01 · SUMMARY
The essentials
- The Demo does not use the licensing Worker or Firebase.
- The full edition asks Steam to confirm that the current account owns the product.
- SteamID and stable device identifiers are stored only as domain-separated SHA-256 hashes.
- The Steam ticket is used for validation and is not stored in Firestore.
- The cloud registry backup is compressed and encrypted with AES-256-GCM; its key derives from a local secret that is never sent.
- We do not sell data, display advertising, or use this site for behavioral tracking.
02 · DATA CONTROLLER
Who is responsible
Fabrício Henrique Alves Pereira, publisher of NitroCore Synapse™, is responsible for the processing decisions described here. Support and privacy-request channels appear at the end of this page.
03 · DATA AND PURPOSES
What we process
The Steam ticket and SteamID are processed transiently to verify ownership. We persist SteamID hashes, device binding, App ID, release, and activation status to provide the license and prevent fraud.
The app computes a device identifier locally from stable hardware signals and sends only its hash, a hardware class, and the hash of a random installation key. Raw identifiers are not transmitted.
Component hashes, protocol version, release, observed Build ID, nonces, one-time challenges, temporary reservations, timestamps, and error codes help block tampering, replay, and concurrent activations.
The full edition keeps an encrypted full-system snapshot locally. The cloud stores only an encrypted snapshot of registry values required for recovery, plus metadata and integrity hashes.
Cloudflare and Google may process IP address, time, and technical metadata to deliver and protect the service. If you contact support, we process the message, contact address, and voluntarily supplied attachments.
04 · LEGAL BASES
Why processing is permitted
We process data necessary to perform the agreement and deliver purchased functions, including license verification, apply, and restore. Integrity, fraud prevention, service security, and legal defense rely on our legitimate interests within the product's reasonable expectations. We may also process data to comply with legal obligations where applicable.
05 · PROCESSORS AND TRANSFERS
Who handles the data
Distribution, authentication ticket, and ownership confirmation.
Worker execution, edge protection, and authorization delivery.
Temporary authentication and protected Firestore storage.
These providers may process information outside Brazil. We use only necessary services and appropriate technical and contractual safeguards. We do not share data for advertising or sell personal information.
06 · RETENTION AND DELETION
How long data remains
- Authorization tokens: short-lived, up to five minutes in production.
- Challenges, rate limits, and reservations: carry operational expiry in seconds or minutes and are intended for automatic cleanup. Physical TTL deletion may happen after logical expiry; during that interval, expired data no longer authorizes operations.
- Binding and encrypted snapshot: kept while needed to apply, restore, and prove the product binding. Unlink removes the binding and remote snapshot after restoration.
- Integrity configuration: does not directly identify a user and remains while a release must be validated or until revoked.
- Support: kept as needed to resolve the request and protect legal rights, then deleted or anonymized.
07 · SECURITY
How we protect information
The flow uses HTTPS, short-lived signed tokens, one-time challenges, key separation, restrictive Firestore client rules, a dedicated IAM identity for the Worker, domain-separated hashes, integrity checks, and authenticated AES-256-GCM snapshot encryption. Steamworks, Firebase, and signing private keys stay only in Worker secrets and never enter the application or depot.
No system is immune to incidents. If a material risk to individuals is identified, we will contain and investigate it and provide notices required by applicable law.
08 · YOUR RIGHTS
Access, correction, and control
Subject to applicable law, you may request confirmation, access, correction, sharing information, anonymization, restriction or deletion where appropriate, portability within regulatory limits, objection, and review of applicable automated decisions. We may request reasonable proof of identity and Steam ownership to protect the account.
For normal device removal, use Restore and then Unlink. If you no longer have the linked PC, use the direct channel below. Do not post a SteamID or proof of purchase in a public forum.
09 · CHANGES
Policy updates
We may update this policy to reflect technical, legal, or provider changes. The current version and effective date always appear at the top. Material changes will be highlighted in the product or on its Steam page when appropriate.