NexlimGames Privacy Policy

Last updated: 2026年11月2日 Effective: 2026年11月2日

This is an English translation of the Japanese original, provided for reference. If there is any discrepancy between the Japanese original and this translation, the Japanese original prevails. Japanese original: プライバシーポリシー

This Privacy Policy is the revised version that applies from 2026年11月2日. With this revision, the privacy policies of the games provided by the Company (including VagrantCrown) have been consolidated into this Policy, and the use of the access analytics tool (Google Analytics) has been extended to the Portal. Until then, this Policy before this revision and the privacy policy of each game apply. The VagrantCrown privacy policy before this revision and this Policy before this revision are available in the list of past versions.

Article 1 (Introduction and Scope)

  1. Nexlim Inc. (株式会社Nexlim) (hereinafter referred to as “the Company”) handles User information obtained through the following services (hereinafter collectively referred to as “the Service”) in accordance with this Privacy Policy (hereinafter referred to as “this Policy”).
    1. The game portal “NexlimGames” (nexlim.games; hereinafter referred to as “the Portal”) and the games provided on the Portal (hereinafter referred to as “Portal Games”)
    2. The authentication platform for NexlimGames Accounts (id.nexlim.games; hereinafter referred to as “the Authentication Platform”)
    3. The games provided by the Company on websites separate from the Portal that are listed in Appendix 1 of the NexlimGames Terms of Service (hereinafter referred to as “Standalone Games,” and together with the Portal Games, “Our Games”)
  2. Terms used in this Policy shall have the meanings set forth in the NexlimGames Terms of Service (hereinafter referred to as the “Terms of Service”), except as otherwise set forth in this Policy.
  3. This Policy includes the matters to be published regarding the external transmission of information about Users under Article 27-12 of the Telecommunications Business Act (電気通信事業法) (Article 10).

Article 2 (Information Collected)

The information the Company collects and stores through the Service is as follows. The Company does not collect any other information (such as addresses, telephone numbers, dates of birth, or names (excluding names entered in inquiries)). Information obtained through access analytics, behavior analytics, ad delivery, and ad performance measurement is described in Articles 8 through 10.

(1) Information about Accounts (Authentication Platform)

Information Details
Account identifier An identifier for each User issued by the Company
Display name The display name set by the User or provided by the linked service
Email address Stored where the User has registered with an email address and password, or where a verified email address has been provided by the linked service
Password Not stored in plain text. Stored after conversion into a non-restorable form (PBKDF2-SHA-256, 100,000 iterations, with a per-User salt)
User identifier of external services Where the User has linked with Google or Discord, the User ID on that linked service
Login status Login session identifier (only its hash value is stored), date and time of authentication, expiration, browser information (User-Agent), and hash value of the IP address
Records of consent The versions of the terms and policies agreed to, and the date and time of consent
History of suspensions and their lifting The date and time, target, and reason of suspensions and their lifting (kept as records of operational actions (audit logs))

The Company requests only information within the scopes openid, email, and profile from Google, and identify and email from Discord. The Company does not access friend lists, posts, contacts, calendars, or the like.

(2) Information about the Use of the Portal

Information Details
Profile Nickname, icon (selected from those provided by the Company), and the date and time of creation and update
Scores Scores for each Portal Game and the date and time of recording
Comments The posted text, the game posted to, the date and time of posting, and the display status (public or hidden)
Reports of Comments The reporting User, the target Comment, the reason for the report, and the date and time
Match records Creating, joining, and spectating Match Rooms, and the moves and results of matches (stored only while the room is open, and deleted after the room is closed)
Login status (Portal) A signed cookie for maintaining login to the Portal (Article 5)

(3) Information about the Use of Standalone Games

In Standalone Games, the following information is collected for all Users, including persons using Guest Play.

Information Details
Session identifier The value of a cookie stored in the browser. Only its hash value is stored on the server
Hash value of IP address The IP address itself is not stored. Only a string hashed after adding a secret string (salt) is stored
Browser information (User-Agent) A string indicating the type of browser and OS
Access date and time Date and time of initial creation, date and time of last access
Game Data Information generated through in-game operations, such as player name (display name), self-introduction, level, inventory, progress, records, and records of receipt of in-game mail
Chat messages The text, channel, date and time, and reactions of messages posted in Standalone Games that provide chat (Appendix 1 of the Terms of Service)
NexlimGames Account identifier The identifier received from the Authentication Platform when the User logs in with a NexlimGames Account. Stored to associate the Game Account with the NexlimGames Account
Records of consent The versions of the terms and policies agreed to, and the date and time of consent

The only information Standalone Games receive from the Authentication Platform is the NexlimGames Account identifier (the only scope requested is openid). Email addresses and display names are not received from the Authentication Platform and are not stored by Standalone Games.

(4) Information about Paid Services

In Our Games that have Paid Services (Appendix 1 of the Terms of Service), the following information is collected.

Information Details
Purchase history Items purchased, amount, date and time of purchase, payment result, and transaction identifier issued by the payment service provider
Records of refunds and rescissions Where a refund or rescission has been made, the fact thereof, the reason, and the date and time

Credit card numbers, expiration dates, security codes, and other payment information are collected and managed directly by the payment service provider (Stripe, Inc.) on its payment screen, and the Company does not collect or store them. For the handling of payment information, please refer to the privacy policy established by that payment service provider.

(5) Information about Inquiries

Information Details
Content of inquiries The content entered in the contact form (the type of inquiry, name, email address for reply (required), and message), or, for inquiries made by email, the sender’s email address and message; the date and time of sending; the Account identifier if logged in; and the hash value of the IP address for limiting the sending interval

So that the Company’s staff can receive inquiries, the content of inquiries is automatically forwarded to a private channel of the Company on the chat service Discord, and a copy is also stored in the Company’s database (Article 7). The Company’s replies are sent by email to the email address for reply that was entered.

(6) Information Recorded for Security Purposes

Information Details
Records of login attempts The email address entered, hash value of the IP address, success or failure, and date and time
Records of the number of emails sent The recipient and the date and time of emails for email address verification and password reset (to prevent mass sending in a short time)
Records of the number of new registrations In Standalone Games, the hash value of the IP address and the number of registrations within a certain period
Detection of automated access Information obtained by Cloudflare Turnstile for detection purposes when posting Comments or the like (Article 10)
Records of suspensions Whether a NexlimGames Account suspension or a Game-Level Suspension has been imposed, and the date and time and reason
Records of declarations of use on the same connection Where a self-declaration has been submitted under Article 14 of the Terms of Service, the content of the declaration and the target Game Accounts
Records of operational actions (audit logs) The type, target, and date and time of operations performed by operators, such as hiding or deleting Comments and chat messages, suspensions and their lifting, recording an account as requiring attention, and corrections of Game Data

(7) Information Not Collected

  • The IP address itself (only a hash value with a secret string (salt) added is stored)
  • Addresses, telephone numbers, dates of birth, and names (excluding names entered when making inquiries)
  • Credit card numbers and other payment information (collected directly by the payment service provider; see (4) of this Article)
  • Location information (from the location function of the device), the device’s contacts, and access to the camera, microphone, or the like. For the approximate country or region estimated from the IP address in access analytics and the like, please see Article 8

Article 3 (Purposes of Use)

The information collected is used only within the scope of the following purposes.

  1. Providing the Service (including login, providing profiles, scores, rankings, Comments, Match Rooms, and chat, and saving and restoring Game Data)
  2. Identifying Users, maintaining login status, and providing login to each of Our Games (Article 7)
  3. Email address verification, password resets, and security notifications
  4. Providing Paid Services, processing payments, granting purchased Paid Items, and managing purchase history
  5. Responding to refunds, rescissions, and other requests regarding purchases (including requests for rescission of purchases made by minors)
  6. Retaining accounting and tax records under laws and regulations
  7. Detecting and preventing unauthorized access, unauthorized use, mass registration and mass posting for mischievous purposes, and fraudulent use of payment methods
  8. Checking compliance with the prohibition of multiple accounts, and responding to declarations of use on the same connection
  9. Responding to violations of the Terms of Service and the NexlimGames Common Account Terms (including hiding or deleting Comments and chat messages, and suspension measures)
  10. Responding to inquiries and to reports of rights infringement
  11. Investigating bugs and improving the Service
  12. Statistically understanding usage (carried out in a form that does not identify individuals)
  13. Posting announcements about the Service, and sending announcements about the Service (including notices about material changes, failures, maintenance, and termination of provision) to the registered contact address
  14. Sending introductions to the Service and announcements encouraging Users to resume to Users who have not used the Service for a certain period (which can be stopped at any time by the methods set forth in Article 11)
  15. Ad delivery, ad performance measurement, and optimization of ad delivery (Articles 9 and 10)
  16. Preventing fraudulent re-registration by persons who have been suspended (including matching against newly created accounts)
  17. Carrying out the withdrawal procedure for each Standalone Game when a NexlimGames Account is deleted (Article 13, paragraph 5)
  18. Recording the versions of the terms and policies to which consent has been given, and confirming consent to amended terms and policies

Article 4 (Retention Periods)

Information Retention Period
Login sessions (Authentication Platform) Deleted 180 days after the expiration (30 days from the last login)
Login sessions (Standalone Games; VagrantCrown) Deleted 180 days after the expiration (180 days from the last use)
Records of login attempts Deleted after 24 hours have elapsed
Tokens for email address verification and password reset Deleted 24 hours after the expiration (24 hours and 1 hour, respectively)
Authorization codes (values used temporarily in the login process) Promptly deleted after the expiration (60 seconds) or after use. The security check values used when linking with Google / Discord are not stored in the database and are placed only in a cookie valid for 10 minutes (Article 5)
Account information, profiles, scores, Game Data, and NexlimGames Account identifiers (Standalone Games) Stored during the period in which the Service is provided, or until withdrawal or a request for deletion (Accounts under suspension are treated as set forth in the next row)
Information on NexlimGames Accounts under suspension (account information, email addresses, user identifiers of external services, hash values of IP addresses, profiles, etc.) To prevent fraudulent re-registration (Article 3, item 16), stored without being deleted until the suspension is lifted. During suspension, the User cannot withdraw, and the Company may not comply with requests for deletion (Article 13, paragraph 7)
Comments Stored during the period in which the Service is provided, or until deletion by the Company, a request for deletion, or withdrawal. Posts hidden by the Company are also deleted upon the poster’s withdrawal
Chat messages (VagrantCrown) The most recent 500 messages per channel are stored, and older messages are automatically deleted when new messages are posted
Purchase history and records of refunds and rescissions Stored for seven years from the last day of the business year that includes the date of the transaction, in accordance with statutory retention obligations. The same applies after withdrawal
Records of the number of new registrations (Standalone Games) Deleted after 30 days have elapsed
Hash value of the IP address at the time of Account creation (Authentication Platform) Stored while the Account exists, and deleted upon withdrawal. However, for Accounts that have been suspended, the next row applies
Hash values for identifying NexlimGames Accounts that have been suspended (and were withdrawn after the suspension was lifted) (hash values of the email address, user identifiers of external services, and the IP address at the time of Account creation) Continuously stored even after withdrawal, in order to treat new accounts created by persons who have been suspended as accounts requiring attention (Article 3, item 16; Article 3, paragraph 5 of the NexlimGames Common Account Terms). For persons who have never been suspended, deleted upon withdrawal
Hash value of the IP address at the time of Game Account creation (VagrantCrown) Continuously stored even after withdrawal, to prevent fraudulent acts (preventing the creation of multiple accounts and the circumvention of suspensions)
Reports of Comments, audit logs of operational actions, records of declarations of use on the same connection, history of suspensions and their lifting, and records of consent Continuously stored even after withdrawal, as operational records
Content of inquiries Deleted after 6 months have elapsed from the completion of handling (including copies from the form, content forwarded to Discord, and, for inquiries made by email, the sender’s email address and message)
User data in Google Analytics Deleted by Google after 14 months have elapsed (Article 8)
Records of operations in Microsoft Clarity Deleted by Microsoft after 30 days have elapsed from the time of recording. However, records that the Company has marked for retention and records randomly sampled by Microsoft are stored for up to 9 months (Article 8)

Notwithstanding the periods in the table above, information relating to NexlimGames Accounts under suspension (including login sessions, records of login attempts, tokens for email address verification and password reset, authorization codes, Comments, and other records) is stored without being deleted, to prevent fraudulent re-registration (Article 3, item 16). Information relating to Accounts not under suspension is deleted as set forth in the table above.

Deletion processing in Standalone Games is executed automatically with a certain probability, triggered by access to the relevant Standalone Game. Therefore, actual deletion may occur slightly after the periods in the table above.

Article 5 (Use of Cookies)

  1. The Service uses the following essential cookies to maintain login status and Game Data from Guest Play.
Cookie name Set by Purpose Validity period
__Host-ngid_session Authentication Platform Maintaining login status on the Authentication Platform 30 days
__Host-ngid_oauth_state Authentication Platform Security check when linking with Google / Discord 10 minutes
ng_sess Portal Maintaining login status on the Portal (signed to prevent tampering) 30 days
ng_login Portal Security check during the login procedure 10 minutes
__Host-vc_session VagrantCrown Maintaining the session (common to Guest Play and Game Accounts) 180 days (extended with each use)
__Host-vc_ngid_state VagrantCrown Security check during the login procedure with a NexlimGames Account 10 minutes
__Host-vc_ngid_switch VagrantCrown Holding the account switching procedure pending when logging in with a NexlimGames Account 10 minutes
  1. The cookies in the preceding paragraph are given the HttpOnly, Secure, and SameSite=Lax attributes and cannot be read from JavaScript.
  2. To statistically understand usage, the Service uses the following cookies set by the access analytics tool (Google Analytics). These are used to measure usage, and are not used for ad delivery or for tracking across other companies’ sites. The information obtained and the methods of opting out are described in Article 8.
Cookie name Set by Purpose Validity period
_ga, _ga_N8LYDS1B6T Portal Distinguishing users in access analytics (an identifier that does not identify individuals). Not set for access from the European Economic Area (EEA), the United Kingdom, and Switzerland (Article 8, paragraph 3) 2 years (extended with each measurement)
_ga and cookies beginning with _ga_ VagrantCrown Distinguishing users in access analytics (an identifier that does not identify individuals). Not set for access from the European Economic Area (EEA), the United Kingdom, and Switzerland (Article 8, paragraph 3) 2 years
  1. Among the Standalone Games, VagrantCrown uses the following cookies set by the behavior analytics tool (Microsoft Clarity) to improve usability. These cookies are used only on the screens described in Article 8, paragraph 9.
Cookie name Purpose Validity period
_clck Distinguishing use from the same browser (an identifier that does not identify individuals) Period determined by Microsoft
_clsk Grouping the display of multiple screens into a single use Period determined by Microsoft
MUID and other cookies set on Microsoft’s domains Distinguishing browsers in Microsoft’s services Period determined by Microsoft
  1. Among the Standalone Games, VagrantCrown uses the following cookies set by X Corp.’s advertising tag (X Pixel) for ad performance measurement and optimization of ad delivery.
Cookie name Purpose Validity period
_twpid Distinguishing browsers in ad performance measurement (an identifier that does not identify individuals) Period determined by X Corp.
personalization_id, muc_ads, and other cookies set on X’s domains Distinguishing browsers in X’s services, and ad performance measurement Period determined by X Corp.
  1. When Comments are posted or the like, Cloudflare Turnstile may use cookies and other technologies to detect automated access (Article 10).
  2. In the course of the payment procedure, the payment service provider may use cookies and the like to prevent fraudulent use. Their handling is governed by that provider’s privacy policy.
  3. The Portal loads the Google AdSense code (ad delivery will start after review by Google). Cookies set by Google AdSense and third-party vendors participating in its advertising network may be used (Article 9; excluding access from the regions set forth in paragraph 6 of that Article).
  4. Cookies can be deleted in the browser settings. If you delete them, you will need to log in again, and you will lose access to Game Data from Guest Play (it cannot be restored).

Article 6 (Information Made Public to Other Users)

  1. In the Service, the following information is viewable by everyone who views the relevant feature.
    • Portal: nickname, icon, scores displayed in rankings, posted Comments (together with the date and time of posting and the game posted to), and information about Match Rooms (the nicknames and icons of Users who created or joined the room, the moves and results of matches, and recruitments for opponents)
    • Standalone Games: the information specified in Appendix 1 of the Terms of Service (the player’s display name, self-introduction, records displayed in rankings, chat messages, etc.)
  2. Email addresses, user identifiers of external services, hash values of IP addresses, browser information, purchase history, content of inquiries, and the reporters of Comments are never made public to other Users.
  3. The Service has no messaging feature that can be viewed only among specific Users. Please be careful not to enter your name or any other personally identifiable information, or information you do not want others to know, in nicknames, display names, self-introductions, Comments, or chat messages.

Article 7 (Provision to Third Parties and Use of External Services)

  1. The Company does not provide collected information to third parties, except in the following cases.
    • Where the User’s consent has been obtained
    • Where required by laws and regulations (including responding to requests for disclosure of sender information), or where a lawful request has been received from a public authority such as a court or the police
    • Where it is necessary for the protection of the life, body, or property of a person and it is difficult to obtain the consent of the person
  2. When a User logs in to one of Our Games with a NexlimGames Account, the Authentication Platform provides that game with the Account identifier. In addition, it provides the Portal with the display name and, where the Portal requires it, the email address (only the identifier is provided to Standalone Games; Article 2 (3)). In addition, when a NexlimGames Account is deleted, the Authentication Platform sends a notice of deletion (the Account identifier) to each Standalone Game. Our Games never send Game Data, purchase history, or other information about the use of Our Games to the Authentication Platform. Our Games and the Authentication Platform are all operated by the Company, and these are uses within the Company.
  3. The Company uses the following external services to operate the Service, and entrusts the handling of information to them to that extent.
Provider Purpose Information handled Country
Cloudflare, Inc. Execution platform and database of the Service, communication logs, and detection of automated access (Cloudflare Turnstile) All information stored by the Service, access logs, and the information described in Article 10 United States
Google LLC Login with Google accounts, access analytics (Google Analytics), and delivery of fonts for the Portal (Google Fonts) Information within the scope permitted by the User when linking, and information used for access analytics and font delivery described in Articles 8 and 10 United States
Discord Inc. Login with Discord accounts, and receipt of inquiries (forwarding to a private channel of the Company) Information within the scope permitted by the User when linking, and the content of inquiries United States
Railsware Products Studio LLC (Mailtrap) Sending emails from the Company to Users (the various emails described in Article 11, paragraph 1) Recipient email address and email body United States
Stripe, Inc. Processing payments for Paid Services Payment information (card numbers, etc.), User identifiers to the extent necessary for payment, and purchase amounts United States
Microsoft Corporation Behavior analytics (Microsoft Clarity; VagrantCrown) Records of on-screen operations and device and environment information described in Article 8 United States
  1. In connection with the preceding paragraph, User information is transferred outside Japan (to the United States). The Company selects and exercises necessary and appropriate supervision over its contractors after understanding the systems for the protection of personal information in the countries and regions where the contractors are located (understanding of the external environment). For the handling by each provider, please refer to the privacy policy established by each provider.
  2. Of the external transmissions described in Articles 8 through 10, the information sent to X Corp. (X Pixel) and Google LLC (Google AdSense) is also used by each company for its own ad delivery and other purposes. This is not based on the entrustment under paragraph 3, and is handled by each company in accordance with its own privacy policy. The Company does not provide these providers with personal data of Users held by the Company (display names, email addresses, Account identifiers, etc.).

Article 8 (Access Analytics, Behavior Analytics, and Ad Performance Measurement)

Google Analytics

  1. To understand usage, the Service uses the access analytics tool “Google Analytics” provided by Google LLC within the following scope.
Site Measurement ID Screens where used Records of operations sent by the Company
Portal G-N8LYDS1B6T All pages of the Portal and the screens of Portal Games (excluding Standalone Games) Page views, and the end of a Portal Game (the game identifier and score)
VagrantCrown G-NG2GNXBJKB Landing page and game screens Page and screen views, completion of account registration, completion of external service linkage (the name of the linked service), display of and operations on the guidance for external service linkage (that it was displayed, the linkage method selected, and that it was closed), exploration (dungeon identifier, difficulty, floor, and count), reading of skill books (book identifier and number of volumes), completion of a purchase of Paid Services (transaction identifier, amount paid, and item identifier), display of the guidance for adding to the home screen (the type of guidance and the trigger for display), and completion of adding to the home screen (the type of device)

  1. Google Analytics collects the following information using the cookies set forth in Article 5, paragraph 3 (excluding access from the regions set forth in the next paragraph). The collected information is sent to Google LLC (United States) and handled in accordance with the conditions established by that company. What the Company receives is statistically processed information.

    • The URL and title of pages and screens viewed, the date and time of access, and the referrer (the page viewed immediately before)
    • The type of browser, OS, and device, screen size, language settings, and whether the Service was launched from the home screen
    • The approximate country or region estimated from the IP address (the Company does not receive the IP address itself)
    • The records of operations in the table in the preceding paragraph

  2. On the Portal and VagrantCrown, for access from the European Economic Area (EEA), the United Kingdom, and Switzerland, the default of the Google Analytics consent settings (Consent Mode) is set to “denied.” For access from these regions, measurement is performed without storing cookies, by sending the consent status, page information, and information accompanying the communication (IP address and browser information) to Google Analytics (since no screen for choosing consent is provided, measurement is always performed in the denied state).

  3. The Company does not send nicknames, display names, email addresses, Account identifiers, or any other personally identifiable information to Google Analytics. The Company also does not use the feature that associates logged-in Users with analytics records (the User-ID feature).

  4. The information in the preceding paragraphs is used only for the purposes of Article 3, item 11 (investigating bugs and improving the Service) and item 12 (statistically understanding usage).

  5. The retention period of user data in Google Analytics is 14 months. Information for which this period has elapsed is deleted by Google (Article 4).

  6. Users can stop the collection of information by Google Analytics by any of the following methods. Stopping it does not affect your use of the Service.

    • Installing the “Google Analytics Opt-out Browser Add-on” in your browser: https://tools.google.com/dlpage/gaoptout/
    • Deleting cookies or refusing to accept them in your browser settings (for Game Data from Guest Play, please see Article 5, paragraph 9)
    • Using the tracking prevention features of your browser

    For the handling of data by Google, please see the following.

Microsoft Clarity (VagrantCrown)

  1. To improve usability, VagrantCrown uses the behavior analytics tool “Microsoft Clarity” provided by Microsoft Corporation. This tool uses the cookies set forth in Article 5, paragraph 4 to record on-screen operations and enables the Company to replay or aggregate and view those records.
  2. The Company uses Microsoft Clarity only on the VagrantCrown landing page (/lp) and on the game screens of Users within 7 days of the creation of their account (including Guest Play accounts). It is not used on the administration screens for operators, the screens for email address verification and password reset, or the pages for the terms and policies.
  3. The information collected by Microsoft Clarity is as follows.
Information Details
Records of on-screen operations The structure of displayed screens, clicks and taps, scrolling, mouse movements, screen transitions, date and time of access, and referrer
Device and environment information The type of browser and OS, screen size, language settings, and whether the Service was launched from the home screen
Approximate region The country or region estimated from the source of communication
Additional information sent by the Company The category of the number of days elapsed since account creation, whether an external service is linked, the stage of tutorial progress, the type of screen displayed, and the fact that the following operations were performed (finishing the opening, reaching, completing, or skipping each stage of the tutorial, the first exploration and the display of its result, display of, operations on, and ending of the guidance for external service linkage, adding to the home screen, permitting push notifications, and unlocking expeditions)
  1. The Company does not send display names, email addresses, Account identifiers, or any other personally identifiable information to Microsoft Clarity. The Company also does not use the feature for specifying an identifier to associate records with Users. In addition, the main areas of the screen that display display names, names of companions, chat messages, rankings, mail, profiles, inquiries, and payments are recorded with their content masked, and are configured so that their content is not sent to Microsoft (content entered in input fields is not recorded, due to the specifications of the tool).
  2. The information in the preceding two paragraphs is used only for the purposes of Article 3, items 11 and 12.
  3. The collected information is sent to Microsoft Corporation (United States) and handled in accordance with the conditions established by that company. Records are stored for 30 days from the time of recording. However, records that the Company has marked for retention and records randomly sampled by Microsoft are stored for up to 9 months (Article 4). For details, please see the following.
  1. Users can stop the collection of information by Microsoft Clarity by any of the following methods. Stopping it does not affect your use of the Service. Please note that Microsoft Clarity does not support the browser “Do Not Track” setting.
  • Selecting “Microsoft” in the opt-out mechanism for third-party vendors (the DAA mechanism): https://optout.aboutads.info/
  • Enabling the “Global Privacy Control” setting in your browser

X Pixel (VagrantCrown)

  1. For ad performance measurement and optimization of ad delivery for advertisements placed on X (formerly Twitter), VagrantCrown uses the advertising tag (X Pixel) provided by X Corp. This tag uses the cookies set forth in Article 5, paragraph 5 to enable X Corp. to determine whether views and operations such as account registration came via advertisements on X.
  2. The Company uses X Pixel only on the VagrantCrown landing page (/lp) and game screens. It is not used on the administration screens for operators, the screens for email address verification and password reset, or the pages for the terms and policies.
  3. The information sent to X Corp. by X Pixel is as follows.
Information Details
Records of views The URL of the page viewed, date and time of access, and referrer
Device and environment information IP address, the type of browser and OS (User-Agent), and the values of the cookies set forth in Article 5, paragraph 5
Records of operations sent by the Company The fact that the following were performed: completion of account registration, the operation to start the game on the landing page, reaching adventurer rank 5, completion of account linkage, use on the day after the registration date, and completion of a purchase of Paid Items (including whether it is the first purchase); the purchase amount (yen); and identifiers to avoid duplication (random values generated by the Company each time; for purchases, the payment reception number issued by the payment service provider)
  1. The Company does not send display names, email addresses (including their hash values), Account identifiers, or any other personally identifiable information to X Corp.
  2. The information in the preceding two paragraphs is used only for the purposes of ad performance measurement and optimization of ad delivery. The collected information is sent to X Corp. (United States) and handled in accordance with the conditions established by that company (X Privacy Policy: https://x.com/privacy).
  3. Users can stop the information obtained by X Pixel from being used for advertising by any of the following methods. Stopping it does not affect your use of the Service.
  • Turning off personalized ads in “Ad preferences” under “Privacy and safety” in X’s “Settings and privacy”: https://x.com/settings/ads_preferences
  • Using the opt-out mechanism for third-party vendors (the DAA mechanism) (available even when you are not logged in to X): https://optout.aboutads.info/
  • Deleting cookies or refusing to accept them in your browser settings (for Game Data from Guest Play, please see Article 5, paragraph 9)

Others

  1. VagrantCrown may temporarily record identifiers in a form that does not identify individuals in order to understand the number of concurrent users.
  2. If the Company changes the analytics tools and the like in the preceding paragraphs or adds other analytics tools and the like, the Company will revise this Policy, describe the information obtained and the methods of stopping it, and announce this on the Service.

Article 9 (Advertising)

  1. The Company may display third-party advertisements on the Service using the ad delivery service “Google AdSense” provided by Google LLC. The Company has placed the Google AdSense code on the Portal for Google AdSense’s review, and ad delivery will start after the review. Sites that load the Google AdSense code are listed in the table in Article 10, paragraph 1. After ad delivery has started, third-party vendors, including Google, use cookies to deliver advertisements based on Users’ past visits to the Service or other websites. The ad delivery provider used by the Company is Google LLC (Google AdSense), and that company may provide ad space to third-party ad delivery providers participating in its advertising network.
  2. Advertisements are displayed to cover the operating costs of the Service.
  3. The Company does not provide nicknames, display names, email addresses, Account identifiers, or any other personally identifiable information to ad delivery providers. The Company never sells User information to third parties for the purpose of displaying advertisements.
  4. Users can disable personalized ads by any of the following methods. Even if disabled, advertisements will continue to be displayed, but they will no longer be based on the User’s interests.
  5. For how Google uses information in ad delivery, please see the following.
  6. The Company does not deliver personalized advertisements to access from the European Economic Area (EEA), the United Kingdom, and Switzerland. For access from these regions, the default of Google’s consent settings (Consent Mode) is set to “denied” (Article 8, paragraph 3), and no cookies for advertising are stored (because no screen for choosing consent is provided, consent is always treated as denied). In this case, only limited ads are shown, or no ads are shown. Even for access from these regions, the URL of the page viewed, the IP address, and browser information are sent to Google when the Google AdSense code is loaded.

Article 10 (External Transmission of Information about Users)

  1. In the Service, information about Users is sent from the User’s browser to the following providers (matters to be published under Article 27-12 of the Telecommunications Business Act (電気通信事業法)).
Site Recipient Information sent Purpose of use Method of opting out
Portal Google LLC (Google Analytics) URL and title of the page viewed, referrer, IP address, browser, OS, and device information (User-Agent, screen size, and language), identifiers stored in cookies (_ga, etc.), and records of operations sent by the Company (end of a Portal Game and score). For access from the EEA, the United Kingdom, and Switzerland, cookies are not used, and only the consent status, page information, and information accompanying the communication (IP address and browser information) are sent Statistically understanding the usage of the Service, and improving the Service The methods in Article 8, paragraph 7
Portal Google LLC (Google Fonts) URL of the page viewed (as the referrer), IP address, and browser and OS information (User-Agent) Delivery of the fonts displayed on the screens of the Portal Cannot be stopped (necessary for displaying pages). Not sent if loading of external fonts is blocked in the browser settings
Portal Cloudflare, Inc. (Cloudflare Turnstile) Information used to detect automated access, such as IP address, browser and device information, and information about operations Preventing mass posting and the like for mischievous purposes Cannot be stopped (necessary for posting Comments and making inquiries). Not sent if the Comment section or contact form is not displayed
Authentication Platform Google LLC (login with Google accounts) / Discord Inc. (login with Discord accounts) Where the User chooses to link, the information entered and permitted by the User on the screen of the linked service Login to a NexlimGames Account Not sent if the User does not choose to link
VagrantCrown Google LLC (Google Analytics) The information described in Article 8, paragraphs 1 and 2 (including the IP address and identifiers stored in cookies). For access from the EEA, the United Kingdom, and Switzerland, cookies are not used, and only the consent status, page information, and information accompanying the communication (IP address and browser information) are sent Statistically understanding the usage of the Service, and improving the Service The methods in Article 8, paragraph 7
VagrantCrown Microsoft Corporation (Microsoft Clarity) The information described in Article 8, paragraph 10 (including the IP address and identifiers stored in cookies) Improving usability, and statistically understanding usage The methods in Article 8, paragraph 14
VagrantCrown X Corp. (X Pixel) The information described in Article 8, paragraph 17 Ad performance measurement, and optimization of ad delivery The methods in Article 8, paragraph 20
Portal (loads the Google AdSense code; ad delivery will start after the review) Google LLC and third-party vendors (Google AdSense) URL of the page viewed, referrer, IP address, browser and device information, cookies and advertising identifiers, and records of ad impressions and clicks (after ad delivery starts). For access from the EEA, the United Kingdom, and Switzerland, cookies and advertising identifiers are not used Ad delivery, ad performance measurement, delivery of advertisements based on the User’s interests (personalized ads), and detection of invalid clicks The methods in Article 9, paragraph 4
  1. Payments for Paid Services are made by moving to the payment screen of the payment service provider (Stripe, Inc.). Information entered on the payment screen is sent directly from the User’s browser to that company and handled in accordance with that company’s privacy policy.
  2. The table in paragraph 1 of this Article will be revised when the recipients or the information sent are changed, and this will be announced on the Service.

Article 11 (Sending of Emails and Opting Out)

  1. The Company sends the following emails to the registered contact address (email address). Emails are sent by Nexlim Inc. (株式会社Nexlim) to the email address registered on the Authentication Platform (since Standalone Games do not hold Users’ email addresses, Standalone Games never send emails directly).
Type Content Whether it can be stopped
Procedural emails Email address verification and password reset Cannot be stopped (necessary for identity verification)
Security notifications Password changes and the addition of login methods Cannot be stopped (necessary for detecting unauthorized use)
Announcements Notices about material changes, failures, maintenance, and termination of provision of the Service Can be stopped
Invitations to resume Introductions to Our Games for persons who have not used the Service for a certain period Can be stopped

“Announcements” and “Invitations to resume” are not currently sent. When the Company starts sending them, it will do so after preparing the opt-out methods set forth in the next paragraph.

  1. The “Announcements” and “Invitations to resume” in the preceding paragraph can be stopped at any time by either of the following methods. Stopping them does not affect your use of the Service.
    • Opening the unsubscribe link provided at the end of the relevant email (login is not required)
    • Contacting the contact point set forth in Article 14
  2. After receiving a request to stop, the Company will not send the “Announcements” and “Invitations to resume” set forth in the preceding paragraph. However, the “Procedural emails” and “Security notifications” set forth in paragraph 1 will continue to be sent even after the request to stop.
  3. “Invitations to resume” are sent when a certain period has elapsed since the date of last use.
  4. The Company does not send emails for the purpose of advertising the goods or services of third parties. The Company also does not provide registered contact addresses to third parties (Article 7).
  5. Emails sent by the Company state the name of the sender, the method of opting out, and a contact address for receiving complaints and inquiries. The name of the sender is 株式会社Nexlim (Nexlim Inc.), and the address is 〒461-0002 愛知県名古屋市東区代官町40番13号 (40-13 Daikan-cho, Higashi-ku, Nagoya, Aichi 461-0002, Japan) (the same business operator and address as stated in the Notation Based on the Specified Commercial Transactions Act and the Operator Information).
  6. Emails are sent through the contractor described in Article 7.

Article 12 (Security Control Measures)

The Company takes the following measures for the secure management of collected information.

  1. Encryption of communications (HTTPS)
  2. One-way hashing of passwords (PBKDF2-SHA-256, 100,000 iterations, with a per-User salt)
  3. Hashing of IP addresses (using a secret salt, without storing the original IP address)
  4. Storing login session identifiers as hashes (raw values are not stored in the database), and preventing tampering with Portal cookies through signatures
  5. Limits on the number of login attempts, limits on the number of verification emails sent, and limits on the number of new registrations in Standalone Games
  6. Verification of the origin of write requests (such as posting Comments), and detection of automated access
  7. Adoption of a configuration in which payment information is not retained in the Company’s systems but is entrusted to the payment service provider
  8. Recording of audit logs of operations performed by operators
  9. Limiting the persons with operational privileges (in VagrantCrown among the Standalone Games, operational privileges are granted only through direct operations on the database)

Please note that absolute security cannot be guaranteed for the transmission, reception, and storage of information over the internet.

Article 13 (Requests for Disclosure, Correction, and Deletion, and Withdrawal)

  1. Users may request disclosure, correction, addition, suspension of use, or deletion of their own information held by the Company.
  2. Please make requests to the contact point set forth in Article 14. The Company will respond without delay after verifying that the requester is the person in question. If the Company decides not to disclose or not to make corrections or the like, it will notify the User to that effect without delay.
  3. Nicknames and icons (Portal), and display names, self-introductions, and part of Game Data (Standalone Games) can be changed by the User on the screens within the Service. To delete posted Comments, please make a request to the contact point set forth in Article 14.
  4. A NexlimGames Account can be deleted (withdrawn) from the Account settings screen (Article 9 of the NexlimGames Common Account Terms). However, Accounts under suspension cannot be withdrawn (paragraph 2 of that Article). Upon withdrawal, the profile, scores, and Comments on the Portal will be deleted.
  5. If a NexlimGames Account is deleted, the User will be treated as having also withdrawn from each Standalone Game, and the Game Data of each Standalone Game will be deleted (Article 18, paragraph 2 of the Terms of Service). If you wish to delete only the data for a specific Standalone Game, or if you wish to delete data from Guest Play, please contact the contact point set forth in Article 14.
  6. Deleted Accounts and Game Data cannot be restored. No refund will be made for purchased Paid Items either (Article 18, paragraph 5 of the Terms of Service). Even after deletion, the Company will retain certain records (purchase history, history of suspensions and their lifting, audit logs, hash values for identifying accounts that have been suspended, hash values of the IP address at the time of Game Account creation in VagrantCrown, etc.) to the extent necessary for legitimate purposes such as preventing fraudulent acts and complying with laws and regulations (including keeping accounting and tax records) (Article 4).
  7. Because information on Accounts under suspension is stored to prevent fraudulent re-registration (Article 3, item 16), the Company may be unable to comply with requests for the deletion or suspension of use of such information. In this case, the Company will notify the User to that effect and the reason without delay.

Article 14 (Contact Point and Business Operator Information)

For inquiries regarding this Policy and the handling of information, and for requests for disclosure and the like, please contact the following contact point.

  • Business operator: Nexlim Inc. (株式会社Nexlim)
  • Address: 〒461-0002 愛知県名古屋市東区代官町40番13号 (40-13 Daikan-cho, Higashi-ku, Nagoya, Aichi 461-0002, Japan)
  • Representative: 太田 嘉隆
  • Contact form: https://nexlim.games/contact/
  • Email address: contact@nexlim.co.jp

Inquiries are accepted through the form or email address above. When using the form, you must enter an email address for our reply. The Company’s replies are made by email. Depending on the content of an inquiry, the Company may be unable to respond, and the Company does not reply to every inquiry. However, requests under Article 13 will be answered in accordance with laws and regulations.

Article 15 (Use by Minors)

  1. The Service has no means of verifying age. Minors should use the Service after obtaining the consent of a legal representative (parent or guardian).
  2. If a minor posts Comments, posts chat messages, or the like, the minor should confirm together with a legal representative that the content will be made public as set forth in Article 6.
  3. If a minor uses Paid Services, the minor must obtain the consent of a legal representative on each occasion. For purchases made without such consent, the legal representative should make a request to the contact point set forth in Article 14 (Article 24 of the Terms of Service).
  4. If the Company is contacted by a legal representative regarding the disclosure or deletion of a child’s information, the Company will respond after confirming the identity of the person and that the requester is the legal representative.

Article 16 (Amendment of This Policy)

  1. The Company may revise this Policy in response to changes in laws and regulations or changes in the content of the Service.
  2. The revised Policy shall take effect on the effective date determined at the time of revision. The Company will post the content of the revision and the effective date on the Service no later than the effective date. When making material changes (changes to the purposes of use, addition of external transmission recipients, etc.), the Company will announce them on the Service.
  3. A revision that adds one of Our Games and describes the handling of information in that game in this Policy shall take effect through the posting set forth in the preceding paragraph, insofar as it does not change the handling of information in the existing Our Games.
  4. Past versions of this Policy (including the privacy policies that Our Games had individually established) are available in the list of past versions.

Supplementary Provisions (Transition from the VagrantCrown Privacy Policy)

  1. Until the effective date of this Policy, the “VagrantCrown Privacy Policy” (the final version being r13, effective November 1, 2026) applied to VagrantCrown. Information obtained under that policy will be handled in accordance with this Policy on and after the effective date of this Policy (the purposes of use remain within the scope of that policy).
  2. Accounts created before the end of the maintenance performed on VagrantCrown on November 1, 2026 (hereinafter referred to as “the Switchover”) have been provided as NexlimGames Accounts on and after the Switchover. The email address, password hash value (converted with PBKDF2-SHA-256, 100,000 iterations), Discord or Google user identifier, and display name registered for such an account are managed on the Authentication Platform as the authentication information of the NexlimGames Account. Such information remaining in the VagrantCrown database will be deleted within approximately 30 days after the Switchover.
  3. Until the User logs in with a NexlimGames Account for the first time and agrees to the terms and policies, the information in the preceding paragraph is used only for providing login to VagrantCrown (including email address verification and password reset) and ensuring its security. Such information of persons who have never logged in with a NexlimGames Account is stored for as long as their VagrantCrown account exists.
  4. Records of login attempts and tokens for email address verification and password reset recorded in VagrantCrown before the Switchover are deleted within the periods in the table in Article 4. Article 11 also applies to emails sent to email addresses registered in VagrantCrown before the Switchover.

Revision History

  • 2026年11月1日 Established
  • November 1, 2026: Changed the URL of the Service from games.nexlim.co.jp to nexlim.games, and the URL of the Authentication Platform from id.nexlim.co.jp to id.nexlim.games
  • 2026年11月2日 Revision consolidating the privacy policies of Our Games into this Policy (establishment of provisions on information about Standalone Games and Paid Services, Microsoft Clarity and X Pixel, sending of emails and opting out, the Supplementary Provisions, etc.). Introduction of Google Analytics to the Portal (Articles 4, 5, 7, 8, and 10), addition of Google Fonts to the matters to be published regarding external transmission, and removal of the description of Cloudflare Web Analytics (version ng-r10; effective 2026年11月2日)

End