Privacy policy
Last updated: October 18, 2026
1. Who we are
Nopilas is a free, ad-free space strategy game, played in the browser or in its phone app, published by InnoLogiciel Inc. (“we”). This policy covers the showcase site nopilas.online, the game at app.nopilas.online and the Nopilas app for iPhone and Android. It describes, in plain words, which personal information we collect, why, and what your rights are, in accordance with Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25.
2. Person in charge of the protection of personal information
Frédéric Coutu, president — person in charge of the protection of personal information
InnoLogiciel Inc.
53, 17e Avenue, Drummondville (Québec) J2B 3J5, Canada
Email: [email protected]
Phone: 873-657-3156
3. Information we collect
3.1 Your game account
To create a planet, the game asks for a username, an email address and a password. The password is stored hashed: nobody, not even us, can read it. The email is used to give you back access to your account: if you forget your password, the game sends a link to that address, at your request, valid for one hour, to choose a new one. It may also be used, if needed, to reach you about your account. We do not ask for your real name, your date of birth or your address.
3.2 What you do in the game
Your planet, buildings, squadrons, battle reports, mail messages, forum posts and posts on the home page's “public message” are kept for as long as your account exists. Your username, alliance, position on the map and score are visible to other players: that is the game. What you write on the forum and in the public message is public.
3.3 Contact form
When you write to us through the showcase site's Contact page, we collect your name, email address, phone number (optional), subject and message. You provide them voluntarily.
To keep out robots that send spam and phishing, this form uses Cloudflare Turnstile, a service of Cloudflare, Inc. (United States). While you fill it in, Turnstile receives technical signals from your browser (IP address, browser type, connection characteristics). They are used only to check that a person is writing and to improve Cloudflare's robot detection, never to identify, profile or target you. See the Turnstile privacy addendum.
3.4 Technical logs
Like any website, our servers automatically keep logs: IP address, pages visited, date and time, browser type. They are used for security and diagnostics, then recycled according to the host's rotation cycle.
3.5 The phone app and its alerts
The Nopilas app for iPhone and Android uses the same account as the game in the browser. It keeps your session token in the phone's secure storage (the iOS Keychain, the Android Keystore) and your language in its settings. It contains no advertising and no audience measurement.
Alerts. If you allow the app to send you notifications, your phone gives it a notification token: a string of characters that lets a message reach that phone, and says nothing else about you. We keep it with the type of phone (iPhone or Android), the app's language and the alerts you chose (attack on its way, combat, mail, famine), linked to your account. It is used only to send you those alerts. You can turn each alert off in the app's Preferences, or all notifications in the phone's settings.
3.6 Where your sign-up came from
When you create your account in the browser, we note how you found Nopilas: the site that brought you (for example “google.com” or a game directory, never the full address of the page), the campaign if you followed a link from our posts (the address's utm_ parameters), and the first page you saw. To do so, the showcase site keeps these three items for the length of your visit and adds them to its links to the game; the game keeps them in your browser for 30 days at most, sends them with your sign-up, then deletes them. They are then kept with your account and deleted with it. They contain neither your IP address nor any identifier: they cannot be used to recognize you from one site to another, and they go through no third party. They are used only to know how players find us, and only the game's administrator sees them.
3.7 Reports, blocks and rules of conduct
By creating an account, you accept the game's rules of conduct; we note the date of that acceptance.
Reporting. You can report a forum post, a mail you received, a board message or a player. We then keep your username, the reported player's username, the reason you give and a copy of the reported message, as it was when reported. For a mail, you, its recipient, choose to show it: nobody else can report it. Only the administrator reads reports; the reported player does not learn who reported them.
Blocking. You can block a player: we keep who blocked whom. Their mail no longer reaches you, which they learn only if they try to write to you, and their forum and board messages fold away for you.
4. Cookies and local storage
The showcase site and the game measure their audience with Google Analytics 4, and only if you accept. On your first visit, a banner at the bottom of the page asks for your choice: until you accept, or if you decline, no analytics cookie is set and nothing is sent to Google. You can change your mind at any time through the “Manage cookies” link at the bottom of every page of the showcase site, and in the game through the “Cookies” link on the home page or the “Cookies” section of your preferences. What we measure: pages viewed, where visits come from (search engine, link, direct access), device and browser, buttons clicked (for example “Play” or “Create my planet”) and, in the game, pages visited, sign-ups and logins — never your username or email. When you go from the showcase site to the game, a _gl parameter added to the address links the two visits, so we know a sign-up came from the showcase site; it carries no personal information. This data is processed by Google LLC (United States) under Google's terms; Google Analytics 4 does not store IP addresses, and we keep the data for 14 months. It is not used for advertising and is never matched with your game account. The phone app does not measure its audience, not even in the 3D replay of a battle that it opens in a web view: it declines audience measurement there in advance.
Cookieless audience measurement (Matomo). The showcase site and the game also count their visits with Matomo, a tool we host ourselves in Canada (Web Hosting Canada, Montréal): this data goes through no third party. Matomo sets no cookie and keeps no identifier on your device; your IP address is truncated (its last two bytes erased) before it is recorded, so it can neither identify you nor recognize you from one visit to the next. What it counts: pages viewed, where visits come from (search engine, site, campaign), country, type of device and browser, buttons clicked and sign-ups. These figures are used only for overall statistics, are never matched with any account, and the raw data is deleted after 14 months. Because this measurement neither identifies nor follows you, it does not go through the cookie banner; the phone app does not take part in it.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
tarteaucitron | showcase site | remembers your choice in the cookie banner | 1 year |
nopilas.consentement | game (local storage) | remembers your choice in the game's cookie banner | until you clear it |
_ga, _ga_* | showcase site and game, each on its own address, only after your consent | Google Analytics: tells visitors apart with a random identifier, without name or email | 2 years |
csrftoken | showcase site | protects forms against forged submissions | 1 year |
django_language | showcase site | remembers the language you chose | 1 year |
sessionid | showcase site | technical session, created only after a language switch or a form submission | 1 hour |
| session token | game (browser local storage, not a cookie) | keeps you signed in to your planet | until sign-out or token expiry |
| language | game (local storage) | remembers the game's language | until you clear it |
origine.visite (showcase), nopilas.origine (game) | showcase site (session storage) and game (local storage), before sign-up only | where your visit came from, sent with your sign-up (section 3.6) | the visit on the showcase site; 30 days at most in the game, deleted at sign-up |
| session token | phone app (the phone's secure storage) | keeps you signed in to your planet | until sign-out or token expiry |
You can clear these at any time in your browser settings, and withdraw your consent to audience measurement through the “Manage cookies” link (showcase site) or the “Cookies” link and preferences section (game): the Google Analytics cookies are then deleted.
5. Why we use this information
- to run the game: your planet, your orders, your exchanges with other players;
- to give you back access to your account and let you manage it;
- to send the alerts you chose to your phone, if you allowed it;
- to know how players find Nopilas (section 3.6);
- to answer your messages and follow up on them;
- to handle reports and enforce the rules of conduct;
- to keep the site and the game secure and working, and to enforce its rules (one player, one planet).
We do not use your information for any other purpose. We send no promotional email, and we make no automated decision about you other than through the game's rules, which are the same for everyone.
6. Sharing and hosting
We never sell, rent or share your personal information. It is accessible only to the people at InnoLogiciel who administer the game or handle your request.
The showcase site and its database are hosted in Canada (Web Hosting Canada, Montréal). The game and its database are hosted in Canada (OVH, Beauharnois, Québec). Both are protected by Cloudflare: requests pass through its network, which may involve processing your IP address outside Québec. No account information is communicated to Cloudflare beyond that transit.
The game's emails (the password reset link) are sent from [email protected], a mailbox hosted in Canada by Web Hosting Canada.
The app's alerts go through Firebase Cloud Messaging (Google LLC, United States) and, on iPhone, through Apple's notification service (Apple Inc., United States): to deliver an alert, we send them your phone's notification token and the text of the alert, for example the name of the player attacking you. This processing takes place outside Québec. They receive neither your email nor your password.
7. Our YouTube channel and YouTube API Services
We publish videos of Nopilas on our own YouTube channel, @nopilas.online. Our internal publishing tool, InnoLogiciel Promo, uses YouTube API Services to upload these videos to that channel. When you watch or interact with our videos on YouTube, you are bound by the YouTube Terms of Service, and Google handles your information as described in the Google Privacy Policy.
The tool signs in only with our own Google account, and it has only one permission: uploading videos to our channel. It does not access, collect, store, use or share any information about you or any other YouTube user or channel, and it places no cookies or other data on your device. All it keeps is the sign-in authorization for our own account. That authorization can be revoked at any time on the Google security settings page, https://security.google.com/settings/security/permissions. The same page lets you revoke any access you have given to an application with your own Google account.
For questions about these practices, contact the person named in section 2.
8. Retention
- Game account: kept as long as the account exists. You can delete it yourself at any time (see below).
- Phone notification token: erased when you sign out of the app, change your password, delete your account, or as soon as Google tells us it no longer works.
- Contact messages: deleted automatically after 24 months.
- Technical logs: according to the host's rotation cycle, generally a few weeks.
- Reports: kept for one year after the administrator's decision, then deleted automatically; a report still open stays until it is settled.
- Blocks: as long as both accounts exist; you can unblock a player at any time in your preferences.
- Backups: the game's database is backed up every night, and each backup is kept for 14 days.
Delete your account
You can delete your Nopilas account yourself, at any time:
- In the phone app: menu → Preferences → Delete my account, enter your password, then confirm.
- In the browser: sign in at app.nopilas.online, open Preferences → Delete my account, enter your password, then confirm.
- By email: if you can no longer access your account, write to [email protected] from the account's email address, with your username. We delete it within 30 days.
Deletion is immediate and permanent. Erased: your account (username, email, hashed password), your planet and everything on it, the mail you received, your history and battle reports, your phones' notification tokens, your blocks, and the reports you made or that concerned you; you also leave your alliance. Still published under your username: your forum posts, and the mail you sent, in its recipients' mailboxes. Ask the person in charge to remove them if you wish. Database backups that still contain your account disappear after 14 days.
9. Your rights
Under Law 25, you may:
- access the personal information we hold about you, and obtain a copy;
- have it corrected if it is inaccurate or incomplete;
- request its deletion, or delete your account yourself;
- withdraw your consent at any time;
- be informed of any confidentiality incident concerning you.
Write to the person identified in section 2; we will answer within 30 days.
10. Minors
The game is not designed for children under 14, and we do not knowingly collect information about them. If you learn that a child under 14 has created an account without the consent of the person holding parental authority, write to us: the account will be deleted.
11. Security
Exchanges with the site and the game are encrypted (HTTPS). Passwords are hashed. Administrative access is restricted and logged. Any confidentiality incident presenting a risk of serious injury is recorded in our incident register and reported to the Commission d'accès à l'information and to the people concerned, as the law requires.
12. Changes
We may update this policy as needed. The current, dated version is always published on this page; an important change is announced in the administrator's messages, inside the game.
13. Complaints
If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).