PRIVACY POLICY

Last Updated: August 2026

NPL Auction ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform ("Service").

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

Registration & Account Data:

• Email address
• Full name (display name)
• Profile picture (via Google OAuth)
• Authentication provider information

Gameplay Data:

• Auction history and bid records
• Squad composition and player selections
• Game statistics (wins, average bid price, etc.)
• Timestamps of all actions
• IP address and device information

1.2 Information Collected Automatically

• Browser type and version
• Operating system
• Pages visited and time spent
• Cookies and local storage data
• Server logs and API metrics

1.3 Guest Users

Guest users can play without creating an account. We collect session-specific gameplay data and temporary device identifiers (stored in localStorage). Guest data is not retained after the session ends and is not linked to any personal identity.

2. HOW WE USE YOUR INFORMATION

• Service Delivery — Running auctions, managing accounts, processing bids
• Personalization — Remembering your preferences, display name, game history
• Analytics — Understanding user behavior, improving gameplay
• Security — Detecting fraud, enforcing Terms & Conditions
• Communication — Sending account updates, bug fixes, new features (opt-in)
• Leaderboards — Displaying your stats and rankings (if signed in)
• Research — Improving AI bot behavior and game balance (anonymized data only)

3. DATA SHARING & DISCLOSURE

3.1 Third-Party Services

• Google OAuth — Handles sign-in; we receive your name and profile picture
• Resend — Manages email-based magic link authentication
• Neon PostgreSQL — Hosts our database (ISO 27001 certified)
• Render — Hosts our server (SOC 2 compliant)
• Vercel — Hosts our frontend (enterprise-grade security)

3.2 Legal Requirements

We may disclose your information if required by law: court orders or subpoenas, government requests, or protection of safety or legal rights.

3.3 Business Transfers

If NPL Auction is acquired or merged, your data may be transferred as part of that transaction. We will notify you of any such change.

4. DATA SECURITY

• Encryption — Data in transit (HTTPS/TLS) and at rest (PostgreSQL encryption)
• Authentication — OAuth 2.0 with secure session management
• Access Control — Role-based access, limited employee access
• Regular Audits — Security reviews and penetration testing
• Incident Response — Procedures in place for data breach notification

No security system is 100% secure. We cannot guarantee absolute security of your data.

5. DATA RETENTION

• Signed-in Users — Account data retained until you delete your account
• Guest Users — Session data deleted immediately after logout
• Audit Logs — Server logs retained for 90 days for security purposes
• Deleted Accounts — Personal data deleted within 30 days; gameplay statistics may be retained in anonymized form

6. YOUR RIGHTS

Depending on your location, you may have rights including:

• Access — Request a copy of your personal data
• Correction — Update or correct inaccurate information
• Deletion — Request deletion of your account and data (right to be forgotten)
• Portability — Request your data in a portable format
• Opt-Out — Opt out of non-essential communications

To exercise these rights, contact us at privacy@nplaution.com.

7. COOKIES & LOCAL STORAGE

We use cookies for session management, authentication, and preferences. We store in browser local storage: guest identity (guest ID and display name) and tutorial dismissal flags. You can clear local storage at any time through browser settings.

See our Cookie Policy for full details.

8. CHILDREN'S PRIVACY

NPL Auction is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the information promptly.

9. INTERNATIONAL DATA TRANSFERS

Our servers are hosted in the United States (Render) and Europe (Neon). By using NPL Auction, you consent to the transfer of your information outside your country of residence.

10. UPDATES TO PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or by posting the updated policy on our website.

11. CONTACT US

• Email — privacy@nplaution.com
• Mailing Address — Kathmandu, Nepal
• Response Time — We aim to respond within 10 business days

By using NPL Auction, you acknowledge that you have read and understood this Privacy Policy and consent to our collection and use of your information as described.