The Vigil · Privacy
What NoDawn keeps, and what it does not.
This document describes what NoDawn actually does, read out of the code and database rather than from a template, and that part is accurate. The legal framing around it — jurisdiction, liability, consumer-law carve-outs — has not been reviewed by a lawyer and may change before launch.
Points still marked like this are genuinely undecided. They are shown rather than guessed, because each one is a commitment nobody has made yet.
Last updated: 2026-08-02 · Contact: the Vigil Discord, or the feedback form inside the game
1. The short version
NoDawn stores what it needs to run your account and your games, and nothing else. There are no advertising trackers, no analytics SDKs, and no data sold or shared for marketing — not as a promise of restraint, but because none are present in the product. You can delete your account from inside the game, and that deletion is real.
2. What we collect, and why
We collect only what you give us or what playing generates. There is no profiling and no inference.
| What | Where it comes from | Why |
|---|---|---|
| Email address | You, at sign-up | Authentication and account recovery. Sign-in is email + password or an emailed magic link. |
| Handle, display name, avatar, region | You, optionally | So other players can see who they are playing. region is decorative flavour, not your location. |
| Decks and collection | Playing | So your cards and decks follow your account rather than one browser. |
| Match history, replays, ranked standing | Playing | Your game history, the ladder, and replay viewing. |
| Wallet, ledger, entitlements, purchases | Buying | To grant what you paid for and keep an auditable record of it. |
| Quests, Vigil XP, cosmetics | Playing | Progression. |
| Friends and challenges | You | The social features you choose to use. |
| Feedback and card reports | You, when you send them | So we can answer and fix things. |
We do not collect: your real name, your address, your phone number, your precise location, contacts, or biometrics. We never see your card number — see §4.
Technical data. Our hosting providers process your IP address to deliver the service and to absorb attacks. We do not use it to build a profile of you.
3. Legal basis
Under the LGPD and GDPR we rely on: contract performance for anything required to run your account and games; legal obligation for financial records; and legitimate interest for security and abuse prevention. Where we ever rely on consent, you may withdraw it at any time.
4. Payments
Payments are processed by Stripe. Card numbers go directly to Stripe and never reach our servers — we store only the fact that a purchase happened and what it granted.
Stripe is an independent controller of the payment data it holds, under its own privacy policy.
5. Who else processes your data
We use these providers, and no others:
| Provider | Role | What they see |
|---|---|---|
| Supabase | Database, authentication | Everything in §2 |
| Stripe | Payments | Payment details, purchase records |
| Cloudflare | DNS, proxy, DDoS protection | IP address, request metadata |
| Fly.io | Game relay hosting | Live match traffic while you play |
We do not sell your data and we do not share it for advertising.
6. International transfers
Our providers operate globally, so your data may be processed outside your country — including in the United States and the EU. Transfers rely on the providers' standard contractual clauses.
7. How long we keep it
Your account data is kept while your account exists. When you delete it, §8 applies.
Financial records are retained as long as tax and accounting law requires , even after account deletion. This is a legal obligation and overrides erasure requests, as the law allows.
8. Deleting your account
You can delete your account from inside the game. Deletion is immediate, permanent, and cannot be undone — there is no grace period and no way for us to restore a single account.
What is erased: your profile, decks, collection, match history, replays, wallet and ledger, entitlements, purchases, quests, ranked standing, friends, challenges, custom cards, feedback, and your login credentials. All of it, in one transaction.
What is not, and why — stated plainly rather than buried:
- Payment records held by Stripe. These are retained under financial-record law. We cannot delete them and neither can you.
- Matches you played against other people. Those rows are your opponent's game history, not only yours. They remain, with your identity removed — your account id is erased from them. Deleting them outright would destroy another person's data to satisfy your request.
Anything you bought is lost. Deleting an account forfeits every purchase, entitlement and currency balance in it, with no refund. Read the refund policy first if that matters to you.
9. Your rights
Under the LGPD, GDPR and similar laws you may request: access to your data, correction, deletion (§8), a portable copy, restriction of processing, and to object to processing based on legitimate interest.
Most are available in-product. For anything else, write to the in-game feedback form or the Vigil Discord and we will respond within. You may also complain to your data protection authority — in Brazil, the ANPD.
10. Children
NoDawn is not intended for children under minimum age — not yet set. We do not knowingly collect data from them. If you believe a child has created an account, write to the in-game feedback form or the Vigil Discord and we will delete it.
11. Security
Access is enforced at the database by row-level security, so one account cannot read another's data even if the client is tampered with. Payment credentials never touch our servers. Administrative access is separately gated and audited.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant authority as the law requires.
12. Cookies and similar technologies
NoDawn uses browser storage to keep you signed in and to remember your settings. We do not use advertising or analytics cookies, and there are no third-party trackers in the client.
13. Changes
We will post any change here and update the date above. For material changes we will notify you in-product before they take effect.