The short version
- We store only what the games need: your email, your username and your game results.
- No ads, no analytics, no tracking cookies, and we never sell your data.
- Your username and scores are public on the leaderboards. Your email is never shown.
- You can delete your account and all of your game data yourself, at any time, on the Account page.
Who is responsible
NULLWIRE (https://nullwire.org) is a free, non-commercial fan project run by the NULLWIRE team, based in the Netherlands. They are the "controller" of your data under the GDPR (AVG). For anything about your data, email contact@nullwire.org.
What we store and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, password (stored only as a one-way hash; we can't read it), username, and 2FA setup if you turn it on | Your account: logging in, resetting your password, keeping it secure | Providing the service you signed up for (art. 6(1)(b) GDPR) |
| Game data: every Wirebreach run (the puzzle, each pick and its timing, your score), every ranked INTRUSION run (each action and its timing, your score), duels (moves, timings, results, and the emotes you send), ratings, your cyberdeck, XP, level, Creds, the cosmetics and paint cans you own and the cosmetics and paint you equip; in CTF Ops: which challenges and contracts you opened and solved, the flags you submitted (right or wrong), hints you used, and when (contract solve times are measured to keep bots out) | Running the games, the leaderboards and the rankings | Providing the service (art. 6(1)(b)) |
| Anti-cheat results: a suspicion score and the reasons for it, per run | Keeping the leaderboards fair | Legitimate interest in fair play (art. 6(1)(f)) |
| Community: the upcoming features you said you want (and which one is your #1), whether you signed up as an alpha tester, and the suggestions and bug reports you send (with your username and the part of the site you picked) | Deciding what to build next, inviting alpha testers to try new modes, fixing what you report | Providing the service and improving it (art. 6(1)(b) and (f)) |
| Alpha waitlist (only if you join it, without an account): your email address, the features you want, when you joined, and a keyed fingerprint of your IP address (not the address itself) to stop one connection from filling the list | Sending you ONE email with an invite code when a spot opens. Nothing else: no newsletter, no marketing | Your consent (art. 6(1)(a)). You can withdraw it any time: email us and we remove you |
| Signup demand: when you open the signup form on a day the alpha spots are full, a keyed fingerprint of your IP address (not the address itself) for that day, so each visitor is counted once | Knowing how many people we had to turn away, to decide whether to open more spots | Legitimate interest in running the alpha (art. 6(1)(f)). Deleted after 30 days |
| Technical data: IP address, browser type, times of requests | Security, bot protection and fixing errors. These end up in our providers' server logs. | Legitimate interest in a secure site (art. 6(1)(f)) |
| Security log: only when a request looks like cheating or an attack (for example an edited game move, a forged login token or someone poking for admin features): your account, IP address, browser type, what was attempted and when | Detecting and stopping attacks and cheating, temporary automatic blocks, and evidence if we have to report an attack | Legitimate interest in a secure, fair site (art. 6(1)(f)) |
We do not ask for your real name, address, date of birth or payment details.
What other people can see
- Everyone: your username, your best scores and your duel ratings on the public leaderboards, and the cosmetics you equip (name colour, title, badge, nameplate, board theme, victory banner, upload effect and any paint colours).
- Your duel opponents: your username, your moves and the emotes you send in the duels you play against them.
- Nobody else: your email address, your individual runs, your anti-cheat results, your suggestions and which features you voted for (only totals may be shown). Only you and the site operator can see those.
The anti-cheat ("the referee")
The server automatically checks every score, for example whether your picks came at humanly possible speeds. It gives each run a suspicion score. Clearly human runs go straight onto the leaderboard. Suspicious runs are hidden until a person has looked at them. Only runs that are practically impossible for a human are rejected automatically.
Bans are only ever given by a person, never by the computer alone. If you think a run was wrongly hidden or rejected, email us and a person will look at it again.
Security log and automatic pauses
Normal play is never logged here. Only requests that the real game can't produce, or that look like an attack, are written to a security log that only the site operator can see. If one account or one internet connection causes too many of those in 10 minutes, it is paused automatically for 15 minutes; if it keeps happening, for 1 hour, 4 hours and at most 24 hours. A pause is temporary and nothing else happens automatically. Several people on the same connection (a school or a café, for example) can be paused together, so if you think a pause was a mistake, email us and we'll lift it.
The site operator gets an email about serious events. For attacks on the site we may use the log to file a police report or to warn the provider of the network the attack came from.
Cookies and browser storage
We don't use tracking or advertising cookies, and there is no analytics. Your browser stores only what the site needs to work:
- your login session, so you stay logged in;
- small preferences such as sound on/off and the tab or game mode you picked last.
When you sign up or log in, Cloudflare Turnstile may run a short check to stop bots. Because all of this is strictly necessary, the site doesn't need a cookie banner.
Who processes your data for us
| Company | What for | Where |
|---|---|---|
| Supabase | Accounts, database and the game servers. Stores all of the data above. | Frankfurt, Germany (EU) |
| Cloudflare | Bot check at sign-up and login (Turnstile): sees your IP address and browser signals. Also runs this domain's DNS and forwards emails you send to our addresses. | Global network |
| Resend | Sends the site's emails (sign-up confirmation, password reset). Sees your email address and the email's content. | Ireland (EU) |
| Netlify | Hosts the website files. Sees your IP address in its access logs. | Global network |
| jsDelivr | Delivers the Supabase code library to your browser. Sees your IP address. | Global network |
| Google (Gmail) | Our mailbox: emails you send us are stored there. | Global |
Some of these companies are based in the United States. Where data leaves the EU, they protect it under the EU–US Data Privacy Framework and/or the EU's standard contractual clauses, as set out in their data processing agreements. The site's fonts are hosted on the site itself, so no data goes to Google.
How long we keep it
- Account and game data: until you delete your account.
- Duel emotes: 3 days, then deleted automatically (they only matter while a match is on).
- Wishlist votes, alpha-tester signup and suggestions: until you take your vote back or delete your account.
- Waitlist: until you create your account (then the waitlist entry is deleted straight away), until you ask us to remove you, or at most one year.
- Security log and pauses: 30 days, then deleted automatically. This also applies after you delete your account, so that deleting an account can't be used to wipe the traces of an attack.
- Server logs (IP addresses): kept by our providers for a short time, usually days to a few weeks, then deleted automatically.
When you delete your account, your profile, runs, scores, deck, Creds, duels, wishlist votes and suggestions are deleted straight away. Your duels also disappear from your opponents' history.
Your rights
Under the GDPR you can ask to see your data, correct it, delete it, receive a copy of it (data portability), limit how we use it, or object to how we use it. You can delete everything yourself on the Account page. For anything else, email contact@nullwire.org. We reply within one month.
If you're not happy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
Age
You must be at least 16 to create an account. If you're younger, you need permission from a parent or guardian. If we find out that a child under 16 signed up without that permission, we delete the account.
Security
Passwords are hashed, all traffic is encrypted (HTTPS), the database only lets each player reach their own data, and you can turn on two-factor authentication on the Account page. Found a security problem? See Report a vulnerability.
Changes
If we change this policy, we'll update the date at the top. If the change is important (for example, new kinds of data), we'll also announce it on the site.