Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how Hitspark Inc., an Ontario corporation (“Hitspark”, “we”, “us”, or “our”), handles personal information in connection with Nin Online, including the game, website, forums, accounts, purchases, and official support channels (the “Services”). Personal information is information about an identifiable individual, including account and technical information when it can be linked to someone.

Our Terms of Service govern use of the Services. This policy does not remove your privacy rights or provide blanket consent for unrelated uses of your information.

1. Who Is Responsible and How to Contact Us

Hitspark Inc. is responsible for personal information under its control. Where applicable law uses the term, we act as the controller of that information.

Privacy contact: rory@ninonline.com

Use this contact for access or deletion requests, corrections, privacy complaints, and questions about service providers or international processing. Do not post identity documents, payment information, or private account details in public forum posts. If you cannot access your game account, the privacy contact remains available to you.

2. Information We Collect

The information involved depends on the features you use and what you provide. We limit collection to information reasonably necessary for the purposes described below.

• Account information: registration details such as email address, username, and any name you supply; login credentials or authentication records; account preferences; and information needed to establish eligibility or account ownership.
• Gameplay information: characters, progression, inventory, virtual-currency balances, transactions, interactions, and activity records needed to operate the game, resolve errors, and investigate suspected abuse.
• Communications: in-game and forum messages, including private messages; posts; support correspondence; reports; appeals; and attachments you or another user submit, such as screenshots or relevant recordings.
• Purchase information: order references, purchased items, amounts, currency, payment status, and information associated with refunds or payment disputes. Payment information collected directly by a payment provider or storefront is also subject to that provider’s privacy notice. Do not send full payment-card details through chat or support.
• Technical information: connection and access logs, such as IP addresses and timestamps, browser or client information, and diagnostic information involved in operating, securing, and troubleshooting the Services. Any additional anti-cheat collection requiring a separate disclosure will be explained before it begins.
• Cookies and similar technologies: information used for sessions, preferences, security, and website traffic measurement, as described in Section 7.
• Linked services: if you choose a third-party sign-in or account connection, the identifiers and account information that provider supplies under the permissions shown during the connection process.

Information comes from you, your interactions with the Services, providers involved in those interactions, and other users who communicate with or report you. We may review relevant publicly available information when investigating a specific security or safety concern. Public availability does not remove applicable privacy protections.

3. How and Why We Use Information

• Register and authenticate accounts, save progress, provide gameplay and community features, and maintain account preferences.
• Deliver purchases, reconcile payments, investigate billing issues, and maintain required transaction records.
• Provide support, verify account ownership, recover accounts, and respond to privacy requests.
• Identify errors, diagnose crashes and performance problems, and improve the reliability and usability of the Services.
• Investigate cheating, exploits, account theft, fraud, harassment, threats, and other rule violations; review reports and appeals; and protect users, staff, and Service security.
• Send necessary account, purchase, security, service, and legal notices.
• Send optional news or promotional communications where permitted by law and consistent with your choices.
• Meet legal obligations, respond to lawful requests, preserve necessary evidence, and establish, exercise, or defend legal claims.

We will not use personal information for a materially different purpose without giving appropriate notice and obtaining consent or another lawful basis where required. A new policy does not retroactively authorize an incompatible use of previously collected information.

4. Consent and Other Legal Grounds

Where consent is required, we seek meaningful consent appropriate to the information and circumstances. Optional processing is not made a condition of receiving unrelated core services. You may withdraw consent, subject to lawful restrictions and reasonable notice; we will explain any resulting limits on features before acting where practicable.

Where applicable law permits other grounds, processing may be necessary to provide the service you request, comply with legal obligations, or pursue legitimate interests such as preventing fraud and securing the Services, subject to the required balancing of your rights and interests. These grounds do not override consent requirements under other applicable laws. Where necessary to protect someone’s life or safety, we may process information as permitted by law.

5. Messages, Public Profiles, and Moderation

Public posts, character names, profiles, rankings, and gameplay information displayed through public features may be visible to other players or visitors. Other people may copy or share what they can see. Choose carefully what personal information you disclose.

Private messages are intended for their recipients but may be stored and accessed by authorized personnel when reasonably necessary for support, safety, security, moderation, or legal obligations. “Private” does not mean inaccessible to the operator. This policy does not authorize unrestricted access for unrelated purposes.

Reports may contain information about both the reporter and the reported person. We limit disclosure to what is appropriate for investigation, review, or legal requirements; we cannot promise absolute anonymity. We do not use personal information to retaliate against someone merely for an unfavorable review or good-faith complaint.

6. When Information Is Shared

We disclose information only as reasonably necessary for the purposes explained here, with appropriate authority under applicable law:

• Personnel and service providers: authorized staff, contractors, and providers supporting hosting, databases, communications, payments, security, diagnostics, or customer support. Providers handling information on our behalf must be subject to appropriate confidentiality, security, and purpose restrictions. We remain accountable for information under our control.
• Platforms you use: storefronts, payment services, and sign-in providers where needed to carry out your requested transaction or account connection. Some act independently under their own privacy notices.
• Other users: information you intentionally make public or send to another user through a feature.
• Legal and safety disclosures: where required or permitted by law, including lawful legal process, protection against serious threats, fraud investigations, and establishment or defence of legal rights. We assess the authority and scope of a request rather than disclosing information simply because someone asks.
• Business transactions: a merger, acquisition, financing, restructuring, or transfer of the Services, only where permitted by law and subject to appropriate safeguards, confidentiality, and required notice.
• Your direction or consent: for a specific disclosure you request or authorize.

This policy does not authorize selling player information, sharing it for cross-context behavioural advertising, or allowing a provider to reuse it for unrelated purposes. Any proposed activity of that kind would require a separate assessment, clear disclosure, and applicable consent or opt-out mechanisms before it begins.

7. Cookies, External Content, and Email Choices

Cookies and similar technologies help maintain sign-in sessions, remember preferences, protect accounts, and measure website activity. Where law requires consent for non-essential cookies or similar technologies, we will obtain it before those technologies are activated and provide a way to change your choice.

You can also adjust browser settings to block or remove cookies. Blocking necessary cookies may prevent login or other requested features from working. Browser controls do not necessarily disable all non-cookie tracking.

External resources, including remotely hosted fonts, and embedded content may cause your browser to contact another provider and disclose technical information such as your IP address. Third-party links and account connections may involve separate privacy practices. Review the relevant provider’s notice before using them.

Optional promotional emails will provide a way to unsubscribe. Opting out of marketing does not stop necessary purchase receipts, security alerts, or other non-promotional service communications. We will comply with applicable electronic-marketing requirements.

8. International Processing

Information may be processed outside your province or country by infrastructure providers or authorized personnel. Foreign laws may allow courts or authorities in those countries to access information. We remain responsible for selecting appropriate safeguards for information under our control.

Where a jurisdiction requires a specific transfer mechanism, assessment, or authorization, we will meet that requirement before the transfer. Contact the privacy contact for information about relevant providers and safeguards and, where legally available, a copy or explanation of those safeguards.

9. AI Tools and Automated Decisions

The prohibitions on AI-assisted cheating and reverse engineering in our Terms do not grant permission to use players’ personal information for AI training or unrelated surveillance.

Before introducing AI-assisted processing of personal information, we will assess necessity, accuracy, security, provider access, retention, and any provider training or reuse. We will explain the specific purpose, data involved, and important consequences, and obtain consent or establish another lawful basis where required. This policy alone does not authorize uploading private communications to public AI services or training general-purpose models on them.

Where automated tools assist enforcement, material sanctions may be appealed for human review through the process in our Terms. We will not treat an AI-generated assessment as conclusive proof of misconduct. If we introduce solely automated decisions producing legal or similarly significant effects, we will first provide the notices and safeguards required by applicable law, including applicable review and challenge rights.

10. Retention and Deletion

We retain identifiable information only as long as reasonably necessary for its stated purpose and applicable legal requirements. Retention depends on the type of information, whether the account remains active, the need to resolve issues or appeals, legal recordkeeping periods, and relevant limitation periods. It is not indefinite merely because storage is available.

• Account and gameplay records: retained as needed to provide an active account and handle closure, recovery, or outstanding obligations.
• Communications, support, and diagnostic records: retained for the period reasonably needed for their operational purpose or a related investigation or appeal.
• Payment and legal records: retained for applicable accounting, tax, dispute, and other legal requirements.
• Enforcement records: limited records may remain where necessary and lawful to prevent fraud or ban evasion, review sanctions, or defend claims. A ban does not justify keeping all information forever.

When information is no longer needed, we delete it or render it anonymous using appropriate measures. Backup copies may remain until their normal replacement cycle, with access limited and deletion requests reapplied if a backup is restored. Pseudonymized information remains personal information when it can still be linked to you. Public material copied by other users or independent sites may remain outside our control.

You may request details of the retention criteria or applicable periods through the privacy contact. A legal hold or other lawful exception may delay deletion of relevant records; we will explain any applicable limits where permitted.

11. Security and Incidents

We use safeguards appropriate to the sensitivity of information and the risks involved, including restricting access to authorized people who need it for their work. We assess providers and seek appropriate safeguards for information processed on our behalf. No system is completely secure, and this policy does not promise absolute protection.

If a privacy or security incident occurs, we will assess it, take appropriate containment and response measures, and notify affected individuals and authorities and maintain records where required by law. Protect your password and contact support promptly if you suspect account compromise. Do not send passwords through privacy requests.

12. Children and Young Players

The Services are not intended for children under 13 or below any higher minimum age required by applicable law. Where a young player needs parental or guardian consent to use the Services or for particular processing, we require it as applicable. Parental permission does not override our minimum age.

If you believe a child below the permitted age has provided personal information, contact us privately. We will investigate and take appropriate steps to restrict access and delete information that we are not legally permitted or required to retain. Notices and consent processes for young people must take account of their capacity to understand.

13. Changes to This Policy

We will publish revisions with a new “Last updated” date. For material changes, we will provide a prominent notice through the website, account, or email as appropriate before the change takes effect, except where a shorter period is necessary and lawful. We will obtain fresh consent where required, rather than treating continued use alone as consent to every change.

Changes do not remove existing rights or retroactively authorize incompatible uses. The “Last updated” date reflects revisions to this policy.