The short version: we collect what we need to run your account and the events you join, we never sell your data, your date of birth and gender stay private, and you can ask us to give you a copy of your data or delete it at any time.
1. Who is responsible for your data
NXLVL is operated by Khaizer D. Noguera, trading as NXLVL, in the Philippines. We are the personal information controller for the data described here. Our Data Protection Officer can be reached at support@nxlvl.online.
We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). If you live in another country, its data-protection law may give you additional rights, and we will honour them.
2. What we collect
Information you give us
- Account: username, email address, password (stored only as a one-way hash), date of birth, and gender.
- Profile: display name, avatar, cover image, bio, social links, favourite games, and in-game names (IGNs).
- Preferences: theme, timezone, and notification settings.
- Tournaments you organize: event details, contact channels, venue address or city for in-person events, and the payment details you give entrants (account name and number).
- Tournaments you enter: your team line-up, answers to the organizer's questions, files you attach, your payment reference, and any proof-of-payment image.
- What you post and send: posts, comments, images, videos, reactions, follows, and messages in chats, match rooms, scrimmages and looking-for-group rooms.
- Reports you file about other users or content, and messages you send our support team.
Information collected automatically
- Security records: the IP address and browser type used for sign-ins and important account actions, kept in an audit log.
- Activity: when you were last active (people you chat with see whether you are active now), and which notifications and messages you have seen.
- Push notifications: if you turn them on, your browser's push address and keys, and its name.
- Uploads: the file name, type and size of what you upload.
- Usage and errors: see "Analytics and error reports" below.
Information from others
- If you sign in with Google or GitHub (where offered), we receive your name, email address and profile picture from them.
- Other users may mention you, invite you, add you to a team, or report you, and organizers record match results that include you.
- Moderation records: warnings, removed content, and suspensions on your account.
3. Why we use it
- To provide NXLVL (our agreement with you): run your account, show your profile, run the events you organize or join, deliver messages and notifications.
- To keep NXLVL safe (our legitimate interest, and legal obligations): prevent fraud, spam and abuse, enforce the Terms, handle reports, and secure accounts.
- To check eligibility: your date of birth is used to make sure you meet the minimum age and is never shown to other users.
- To improve NXLVL (our legitimate interest): understand which features are used and fix errors.
- To contact you about your account: sign-in codes, password resets, and important changes. We do not send marketing email.
- With your consent: push notifications, which you can turn off at any time.
We do not sell your personal data, and we do not use it for advertising.
4. Who can see your information
- Everyone (including people who are not signed in) can see your public profile: username, display name, avatar, cover, bio, social links, favourite games, the teams and organizations you belong to, your follower and following counts, your public posts, the public tournaments you take part in, and your results in them. Your career stats (match record, medals and the calendar of days you played) count every official match you have played, including in private tournaments; they show totals and dates, never the private tournament itself.
- Organizers of an event you enter see your registration: line-up, answers, attachments, payment reference and proof of payment.
- People you message, and members of rooms you join, see what you send there.
- Our moderators see reported content and the account details needed to handle a report.
- NXLVL staff can, when needed to investigate a problem or a report, view NXLVL as your account sees it, including your messages. Only staff given that permission can do it, and every time they do it is recorded in our audit log.
- Nobody else sees your email address, date of birth, gender, or IGNs unless you share them yourself (for example, by sending your IGN in a chat).
5. Service providers we use
These companies process data for us, only to provide their service, under agreements that require them to protect it:
- Railway (hosting, Singapore) and Neon (database, Singapore): all account and content data.
- Upstash (Singapore): short-lived data, such as your sign-up details for up to 20 minutes before your email is verified, a pending email-address change, and rate-limit counters.
- Cloudflare: stores and delivers uploaded images and files (R2) and videos (Stream).
- Resend: sends account emails, so it receives your email address and the email's content.
- Sentry (United States): error reports, and replays of a small sample of sessions with all text hidden.
- PostHog (United States): product analytics, as described below.
- Inngest: runs background jobs such as reminders and welcome emails.
- Your browser's push service (Google, Apple or Mozilla) if you turn on push notifications. Messages are encrypted so the push service cannot read them.
- Google and GitHub, if you choose to sign in with them.
We may also disclose information when the law requires it, to protect someone's safety, or as part of a transfer of NXLVL to a new operator, who would be bound by this policy.
6. International transfers
Your data is stored mainly in Singapore. Some providers above process it in the United States or elsewhere. When data leaves the Philippines, we rely on the provider's contractual commitments to protect it to a standard comparable to Philippine law.
8. Analytics and error reports
When you are signed out, we measure visits anonymously without storing any cookie. When you are signed in, which you agree to when you accept these terms, PostHog records which pages and features you use, linked to your account ID (not your name or email), so we can see what works and what does not.
When something breaks, Sentry receives an error report with technical details. It also records a replay of about 5% of sessions, and of sessions where an error happens, with every piece of text on the page hidden.
9. How long we keep it
- Your account and content: until you delete them or close your account.
- After you close your account: your profile, posts, comments and messages are deleted. Your entries in past tournaments stay in organizers' records under "Deleted user", without your name or the answers and payment proof you submitted. Screenshots and videos you submitted as match results stay with that tournament's results, because organizers rely on them to settle disputes. Pictures you uploaded for an organization, team or tournament stay while they are still shown there. Backups that still contain your data expire within 7 days.
- Security and audit records: up to 2 years.
- Moderation records: as long as needed to keep the community safe, for example to recognise someone returning after a ban.
- Sign-in codes and links: they stop working after 15 minutes (codes) or 1 hour (password reset links), and expired ones are cleared out regularly. Sign-in sessions last up to 24 hours.
- Unfinished uploads: deleted after 24 hours.
10. Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your data is used (this page);
- access your data and get a copy in a portable format (Settings → Security → Your data);
- correct it (most details can be changed in your profile settings, or ask us);
- have it deleted, by deleting your account (Settings → Security → Delete account);
- object to processing based on our legitimate interests;
- be compensated for damage caused by misuse of your data; and
- complain to the National Privacy Commission.
You can download your data and delete your account yourself, any time, in your settings. For anything else, or if you can't sign in, email support@nxlvl.online. To protect your account, we reply to the email address on your account to confirm the request came from you before we act on it. We will answer within 30 days.
11. Children
NXLVL is not for children under 13, and we delete accounts we learn belong to someone under 13. Users aged 13 to 17 need a parent or guardian's permission. A parent or guardian can contact us at support@nxlvl.online to ask about, or delete, their child's account.
12. How we protect it
Passwords are hashed with Argon2, all traffic is encrypted, database rules limit each account to what it is allowed to see, and sensitive actions are logged and rate-limited. No system is perfectly secure: if we learn of a breach that puts you at risk, we will tell you and the National Privacy Commission as the law requires. To report a security problem, see Support.
13. Changes to this policy
When we make an important change, we will update the effective date above and ask you to accept the new version the next time you use NXLVL.
14. Contact
Questions or requests about your privacy: support@nxlvl.online.