Privacy policy
Last updated: 30 September 2026
This is a courtesy translation. If it ever differs from the Spanish version, the Spanish version prevails.
At Nibbly we keep as little data as possible: just enough for you to have your account and for your hamsters to wait for you on any device. We do not sell your data or send you advertising.
Controller
Albert Lujan Segura, living in Spain. Contact: albertseguralujan2@gmail.com.
What data we keep and why
| Data | What for | Legal basis |
|---|---|---|
| Username | To identify your account. | Contract: providing the service. |
| Password | To log in to your account. We never store it as is: only an encrypted fingerprint (scrypt) that cannot be turned back into it. | Contract. |
| To confirm your account, send you the link if you forget your password and tell you about important changes to the service. No advertising. | Contract. | |
| Your game | To keep your hamsters and your cage. | Contract. |
| Order | To know whether your account is paid for or refunded. We only receive the order number: the payment data is handled by Paddle and we never see your card. | Contract. |
| Technical data (session cookie, IP address) | To keep you logged in and protect the service. The IP is only used for a short while to stop attacks (too many attempts to log in or create accounts) and we do not store it. | Contract and legitimate interest in security. |
| Site usage (Google Analytics) | To learn how Nibbly is used and improve it. Only if you accept it in the cookie notice. | Your consent, which you can withdraw at any time. |
Children under 14
Nibbly is suitable for all ages, but the account must be created by someone aged 14 or older. If the player is under 14, the account is created by their parent or guardian, with that adult's own email, who accepts these terms and pays. We recommend not using the child's real name as the username. Nibbly has no chat or any way to talk to other players. If we find an account created by a child under 14 without their parent or guardian, we will delete it.
How long we keep it
For as long as you have your account. An account not paid for within 24 hours is deleted automatically. The links we email you expire (the password recovery one in 1 hour, the email confirmation one in 7 days) and the session in 30 days. If you ask us to delete your account, we delete your data; Paddle keeps the purchase data for as long as the law requires.
Who else handles your data
We use these providers, who only handle your data to provide their service to us:
- Render (United States): the server Nibbly runs on.
- Turso: the database where accounts and games are kept.
- Resend: sending the emails, from servers in the European Union.
- Cloudflare: managing the domain and the network visits come through.
- Paddle: the shop that charges for the account. It acts as the seller (Merchant of Record) and handles the payment data under its own privacy policy.
- Google (Google Analytics): only if you accept the analytics cookies.
Some of these providers are in the United States or may handle data there. They do so with the safeguards required by the General Data Protection Regulation: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can ask us to see your data, correct it, delete it, take it with you, restrict its use or object to it, by writing to albertseguralujan2@gmail.com from your account's email. You can also change your email and password yourself from your account details. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Security
Everything is encrypted over HTTPS, passwords are stored as encrypted fingerprints, the session travels in a cookie that other scripts cannot read, and we limit login attempts to stop anyone trying to guess passwords.
Changes
If we change this policy in any important way, we will announce it in the game or by email.