, so they no longer point to one connection). These copies are stored in the United States.
Cloudflare answers the internet's lookups of the name nospike.gg and forwards mail sent to support@nospike.gg to our mailbox at Google (Gmail), which then stores it. Cloudflare doesn't carry this website's pages or the app's traffic. And only when you run the bufferbloat test in the app's network check, the app downloads test data from and uploads random test data to Cloudflare's public speed test (speed.cloudflare.com), so Cloudflare sees your IP address; nothing about your account is sent.
Valve (Steam): this website and the app load artwork for Steam games from Valve's image servers, so your browser or the app contacts them and they see your IP address. Other game pictures are served by us.

The network check's other parts stay on your PC: the route trace pings the routers between you and a game server or relay, and the optional priority tag is a Windows setting. Their results are only shared if you copy them or save diagnostics and send them to us.

Your account and everything tied to it is kept in the EU; only the log copies above, with shortened IP addresses, what Stripe needs for payments and mail you send us leave it. We'll update this list before adding anyone new.

How long we keep it

Account, your country, PCs, routes, servers you added and your game-server reports: until you delete your account.
Visits to this website: the day's codes and their key are deleted once the day is over; the daily totals are kept.
Payment records (invoices and receipts, kept by Stripe): for 5 years, as Danish bookkeeping law requires, also after you delete your account.
Server logs: each server's log is capped in size and overwritten as new entries come in, and cleared whenever we update the server. The copies at Better Stack are deleted after 3 days (performance figures, which hold no personal data, after 30 days).
Backups: database backups are kept for about two weeks on the server and, encrypted, for up to 30 days in separate storage, then deleted.
Email links: they stop working after 24 hours (email confirmation) or 30 minutes (password reset), and after one use.
Mail you send us: for two years after the last message in the conversation, then deleted.

Game-server addresses that other players confirmed stay in our list after you delete your account, but without any link to you.

Your rights

You can ask to see, correct, export or delete your data, and you can object to the uses based on our legitimate interest. You can delete your account yourself on your account page or in the app (Settings, then Account). This removes your account, PCs, routes and reports straight away, and backups of them are gone within 30 days. For anything else, email support@nospike.gg; we answer within a month. If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the authority where you live.

Children

NoSpike is for people aged 13 and over. If you think a younger child has an account, email us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it applies.