NullBound — Privacy Policy

This Privacy Policy describes how Signal and Echo (“we”, “our”, “us”) handles information in connection with the video game NullBound: The Last Signal (“NullBound”) and the website signalandecho.com (collectively, the “Service”). It applies to data collected on or after the date above.

If you do not agree with the practices described here, do not install or use the Service.

1. Who we are

NullBound is developed and published by Signal and Echo, a solo indie studio.

Contact: privacy@signalandecho.com
Website: https://signalandecho.com
For urgent matters, you may also reach us on Discord or Bluesky.

2. What we collect, and why

We collect as little as we can get away with. This section is an exhaustive list of every data path in NullBound.

2.1 Save data (stored locally on your device)

What: your in-game profile — stats, unlocked content, settings, run history.
Where: written to your operating system’s standard user data directory (%APPDATA% on Windows, ~/Library/Application Support on macOS, ~/.local/share on Linux).
Sync: if you play via Steam, this data syncs to your Steam account via Steam Cloud — Valve’s privacy policy governs that storage. See Valve’s privacy policy.
Why: to preserve your game progress across sessions and devices.
How to delete: delete the save directory, or uninstall the game.

2.2 Crash reports (stored locally by default)

What: when the game crashes, we write a crash log to user://crash_logs/ on your device containing: stack trace, Godot engine version, NullBound build version, operating system name + version, and a snapshot of in-game state at the time of the crash (current menu/room type, player level, player health, run seed). Crash logs do not contain any personal information, IP addresses, save data, or file paths outside the game’s data directory.
Transmission: crash logs are not transmitted automatically. If you contact us for support and voluntarily send us a crash log, we handle it per this policy.
Retention: stored on your device; the game rotates the oldest logs after 20 are kept.
Why: to diagnose bugs and improve stability.

2.3 Opt-in telemetry (only if you enable it)

What: if and only if you toggle Settings → Telemetry to enabled, NullBound sends anonymized gameplay events to our telemetry endpoint. Events include: run start/end, run duration, cause of death, game version, platform (OS), protocol used, dungeon tier reached, a random per-install session ID.
What it does not contain: your name, email, IP address, account identifiers, file paths, hardware IDs, or any data that identifies you personally.
Transmission: batched and sent at the end of each play session via HTTPS.
Retention: 24 months. After 24 months, events are aggregated to anonymized statistics and the individual event records are deleted.
Why: to understand where players struggle, which protocols are underused, and where balance needs tuning. This directly feeds the game’s patch notes.
Consent: opt-in only. Default is off. You can disable telemetry at any time in Settings, and retroactively request deletion of your session ID’s events by emailing [email protected].

2.4 In-game feedback (only if you submit it)

What: if you use the in-game “Send Feedback” form, the text you write is transmitted to a private developer channel, along with your current game version, platform, and in-game state at the time of submission.
What it does not contain: your Steam ID, email, IP address, or any data you didn’t type yourself. If you include identifying information in the feedback text itself (e.g., “my name is X”), that information is transmitted because you chose to include it.
Retention: feedback is retained indefinitely as part of our development record.
Why: to receive bug reports and design feedback directly without forcing you to leave the game.

2.5 Website analytics (signalandecho.com and nullbound.signalandecho.com)

What: the websites use Cloudflare Web Analytics, which is cookieless and does not use unique identifiers. Aggregated metrics — page views, referrer, country-level geography, browser — are collected without linking to individual visitors.
Transmission: handled by Cloudflare. See Cloudflare’s privacy policy.
Retention: 6 months at the analytics endpoint, aggregated statistics retained longer.
Why: to understand which content drives traffic and improve the site.

2.6 Steam-mediated data

When you purchase or play NullBound via Steam, Valve operates the storefront, payment processing, account system, achievement tracking, and cloud saves. Data you share with Valve (email, payment info, Steam ID, playtime statistics, achievement progress) is governed by Valve’s privacy policy, not this one. We do not receive your email address, payment information, or Steam ID from Valve.

If you choose to share your Steam profile link in community posts, Discord, or similar, that data is shared voluntarily and not governed by this policy.

3. What we do not collect

For absolute clarity, NullBound does not:

Collect your real name, email, or contact information (unless you voluntarily email us).
Use cookies or tracking pixels in-game.
Collect your IP address in-game (our telemetry strips it at ingress).
Use advertising networks or third-party ad SDKs.
Sell, rent, or share data with third parties for marketing purposes.
Track you across other games or services.
Collect data from children under 13 (the game is not directed at children under 13, and complies with COPPA).

4. How we store data

Data transmitted to our servers (opt-in telemetry, feedback) travels over HTTPS (TLS 1.2+).
Storage is managed on Cloudflare infrastructure, with server locations in the United States.
Access is limited to Signal and Echo operators. There are no third-party data processors beyond Cloudflare (infrastructure) and Valve (storefront).
We do not maintain a user database tied to real identities. There is no login, no account, no password.

5. Your rights

Depending on your jurisdiction, you have the following rights regarding your data:

Right of access: request a copy of any data we hold about you.
Right to rectification: request correction of inaccurate data.
Right to erasure: request deletion. For opt-in telemetry, provide your per-install session ID (visible in game logs if needed) and we will delete matching records.
Right to restriction: ask us to stop processing your data while a dispute is resolved.
Right to data portability: request your data in a machine-readable format.
Right to object: object to processing based on legitimate interest (we rely on consent, so this is mostly covered by the erasure right).
Right to lodge a complaint: with your national data protection authority.

Lawful basis: consent for opt-in telemetry, performance of contract for save data and Steam-mediated purchases, legitimate interest for crash reports (not transmitted by default) and website analytics (aggregate only).

5.2 CCPA / CPRA (California residents)

Right to know: what personal information we collect (described in Section 2).
Right to delete: request deletion (same process as GDPR erasure).
Right to opt-out of sale: not applicable — we do not sell personal information.
Right to non-discrimination: we will not deny service or charge different prices for exercising your rights.

5.3 Other jurisdictions

If you reside in a jurisdiction with data protection laws beyond GDPR and CCPA (Brazil LGPD, Canada PIPEDA, etc.), contact us and we will handle your request under the applicable framework.

5.4 How to exercise your rights

Email [email protected] with your request. Identifying a telemetry session ID helps us locate records; we may ask for additional information to verify your identity. We will respond within 30 days.

6. Data retention

Data	Retention
Save data	On your device until you delete it
Crash logs	On your device; oldest rotated after 20 kept
Opt-in telemetry events	24 months, then aggregated and individual records deleted
Feedback submissions	Indefinitely, as part of our development record
Website analytics	6 months at the endpoint, longer as aggregate
Email you voluntarily send us	As long as the matter remains active, then archived

7. International transfers

NullBound operates globally. If you are outside the United States, your opt-in telemetry and feedback data may be transferred to the US for processing. We rely on Cloudflare’s Standard Contractual Clauses for EU → US data transfers.

8. Changes to this policy

We may update this policy to reflect changes in the game, the law, or our practices. Material changes will be communicated via:

Steam Announcements
The Discord #announcements channel
The “Last updated” date at the top of this document

Continued use of the Service after a change constitutes acceptance of the revised policy.

Privacy Policy