> Nothing But Dope, LLC

> Effective March 2026

> theteam@nothingbutdope.com

> 1. What We Collect

When you create an account, we collect:

• Username — for login
• Email address — for password resets only
• Password — stored as a one-way bcrypt hash (we cannot read it)
• Codename, bio, avatar — optional profile data you provide

We do not collect IP addresses, device fingerprints, or tracking cookies.

> 2. What We Do NOT Collect

• No gameplay dialogue is stored — AI conversations are ephemeral
• No analytics or tracking pixels
• No advertising data
• No payment information (the game is free)
• No location data

> 3. Third-Party Services

Node37 uses the following services to operate:

• Render (render.com) — hosting infrastructure
• Cloudflare (cloudflare.com) — CDN and DNS; processes standard network request metadata such as IP address and request headers as part of CDN and security services
• Mailgun (mailgun.com) — sends password reset emails; receives your email address for this purpose only
• Groq (groq.com) — generates NPC dialogue; receives only fictional game prompts, no personal data

> 4. Service Providers

Third-party service providers process limited technical data solely to operate the platform and may not use your information for their own marketing purposes.

> 5. How We Use Your Data

• Username + password hash: authenticate your account
• Email: send password reset links when you request them
• Profile data (codename, bio, avatar): display within the game

We do not sell, rent, license, or share personal information with third parties for advertising or marketing purposes.

> 6. Data Retention

Account data is retained until you delete your account or your account has been inactive for more than 2 years, whichever comes first. Inactive accounts may be purged without notice. When an account is deleted, all associated personal data is removed from active systems within a reasonable period of time. Residual copies may remain in encrypted system backups for up to 30 days before being automatically overwritten.

> 7. Your Rights

You may:

• Delete your account at any time from your profile settings
• Update your email or password at any time
• Request a copy of your data by contacting theteam@nothingbutdope.com

California residents (CPRA) and EU residents (GDPR) have additional rights including the right to access, correct, and delete personal data. Contact us at the email above.

> 8. Children's Privacy

Node37 is not intended for users under 16 years of age. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, contact us and we will delete it.

> 9. Security

We protect your data using bcrypt password hashing, HTTPS encryption, rate limiting, and security headers (HSTS, CSP). No system is 100% secure. If you discover a vulnerability, contact security@nothingbutdope.com.

> 10. Changes

We may update this policy. Continued use after changes constitutes acceptance. Last updated: March 2026.

> 11. Contact

Nothing But Dope, LLC

theteam@nothingbutdope.com

── END OF POLICY ──