Privacy Policy

Last updated: October 20, 2026

This English version is a translation of the original Traditional Chinese version. If the two versions differ, the Traditional Chinese version prevails.

Neverdex (including the website, the iOS app, the Android app and related services, the “Game”) is operated by Haku Core LLC, a Wyoming limited liability company (“we” or “us”), which is responsible for the personal data the Game collects. This policy explains what data we collect, how we use it and the rights you have. By using the Game, you agree to this policy; if you do not agree, do not use the Game.

The Game has multiple servers, such as the English, Mandarin (Taiwan) and Cantonese (Hong Kong) servers. Each server is a separate game world: accounts, friends, collections and purchases are stored separately and are not shared between servers. The website and the apps use the same account system. This policy applies to every server.

1. Data we collect

• Game data: the nickname you set, your gift messages, and your play history, such as the cards you own, recipes you discover, friends, gift and request history, achievements, mana, gems and stardust.
• Sign-in credentials: a random sign-in token that identifies you. The server stores only a hash of it, which cannot be turned back into the original token.
• Google account (only if you choose to link it or sign in with it): the account ID and email address provided by Google. The Game requests only basic profile and email permissions. It does not store the name and profile picture Google provides at sign-in, and does not access your Google Drive, Gmail or any other Google data.
• Apple account (only if you choose Sign in with Apple in the iOS app): the unique account ID and email address provided by Apple; if you use Apple’s Hide My Email, we receive the relay address Apple provides. We also store the authorization token issued by Apple, used only to revoke the authorization with Apple when you delete your account.
• Purchase records: for purchases in the website’s Shop, the item, amount, time and Stripe payment ID; for in-app purchases, the item, time, App Store or Google Play transaction ID, the amount and currency reported by the store, and refund records. We do not receive or store your card number or other payment details: website payments are processed by Stripe, and in-app purchases by Apple or Google. To match an in-app purchase to your game account, the Game gives the store a randomly generated purchase identifier that contains no personal data.
• Push notifications (only if you allow notifications in the app): your device’s push token, platform (iOS or Android), time zone, and the types of notifications you have turned off. The time zone is used to pause notifications at night (11 pm to 8 am) in your local time.
• Reports and blocks: reports you submit (the player or content reported, the reason, any details, and the content at the time of the report), players you block, and reports about you and how they were handled.
• Technical data: for account security and to prevent abuse, when you use the Game while signed in, the server stores your IP address and device and browser type with your account for a limited period, to see which devices your account is signed in on, handle support requests and payment disputes, and detect abuse such as one person operating multiple accounts. The server also uses your IP address for rate limiting and, when necessary, temporarily blocks abusive networks. When you hit a limit, your IP address is stored with your account and the number of requests, for only as long as needed to prevent abuse. Server and hosting logs may also contain IP addresses and device and browser types for a short time. When you use the app, its platform and version are also recorded, to prompt you to update and to decide which features are available.
• Local storage: your sign-in token, selected server, workbench layout, local reminder settings and display preferences are stored in your browser’s or the app’s local storage. In the app, the sign-in token is also backed up in the iOS Keychain or the Android AccountManager, so that you can still sign in if the system clears the app’s data. This data stays on your device.
• Usage statistics: the Game uses Google Analytics to understand how players use the Game, such as pages opened, actions like crafting and sharing, device and approximate region. Statistics are keyed by an internal account number and do not include your nickname or email address.
• Data you give us: your email address and the content of your messages when you contact us.

2. How we use data

• To provide the Game’s features, such as crafting, collecting, friends, gifts and leaderboards. Your nickname is shown publicly on leaderboards, World First records and share pages.
• To link accounts and let you sign in on other devices (the website and the apps share the same account).
• To process purchases, verify in-app purchases, deliver items, send receipts, and handle refunds and payment disputes.
• To send the push notifications and local reminders you have allowed.
• To handle reports and blocks, review publicly displayed content such as nicknames, keep the service and accounts secure, and prevent abuse, cheating and fraud.
• To analyze how the Game is used and improve its design.
• To reply to your messages and send service-related announcements.
• To comply with legal obligations and to establish, exercise or defend our legal rights.

We do not sell your personal data or use it for advertising.

3. Sharing with third parties

• AI services (Anthropic, OpenRouter and the model providers OpenRouter connects to): when a brand-new recipe is crafted or extracted, card names are sent to AI to generate the result (the AI generates only text, such as card names and descriptions, never images). When you set or change your nickname, the nickname you enter is sent to AI to check it for advertising or offensive words. Apart from this, no email address or other personal data is sent to AI services.
• Hosting (Railway): the Game’s servers and databases are hosted on Railway.
• Payments (Stripe): when you buy in the Shop, you enter your payment details on Stripe’s payment page, and they are processed under the Stripe Privacy Policy. If you have linked a Google account, the Game pre-fills your email address on the payment page so that a receipt can be sent to you.
• Google: Google verifies your identity when you link your account, and usage statistics are processed by Google Analytics, both under the Google Privacy Policy. You can opt out of the statistics with the Google Analytics Opt-out Browser Add-on.
• Apple and Google (app sign-in and in-app purchases): Apple or Google verifies your identity when you sign in to the app; in-app purchases are processed by the App Store or Google Play, and we check the status of transactions and refunds with the store. This is done under the Apple Privacy Policy and the Google Privacy Policy.
• Push notifications (Firebase Cloud Messaging by Google): the app’s push notifications are delivered to your device through Firebase Cloud Messaging (and, on iOS devices, Apple’s push notification service). We give it your device’s push token and the notification to deliver: the notification text (which may include friends’ nicknames and card names) and its type.
• Legal requirements and protection of rights: we may disclose data when required by law, court order or a government authority, or when necessary to investigate fraud or violations or to protect the rights and safety of us, our players or others.
• Business transfers: if we are involved in a merger, acquisition, sale of assets or transfer of operations to another company, your data may be transferred as part of it and will continue to be handled under this policy.

Except as described above, we do not provide your personal data to third parties.

Google User Data

Neverdex stores only your Google account ID and email address, and uses them only for account linking, sign-in, support and purchase receipts. Google user data is never sent to AI services, used to train AI models, sold or used for advertising. The AI in Neverdex generates card text only, never images. Neverdex does not use Google APIs or Google user data to create AI-generated non-consensual intimate imagery (NCII). Neverdex’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Where data is stored

We are located in the United States, and the servers of the service providers above may be in the United States or other countries. Your data is transferred to, stored and processed in places outside your country, where data protection laws may differ from those where you live. By using the Game, you consent to this transfer.

5. Retention and deletion

• We keep your data until you ask us to delete it, your account is deleted, or the Game shuts down. We may delete guest accounts after 12 consecutive months without a sign-in.
• You can delete your account at any time on the website or in the app: tap your name at the top right to open the “Account” screen, then tap “Delete account” at the bottom (for guests, “Delete this guest account”). Accounts on each server must be deleted separately. For step-by-step instructions, see How to delete your account. You can also email support-en@neverdex.com to ask to access, correct or delete your account data. To protect your account, we may verify your identity first, and we will respond within a reasonable time.
• When you delete your account, we delete your nickname (shown as “Deleted player” from then on), gift messages, linked Google and Apple accounts and email addresses, sign-ins on all devices and IP address records, friends and friend requests, card requests, push tokens and block records; for accounts that use Sign in with Apple, we revoke the authorization with Apple. If you later sign in with the same Google or Apple account, a new account is created.
• After an account is deleted, we may keep purchase and refund records, reports, and violation and suspension records for as long as needed for tax, accounting, fraud prevention and legal disputes; data in backups is removed when the backups expire. Collections and World First records are part of the Dex shared by the whole server and are kept in de-identified form: the discoverer is shown as “Deleted player” and is no longer listed on leaderboards. Cards you have already given to other players stay in their accounts.
• The Game is still in beta, and game data may be reset as part of updates.

6. Security

We take reasonable measures to protect your data, such as encrypted connections and storing only hashes of sign-in tokens. However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee that data will never be leaked, lost or accessed without authorization.

7. Children’s privacy

The Game is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If we find such data, we will delete the related account and data. Parents or guardians who believe their child has provided personal data can email support-en@neverdex.com. Users under 18 (or the age of majority where they live) must use the Game with the consent of a parent or legal guardian.

8. Changes to this policy

We may modify this policy at any time. We will update this page and its “Last updated” date, and announce material changes in the Game or on the website. If you continue to use the Game after a change, you agree to the modified policy.

9. Contact us

If you have any questions about this policy, or want to access, correct or delete your data, please email support-en@neverdex.com.

Neverdex is operated by: