SC NOMADS · POLICIES

Privacy & your information

Practical information about your account, your choices and the community we are building.

Effective date: 2026-10-27. Published following owner approval.

Who operates SC Nomads

SC Nomads operator details and contact routes are listed on the Company information page.

What we use and why

SC Nomads uses account and community information to provide the features you request: signing in, saving a hangar, finding friends, contributing guides, exchanging messages, managing listings and receiving support. Optional fields can be left blank. Making information public is a separate choice from creating an account.

Account access

Nomads username, optional email and its verification state, scrypt password hash, hashed session tokens, sign-in/provider subjects, optional RSI identity evidence and authenticator information. Plaintext passwords are not stored. Authenticator secrets are encrypted; recovery codes are hashed.

Private account information. Selected verified RSI evidence may appear on a member page according to profile visibility.

Profile and hangar

Display name, biography, time zone, languages, game interests, optional experience/gender, friendship preference, ships, loadouts, profile links and tools.

Your selected visibility applies. A public ship still follows its parent profile and hangar restrictions. Discovery fields are self-reported.

Catalog wishlists and equipment kits

Wanted ship, equipment and atlas references, quantities and private wishlist notes; named kit plans, item variants, activity and patch notes, revision numbers, private prepared quantities and an optional link to your own hangar entry.

Catalog and equipment wishlists, their notes, shopping progress and hangar links stay private. A shared kit exposes only its plan and author attribution, subject to both kit and profile visibility, blocks and moderation. Saving equipment does not verify ownership.

Community contributions

Guide drafts and proposals, accepted revisions, review notes, organizations, schedules, images, captions, credits, listings, trade-contact intentions and submitted experiences.

Drafts and pending submissions follow their workspace permissions. Approved public contributions may be visible to visitors and search engines where public indexing is enabled.

Private communication

Friend and marketplace conversation messages, read markers, block relationships, support tickets, staff replies and in-app notifications.

Conversation participants or permitted support staff, subject to access checks. Staff moderation views expose reported messages rather than a general private-inbox browser. The service is not end-to-end encrypted.

Giveaway network review

Campaign entry requests use a campaign-specific HMAC network signal only when the deployment proxy is explicitly trusted. This feature stores no raw IP address. Missing signals and shared networks are flagged for owner review, never automatic household disqualification. Signals and review fingerprints expire after 90 days and are removed on the next giveaway management request. Hosting security logs are separate.

Restricted giveaway management. Public stream results show only an explicitly approved winner alias.

Safety and operations

Reports, restrictions, appeal/support context, moderation decisions, role assignments, audit events and bounded authentication/request limits. Hosting systems may also process network and security logs.

Restricted operational access. Infrastructure administrators can access stored data when operating or investigating the service.

Legal grounds and your choices

We process information necessary to provide requested account access, authentication, profile and community functions, and related support to perform the service agreement with you. We rely on legitimate interests for proportionate account security, abuse prevention, moderation and dispute handling, balancing these purposes against your rights and restricting access and retention. You may object to processing based on legitimate interests through the privacy contact below. Optional provider linking is initiated by your choice; it is not blanket consent for unrelated processing. Analytics, marketing and AI services are disabled. If optional analytics is introduced later, it requires a separate affirmative choice before collection. We do not claim an unspecified legal obligation as a general processing ground.

Optional analytics starts only after a separate positive choice. You can withdraw that choice through Cookie settings without losing access to the site. A refusal does not change your sign-in credentials. Email recovery is requested separately and does not subscribe you to marketing.

Who receives information

OVHcloud supplies the server infrastructure hosting SC Nomads. Combell supplies the existing account-email service. Optional Google, Discord and Twitch sign-in or account linking exchanges the identity information needed for the requested connection with the chosen provider. These providers also process information under their own privacy notices and are not presented as ordinary hosting processors. The operator keeps encrypted recovery copies on an operator-controlled PC. No separate cloud-backup service is used. Analytics, marketing and AI services are disabled. Access to private account, support and security information is restricted to the people and services that need it for these purposes.

Other visitors receive only content made accessible by its visibility rules. Message recipients receive the conversation you send to them. External links and downloads may take you to another operator. Their handling of data is separate from SC Nomads. This application has no advertising tracker or advertising-profile feature.

SC Nomads does not promise that all processing stays in Belgium or the European Economic Area. Optional Google, Discord and Twitch services operate internationally, including processing in the United States, under their own privacy and transfer notices. This notice does not claim a particular hosting or mailbox region, an executed contractual safeguard, or a specific transfer mechanism that has not been verified for the existing service arrangement. The operator can be contacted for available information about recipients and international processing. No separate cloud-backup provider is used.

How long information is kept

Removed equipment wishlist revision guards

Removing an equipment wish deletes its active wanted quantity and timestamps. A private account/item key and highest revision counter remain to prevent an older open tab from changing a later re-saved wish. The guard stores no quantity or notes. There is no automatic expiry for these guards; an authorized retention or rights review can assess their removal.

Sessions and temporary proofs

Sessions stop authorizing access at their stated expiry. Provider and second-factor challenges last at most 5 minutes; email verification lasts 30 minutes and password recovery 15 minutes. Expired records are cleaned during relevant later requests, not necessarily at the exact expiry second.

Public-page analytics

Daily path/count aggregates use a rolling 90-day reporting window. Older counts are deleted on the next collected view or administrator report. The counter does not retain an individual browsing history.

Profiles, contributions, communication and audits

These remain in the application database until an applicable user action or an authorized retention/rights review removes them. There is no general automatic account, message, support-ticket or audit purge currently implemented. Hiding content, closing a ticket or archiving a listing does not mean it was deleted.

Deleted equipment kits

Deleting a kit removes its active plan and private shopping state. Its random address remains reserved so an old shared link cannot identify a different kit. Existing reported snapshots and moderation evidence follow the safety and audit retention process.

Backups and infrastructure logs

The owner must confirm the actual backup schedule, deletion cycle, security-log period and any justified legal hold before public launch. This draft does not promise an unverified deletion deadline.

Owner-approved retention arrangements

We retain account and community information while needed to provide the requested service. The operator manually reviews account inactivity after 12 months and contacts or reviews the account before removal. Closed support matters and resolved disputes receive a necessity review after 90 days. Security and moderation evidence is reviewed for necessity every 90 days, with a deletion or anonymisation review after 12 months. An active incident or dispute may justify longer retention with a recorded reason and next review date. Public contributions are reviewed separately to preserve justified attribution while anonymising where feasible. These are manual review periods, not automatic deletion deadlines. There is no general automatic account, message, support or audit purge; hiding content, closing tickets or archiving listings does not erase them. Sessions and temporary verification challenges expire and are cleaned during relevant later requests. Consent preferences last 180 days. Application logs rotate by size, with at most three files of 10 MB; this is not a duration guarantee or a description of all host, proxy or provider logs. Encrypted recovery copies are held on an operator-controlled PC, with at most three validated sets; an oldest set is removed only after a new set succeeds. No fixed backup frequency is promised. Rights requests use the privacy contact below and are handled manually after proportionate identity verification. Requests cover relevant live data and the risk of data reappearing after restoration; removal from all backup copies is not immediate.

Access, correction, deletion and complaints

You can edit profile fields, visibility and other supported workspace records in the app. There is not yet a general self-service account export or account-erasure workflow. Contact the operator to request access, correction, erasure, restriction, portability or objection where those rights apply. Requests may require proportionate identity verification; do not send passwords or authenticator secrets.

Contact: Company information and contact

Rights may be subject to lawful exceptions, including other people’s rights and necessary legal records. If you believe personal data is handled unlawfully, you may complain to a competent data-protection authority. The Belgian authority is included below as a reference; this does not determine your jurisdiction.

Moderation, rankings and automation

Contribution ranks use eligible recorded activity and are separate from identity verification and trading experiences. Counts and badges are not a guarantee about a person. Reports can trigger temporary visibility restrictions pending review; reports are allegations, not established findings. Human reviewers can assess content and appeals through Support. Automated limits also help protect sign-in and prevent excessive requests.

Moderation notifications should identify the relevant action and next step without copying private reports or unrelated personal information. See the community rules for reporting and appeals.

Reference material and review

These sources inform the draft. They do not certify this site or replace the owner’s review of its actual operation and applicable obligations.

Implementation review: 14 October 2026. Policies must be reviewed again when the data use, providers or service changes.