Your data, plainly.

Last updated 9 September 2026

NEMO APP PTE. LTD., Singapore, operates Whack-a-Reset. We use data to save your game, verify scores, process payments, display sponsors and keep the service working.

What stays in your browser

Browser storage remembers game progress, recorded actions and a signed run token, sound and motion preferences, and your chosen player name. Test-mode scores may also be stored locally. Clearing this site’s browser data removes those local records and may erase your saved run. It does not delete a score or payment already sent to us.

The shared reset counter sends small batches containing a random batch identifier, a count and a creation time. Unsent batches may be saved locally for retry. They are removed after acknowledgement, or rejected when more than seven days old; old local batches are cleared when the game next checks them.

Scores and abuse prevention

If you submit a score, we receive your chosen name, recorded game actions, elapsed ticks and signed run token. We replay those actions to verify the result. The score record contains your name, optional X handle, verified score, run identifier and completion time. Your optional X handle is displayed as a public profile link. The top ten for a ruleset can be returned publicly; choose a nickname rather than sensitive personal information.

Our application does not deliberately retain the submitted action list or token as a separate score record. Requests still pass through our hosting provider. We use a keyed hash derived from your IP address to limit repeated requests. This is a security measure, not a promise of anonymity; hosting services may also process IP addresses and request logs.

An automated-interaction trap can disqualify that run and remove its posted score without banning other players on the same network. The disqualification flag expires two days after its latest trigger. A receipt identifying that run’s scoreboard entries expires two days after submission.

Payments and sponsorships

Stripe handles checkout and payment details. We receive payment status, amounts, currency, transaction identifiers and relevant metadata, including sponsor details where supplied. Our game does not receive or store your full card number. Stripe may collect contact, billing and fraud-prevention information under its privacy policy.

Sponsor URLs, messages chosen as public and credited amounts are published after payment confirmation. Private sponsor notes remain visible only to the owner. The owner can hide a listing. Payment references, credited balances and refund or dispute adjustments help us prevent duplicate credit and maintain accurate records. Do not put private or sensitive information in a sponsor URL.

If you add an optional name or message to a support payment, we send it to Stripe as payment metadata and store it with the credited amount. Notes are private by default. If you choose public, your name, note and credited amount appear after payment confirmation. Private notes remain visible only to the owner. The owner can hide a public note without changing its payment record or the support total. Do not include sensitive information in a public note. Names and messages are retained without automatic expiry; contact us to request a correction or removal.

Traffic measurement and fonts

The production game is configured for Vercel Web Analytics to understand page visits, broad device and location information, and referrals. It uses no analytics cookies. Before sending page-view events, our code removes query strings and URL fragments and excludes owner, API and design-preview routes. It sends no custom events containing player names, replay tokens or payment details. Collection requires the service to be enabled and the updated site to be deployed; this notice does not establish that collection is active on every visit. See Vercel's analytics privacy information.

Separately, the game's visitor and online counters use a random identifier saved in your browser. The server remembers whether that identifier has visited before and counts recent heartbeats as online for up to 90 seconds. These are browser counts, not verified counts of individual people; clearing browser storage can create a new identifier. The aggregate visitor count and previously seen identifiers have no automatic expiry. Requests are also rate-limited using a keyed IP hash.

The site loads its Nunito font from Google Fonts. Your browser contacts Google’s font servers, which receive connection information such as your IP address. See Google’s privacy policy.

Providers and purposes

Vercel provides hosting, Upstash Redis provides application storage, and Stripe processes payments. They receive information needed to provide their services. We may also disclose necessary records to handle legal obligations, fraud, disputes or the protection of people and the service. We do not sell player data.

We process information to deliver the features you request, administer payments, protect the service and understand its use, relying on consent or other grounds available under applicable law. Providers may process data outside Singapore. Applicable cross-border data-protection requirements continue to apply.

How long records remain

• Rate-limit keys expire after two minutes. Duplicate score-submission markers expire after two days. Run tokens are valid for up to one day; validity is separate from deletion of a saved browser record.
• Reset-counter duplicate markers expire after eight days. The aggregate reset total remains to keep the shared counter running.
• Each ruleset’s score list is limited to ten entries, but the list has no automatic time-based expiry. Old ruleset lists and sponsorship or payment records require deletion or review rather than an automatic expiry.
• New unpaid sponsor submissions expire from application storage after 90 days. Once payment is recorded, their automatic expiry is removed so later refunds, disputes and review can be reconciled. Older submissions created before this expiry rule are not automatically removed.
• We retain records as needed for the service, accounting, fraud prevention and legal obligations, then delete or de-identify personal data when those purposes no longer require it. Provider logs and payment records follow the relevant provider’s retention arrangements; we do not promise one universal deletion period.

Your choices and requests

You can play without submitting a public name or making a payment. Clear browser storage to remove local saves and preferences. To request access, correction, deletion where applicable, or withdraw consent, ahoy@nemoboat.app: NEMO APP PTE. LTD., Singapore. Tell us which score, sponsor link or transaction is involved. We may need to verify your authority before acting; legal recordkeeping requirements may limit deletion, and withdrawal may affect the features we can provide.

Please do not submit children’s personal information or sensitive information through player names or sponsor links. A parent or guardian can contact us about information a child has submitted. You may raise an unresolved privacy concern with Singapore’s Personal Data Protection Commission, or the relevant authority where you live.

Updates

We will update this notice when our practices change and show the revised date here. Material new uses of personal data will be communicated, with consent obtained where required.