VagrantCrown Privacy Policy (effective October 20, 2026, r11)

VagrantCrown Privacy Policy

This is the previous version of the Privacy Policy (effective October 20, 2026). From November 1, 2026 (at the end of the maintenance), the revised Privacy Policy applies.

This translation is provided for reference only. If there is any discrepancy between this translation and the Japanese original, the Japanese original prevails.

Last updated: October 20, 2026

Article 1 (Introduction)

Nexlim Inc. (hereinafter referred to as "we") handles information about Users obtained through the browser game "VagrantCrown" (hereinafter referred to as "the Service") in accordance with this Privacy Policy (hereinafter referred to as "this Policy").

The Service is designed so that it can be played immediately without registering an account. Accordingly, even if you do not create an account, some of the information described below is recorded automatically. This Policy also covers that scope.

Article 2 (Information We Collect)

The information we collect and store through the Service is as follows. We do not collect any other information (such as addresses, telephone numbers, names, or dates of birth). In addition, information obtained through access analytics tools, behavior analytics tools, ad delivery, and ad performance measurement is described in Article 8.

(1) Information collected even without account registration

(2) Information collected when you create or link an account

We request only information within the scopes of identify and email from Discord, and openid, email, and profile from Google. We do not access friend lists, posts, contacts, calendars, or the like.

(3) Information collected when you use paid services

Credit card numbers, expiration dates, security codes, and other payment information are collected and managed directly by the payment service provider (Stripe, Inc.), and we do not collect or store them. For the handling of payment information, please refer to the privacy policy established by that payment service provider.

(4) Information recorded for security purposes

(5) Information we do not collect

We do not collect the following information through the Service.

• IP addresses themselves (only hashed values are stored)
• Names, addresses, telephone numbers, and dates of birth
• Credit card numbers and other payment information (collected directly by the payment service provider; see the preceding item)
• Location information (via the device's location features), device contacts, and access to the camera, microphone, etc. For the approximate region estimated from IP addresses in access analytics, please see Article 8

Article 3 (Purposes of Use)

Information collected will be used only within the scope of the following purposes.

1. Providing the Service, and saving and restoring game data
2. Identifying Users and maintaining login status
3. Providing paid services, processing payments, granting purchased paid items, and managing purchase history
4. Responding to refunds, cancellations, and other requests relating to purchases (including requests to cancel charges made by minors)
5. Retaining accounting and tax records in accordance with laws and regulations
6. Detecting and preventing unauthorized access, unauthorized use, mass registrations for mischievous purposes, and fraudulent use of payment methods
7. Verifying compliance with the prohibition on multiple accounts and responding to declarations of shared connection use
8. Email address verification, password resets, and notification of password changes
9. Responding to violations of the Terms of Service (including suspension of use)
10. Responding to inquiries
11. Investigating defects and improving the Service
12. Statistical understanding of usage (conducted in a form that does not identify individuals)
13. Sending notices regarding the Service (including notices of important changes, outages, maintenance, and termination of the Service) to registered contact addresses
14. Sending information about the Service and notices encouraging resumption to Users who have not used the Service for a certain period (which may be stopped at any time by the methods set forth in Article 14)

Article 4 (Retention Periods)

Deletion is executed automatically with a certain probability, triggered by access to the Service (all communications from the game screen). Therefore, actual deletion may occur slightly after the periods stated above.

Article 5 (Use of Cookies)

1. The Service uses essential cookies to maintain login status and game data for guest play.

2. These cookies are set with the HttpOnly, Secure, and SameSite=Lax attributes and cannot be read by JavaScript.
3. In addition to the cookies described in the preceding paragraphs, the Service uses the following cookies set by an access analytics tool (Google Analytics) in order to understand usage statistically. The information collected and the method for opting out are described in Article 8.

4. In addition to the cookies described in the preceding paragraphs, the Service uses cookies set by Google AdSense and by third-party vendors participating in its advertising network, for the purpose of delivering ads. The information obtained through these cookies, and the methods for disabling ads based on Users' interests (personalized ads), are described in Article 8.
5. In the course of payment procedures, the payment service provider may use cookies and similar technologies to prevent fraudulent use. Their handling is governed by that provider's privacy policy.
6. Cookies can be deleted through your browser settings; however, if deleted, you will no longer be able to access game data from guest play (it cannot be recovered).
7. In addition to the cookies described in paragraphs 3 and 4, the Service uses the following cookies set by a behavior analytics tool (Microsoft Clarity) in order to improve usability. These cookies are used only on the screens described in Article 8, paragraph 16. The information collected and the method for opting out are described in Article 8.

8. In addition to the cookies described in each of the preceding paragraphs, the Service uses the following cookies set by X Corp.'s advertising tag (X Pixel) for the purposes of measuring ad performance and optimizing ad delivery. The information collected and the method for opting out are described in Article 8.

Article 6 (Information Disclosed to Other Users)

In the Service, the following information is viewable by other Users.

• Player display name
• Self-introduction
• Records displayed in the rankings (Guild Board)

Email addresses, hash values of IP addresses, browser information, and purchase history are never disclosed to other Users.

Display names and self-introductions are entered by Users themselves. Please take care not to enter your name or other information that could identify you, or information you do not wish others to know.

Article 7 (Provision to Third Parties and Use of External Services)

1. We will not provide information collected to third parties except in the following cases.
   • Where the User has consented
   • Where required by laws and regulations, or where a lawful request is received from a public authority such as a court or the police
   • Where it is necessary for the protection of the life, body, or property of a person and it is difficult to obtain the consent of the person concerned
2. We use the following external services to operate the Service, and entrust the handling of information to them within that scope.

3. In connection with the preceding paragraph, Users' information is transferred outside Japan. For the handling of information by each provider, please refer to the privacy policy established by each provider.

Article 8 (Advertising and Analytics Tools)

1. The Service displays third-party ads using "Google AdSense," an ad delivery service provided by Google LLC. Third-party vendors, including Google, use cookies to serve ads based on Users' prior visits to the Service or other websites. The information obtained in connection with ad delivery, and the methods for disabling personalized ads, are described in paragraphs 11 through 14.
2. The Service uses "Google Analytics" (GA4), an access analytics tool provided by Google LLC, to understand usage. This tool collects information using the cookies described in Article 5, paragraph 3, in a form that does not identify Users as individuals.
3. The information collected by Google Analytics is as follows.

4. We do not send player display names, email addresses, User identifiers within the Service, or any other information that could identify individuals to Google Analytics. We also do not use the feature that links logged-in Users with analytics records (the User-ID feature).
5. The information described in the preceding two paragraphs is used only for the purposes set forth in Article 3, item 11 (investigating defects and improving the Service) and item 12 (statistical understanding of usage).
6. The information collected is sent to Google LLC (United States) and handled in accordance with the terms established by that company. For details, please see the following.
   • Google Privacy Policy: https://policies.google.com/privacy
   • About data use in Google Analytics (How Google uses information from sites or apps that use its services): https://policies.google.com/technologies/partner-sites
7. The retention period for User data in Google Analytics is 14 months. Information for which this period has elapsed is deleted by Google (Article 4).
8. Users can stop the collection of information by Google Analytics by any of the following methods. Stopping it does not affect your use of the Service.
   • Installing the "Google Analytics Opt-out Browser Add-on" provided by Google in your browser: https://tools.google.com/dlpage/gaoptout/
   • Deleting cookies or refusing to accept them through your browser settings (please note that in this case, as described in Article 5, paragraph 6, you will no longer be able to access game data from guest play)
   • Using the tracking prevention features provided by your browser
9. We may temporarily record identifiers in a form that does not identify individuals in order to determine the number of concurrent users of the Service.
10. If we change the analytics tools described in each of the preceding paragraphs or add other analytics tools, we will revise this Policy to describe the information collected and the method for opting out, and will give notice on the Service.
11. Through the use of the ad delivery cookies described in paragraph 1, Google and its partners may display ads to Users based on their visits to the Service and other sites on the Internet. The provider we use for ad delivery is Google LLC (Google AdSense), and that company may provide ad space to third-party ad vendors participating in its advertising network.
12. We do not provide player display names, email addresses, User identifiers within the Service, or any other information that could identify individuals to ad delivery providers. Ads are displayed to cover the operating costs of the Service, and we do not sell Users' information to third parties for the purpose of displaying ads.
13. Users can disable personalized ads by any of the following methods. Even if disabled, ads will continue to be displayed, but they will no longer be based on the User's interests.
    • Turning off personalized ads in Google's Ad Settings: https://www.google.com/settings/ads
    • Disabling personalized ads by third-party vendors collectively (the DAA mechanism): https://www.aboutads.info
    • Deleting cookies or refusing to accept them through your browser settings (please note that in this case, as described in Article 5, paragraph 6, you will no longer be able to access game data from guest play)
14. For how Google uses information in ad delivery, please see the following.
    • How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites
    • Google Privacy Policy: https://policies.google.com/privacy
15. The Service uses "Microsoft Clarity," a behavior analytics tool provided by Microsoft Corporation, to improve usability. This tool uses the cookies described in Article 5, paragraph 7 to record interactions on the screens of the Service, and enables us to replay or view those records in aggregate.
16. We use Microsoft Clarity only on the Service's introduction page (/lp) and on the game screens of Users within 7 days of account creation (including guest play accounts). We do not use it on the administrative screens for the operator, the screens for email address verification and password reset, or the pages of this Policy and other terms and policies.
17. The information collected by Microsoft Clarity is as follows.

18. We do not send player display names, email addresses, User identifiers within the Service, or any other information that could identify individuals to Microsoft Clarity. We also do not use the feature for specifying identifiers to link records with Users. In addition, the main areas of the screens that display display names, names of companions, chat messages, rankings, mail, profiles, inquiries, and payment-related information are configured to be recorded with their contents masked so that such contents are not sent to Microsoft (content entered into input fields is not recorded, in accordance with the specifications of that tool).
19. The information described in the preceding two paragraphs is used only for the purposes set forth in Article 3, item 11 (investigating defects and improving the Service) and item 12 (statistical understanding of usage).
20. The information collected is sent to Microsoft Corporation (United States) and handled in accordance with the terms established by that company. For details, please see the following.
    • Microsoft Privacy Statement: https://www.microsoft.com/privacy/privacystatement
    • Microsoft Clarity Terms of Use: https://clarity.microsoft.com/terms
21. Records of interactions in Microsoft Clarity are retained for 30 days from the time of recording. However, records that we have marked for retention and records randomly sampled by Microsoft are retained for up to 9 months (Article 4).
22. Users can stop the collection of information by Microsoft Clarity by any of the following methods. Stopping it does not affect your use of the Service. Please note that Microsoft Clarity does not support the browser "Do Not Track" setting.
    • Selecting "Microsoft" in the opt-out mechanism for third-party vendors (the DAA mechanism): https://optout.aboutads.info/
    • Enabling the "Global Privacy Control" setting in your browser
23. The Service uses an advertising tag (X Pixel) provided by X Corp. for the purposes of measuring the performance of ads placed on X (formerly Twitter) and optimizing ad delivery. This tag uses the cookies described in Article 5, paragraph 8 to enable X Corp. to determine whether browsing of the Service and actions such as account registration originated from ads on X.
24. We use X Pixel only on the Service's introduction page (/lp) and the game screens. We do not use it on the administrative screens for the operator, the screens for email address verification and password reset, or the pages of this Policy and other terms and policies.
25. The information sent to X Corp. by X Pixel is as follows.

26. We do not send player display names, email addresses (including their hash values), User identifiers within the Service, or any other information that could identify individuals to X Corp.
27. The information described in the preceding two paragraphs is used only for the purposes of measuring ad performance and optimizing ad delivery.
28. The information collected is sent to X Corp. (United States) and handled in accordance with the terms established by that company. For details, please see the following.
    • X Privacy Policy: https://x.com/privacy
29. Users can stop the use of information obtained by X Pixel for advertising by any of the following methods. Stopping it does not affect your use of the Service.
    • Disabling personalized ads under "Ad preferences" in "Privacy and safety" in X's "Settings and privacy": https://x.com/settings/ads_preferences
    • Using the opt-out mechanism for third-party vendors (the DAA mechanism) (available even when you are not logged in to X): https://optout.aboutads.info/
    • Deleting cookies or refusing to accept them through your browser settings (please note that in this case, as described in Article 5, paragraph 6, you will no longer be able to access game data from guest play)

Article 9 (Security Control Measures)

We take the following measures for the secure management of information collected.

1. Encryption of communications (HTTPS)
2. One-way hashing of passwords (PBKDF2-SHA-256, 100,000 iterations, with a per-User salt)
3. Hashing of IP addresses (using a secret salt, without storing the original IP address)
4. Storage of session tokens in hashed form (raw values are not stored in the database)
5. Limits on the number of login attempts and on the number of new registrations
6. Adoption of a configuration in which payment information is not held in our systems but entrusted to the payment service provider
7. Recording of audit logs of operations performed by the operator
8. Limiting the granting of administrative privileges to direct database operations

Please note that absolute security cannot be guaranteed for the transmission, reception, and storage of information over the Internet.

Article 10 (Requests for Disclosure, Correction, or Deletion, and Withdrawal)

1. Users may request disclosure, correction, suspension of use, or deletion of their own information held by us.
2. Please submit requests to the contact point set forth in Article 11. We will respond within a reasonable period after verifying your identity.
3. Once an account and game data have been deleted, they cannot be restored. No refunds will be made for purchased paid items either (Article 10 of the Terms of Service).
4. Even after deletion, we may retain some records (such as purchase history and audit logs) to the extent necessary for the prevention of fraudulent conduct, compliance with laws and regulations (including the retention of accounting and tax records), and other legitimate purposes.
5. Withdrawal (deletion of your account) can also be performed from the withdrawal procedure screen within the Service.
6. Display names, self-introductions, and part of the game data can be changed by you from screens within the Service.

Article 11 (Contact Point)

For inquiries regarding this Policy and the handling of information, and for requests for disclosure and the like, please contact the following contact point.

• Business operator: Nexlim Inc.
• Contact: games_contact@nexlim.co.jp

Article 12 (Use by Minors)

1. The Service does not have any means of verifying age. Minors should use the Service after obtaining the consent of their legal representative (parent or guardian).
2. When a minor uses paid services, they must obtain the consent of their legal representative each time. For purchases made without such consent, the legal representative should contact the contact point set forth in Article 11 (Article 4 of the Terms of Service).
3. When we are contacted by a legal representative regarding the disclosure or deletion of a child's information, we will respond after verifying the identity of the person concerned and of the legal representative.

Article 13 (Changes to this Policy)

1. We may revise this Policy in response to changes in laws and regulations or changes in the content of the Service.
2. The revised Policy takes effect from the time it is posted on the Service. In the case of important changes, we will give notice on the Service.

Article 14 (Sending and Stopping Emails)

1. We send the following emails to the registered contact address (email address).

2. The "Notices" and "Resumption information" described in the preceding paragraph can be stopped at any time by either of the following methods. Stopping them does not affect your use of the Service.
   • Opening the unsubscribe link provided at the end of the relevant email (no login is required)
   • Contacting the contact point set forth in Article 11
3. After we receive a request to stop, we will not send the "Notices" and "Resumption information" described in the preceding paragraph. However, the "Procedural emails" and "Security notifications" described in paragraph 1 will continue to be sent even after stopping.
4. "Resumption information" is sent when a certain period has elapsed since the date of your last use.
5. We do not send emails for the purpose of advertising the goods or services of third parties. We also do not provide registered contact addresses to third parties (Article 7).
6. Emails we send will state the sender's name, the method for unsubscribing, and a contact address for receiving complaints and inquiries. The sender's name is Nexlim Inc., and the sender's address is 40-13 Daikan-cho, Higashi-ku, Nagoya, Aichi 461-0002, Japan (the same as the seller and address stated on the Service's "Notation based on the Act on Specified Commercial Transactions (特定商取引法)" page).
7. Emails are sent through the entrusted provider described in Article 7.

End of Document