Privacy Policy

Scope

This Privacy Policy covers all digital products and services created and distributed by Null Comma, including but not limited to: the nullcomma.com website, downloadable games and prototypes, the Null Comma Launcher, web applications, browser extensions, and any future tools or applications released under this brand.

LGPD Compliance

Null Comma complies with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados - LGPD, Law No. 13.709/2018). All data processing activities described in this policy are conducted in accordance with LGPD principles, including purpose limitation, data minimization, transparency, and security. You have the right to access, correct, delete, or port any personal data we may process. For any data-related requests, contact us at [email protected].

Legal Bases for Processing (LGPD)

Under the LGPD, we process personal data only when there is a valid legal basis. For the Ciranda messaging service we rely on:

• Performance of a contract: processing necessary to provide your account and to deliver, store, and transmit the messages and media you send.
• Legitimate interest: security, abuse prevention, user blocking, content moderation, and server logs.
• Legal or regulatory obligation: retention of records demonstrating your acceptance of these policies.

Where processing relies on your consent, you may withdraw it at any time; this does not affect processing already carried out.

Data Collection

Null Comma products are designed to minimize data collection. Most products do not collect, store, or share any personal data. However, some games and applications may use anonymous analytics for quality assurance and bug reporting purposes. This data is aggregated, does not identify individuals, and is used solely to improve product stability and user experience.

Website

The nullcomma.com website does not use cookies, tracking scripts, analytics services, or OAuth logins. No personal data is collected through browsing or interacting with the site. The contact form sends your message through Formspree, which processes it privately. I do not retain, sell, or access your submitted data beyond responding to your message.

Games and Applications

Most games, tools, and applications created by Null Comma run locally on your device and do not transmit any data to external servers. Any data generated by these products (such as save files, preferences, or configuration) is stored exclusively on your local device.

Some products may include optional anonymous analytics for quality assurance and bug reporting. This analytics data is aggregated and does not contain personally identifiable information such as your name, email, or device identifiers. It is used solely to identify crashes, performance issues, and usage patterns that help improve the product. Analytics can typically be disabled in the application's settings.

Authentication (OAuth)

Some Null Comma applications may use OAuth or similar authentication methods to allow you to sign in using third-party accounts (such as Google, Steam, or other providers). When you authenticate via OAuth:

• Null Comma does not receive or store your password.
• Only the minimum necessary profile information is accessed (such as your display name and email) as permitted by the provider.
• Authentication tokens are stored securely on your device and can be revoked at any time through the provider's settings.
• We do not share your authentication data with any third parties.

Specific details about what data is collected through OAuth are provided within each application that uses authentication.

Third-Party Services and Integrations

Some Null Comma products may interact with third-party services:

Steam: Games distributed on Steam may use the Steamworks SDK for features such as achievements, cloud saves, and leaderboards. These features are governed by Valve's privacy policy. Null Comma does not access or store any Steam user data.

YouTube: This website embeds video trailers from YouTube. YouTube has its own privacy policy. This site is not affiliated with YouTube or Google.

Formspree: The contact form on this website uses Formspree to deliver messages. Formspree processes your email privately. I do not retain, sell, or access your submitted data beyond responding to your message.

Directus CMS: This website uses Directus as a headless CMS to manage content. The CMS is self-hosted and does not collect visitor data.

Analytics Providers: When anonymous analytics are used in games or applications, they may be processed through third-party analytics services. These services are selected based on their privacy practices and commitment to data anonymization.

Children's Privacy

Null Comma products do not knowingly collect any personal information from children under 13. Our products do not include features that require age verification or account creation, except where OAuth authentication is used - in which case the third-party provider's age restrictions apply.

The Ciranda messaging service is intended exclusively for adults aged 18 and over. We do not knowingly allow users under 18 to create or maintain an account, and we may suspend or delete accounts that we identify as belonging to minors.

Data Retention

Any data stored locally by our products (save files, preferences, configuration) remains on your device and is under your control at all times. Authentication tokens are stored securely and can be revoked through the provider. Anonymous analytics data is retained only as long as necessary for quality assurance purposes and is processed in aggregated form.

For the Ciranda messaging service, we keep personal data only for as long as necessary for the purposes described in this policy:

• Text messages: up to 7 days.
• Media and attachments: up to 24 hours.
• Moderation reports: kept for review as moderation records and anonymized after 24 months.
• Server logs: up to 30 days.
• Account deletion: processed immediately upon your request, after which your account and associated personal data are removed.

Records that must be kept to comply with a legal or regulatory obligation may be retained for the period required by law, and are restricted to that purpose.

Network Data for Safety and Legal Compliance

To prevent abuse, protect users, and comply with legal obligations, the Ciranda messaging service collects and stores the following network metadata when you send a message or file a moderation report:

• IP address: the IP address used when sending a message or filing a report, stored to assist in abuse prevention, moderation, and lawful investigations.
• User agent: the application identifier and version, stored to diagnose abuse patterns and assist in investigations.

This data is processed under the LGPD legal basis of legitimate interest (Article 7, IX) for security, abuse prevention, and compliance with legal obligations. It is retained for the same period as the associated message or moderation report, and is never shared with third parties except when required by law or court order.

Your Rights Under LGPD

Under the Brazilian LGPD, you have the following rights regarding your personal data:

• Access: Request confirmation of whether we process your data and access what is stored.
• Correction: Request correction of incomplete, inaccurate, or outdated data.
• Deletion: Request deletion of personal data processed with your consent.
• Portability: Request transfer of your data to another service provider.
• Revocation: Revoke consent for data processing at any time.

You can exercise these rights directly in the Ciranda app using Download my data (data export) and Delete account, or by emailing [email protected]. We respond to data subject requests within up to 15 days.

Encarregado (DPO)

Our Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais) can be contacted at [email protected] for any questions about the processing of your personal data or the exercise of your LGPD rights.

International Data Transfers

Some of our service providers may process data outside Brazil. Ciranda media and attachments are stored on Cloudflare (R2), and authentication is provided by Google. These providers may store or process data in other countries; we rely on appropriate safeguards and their contractual commitments to keep your data protected.

Security

We protect your data using technical and organizational measures, including encryption in transit (TLS), hashed authentication tokens, and data minimization. Ciranda does not store passwords: sign-in is handled through Google. While we work to protect your data, no method of transmission or storage is completely secure.

Changes to This Policy

This Privacy Policy may be updated at any time. Changes will be reflected on this page with an updated "Last updated" date. Continued use of any Null Comma product after changes constitutes acceptance of the updated policy.

Contact

Email: [email protected]

Privacy and data protection (Encarregado / DPO): [email protected]