PRIVACY POLICY

Last updated: March 4, 2026

CONTENTS

1. GENERAL PROVISIONS
2. WHAT DATA WE COLLECT
3. PURPOSES AND LEGAL BASES FOR PERSONAL DATA PROCESSING
4. TRANSFER OF PERSONAL DATA TO THIRD PARTIES
5. DATA STORAGE LOCATION AND PROCESSING PERIODS
6. PERSONAL DATA SECURITY
7. USER RIGHTS
8. CHILDREN AND AGE RESTRICTIONS
9. CROSS-BORDER TRANSFER OF PERSONAL DATA
10. DO NOT TRACK SIGNALS
11. CHANGES TO THE PRIVACY POLICY
12. CONTACTS AND REQUESTS

1. GENERAL PROVISIONS

This Privacy Policy (the "Policy") regulates the procedure for processing and protecting personal data of users (the "User") when using the website https://spaceclipse.com and the Spaceclipse game (together, the "Services"), and also defines Users' rights regarding their personal data.

The personal data operator is:

• Full name: Ilya Grigoryevich Tkachenko, individual
• TIN: 230812699299
• Privacy inquiries email: privacy@spaceclipse.com

Personal data is processed in accordance with Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" and other applicable laws of the Russian Federation. For Users from other countries, the Operator takes reasonable data protection measures corresponding to the applicable legislation.

This Policy does not apply to the use of cookies. That matter is governed by a separate Cookie Policy available at: https://spaceclipse.com/legal/cookies.

Consent to personal data processing is provided by the User by ticking the relevant checkbox during account registration on the website.

Without such consent, registration and use of personalized features of the Services are not possible.

2. WHAT DATA WE COLLECT

2.1. Data Provided by the User

When registering and using the Services, the User provides the following data:

• Email address, used for account login, registration confirmation, and service notifications;
• Username, nickname, displayed in the game and in the account area;
• Password, stored only in hashed form; the Operator does not have access to the password in plain text.

The User must provide accurate and up-to-date data. The Operator does not verify its accuracy but relies on the User's good faith.

2.2. Data Collected Automatically

When the Services are accessed, the following technical information is collected automatically:

• IP address and approximate location, at the country and city level, determined by IP;
• Browser type and version, operating system, and device characteristics;
• Date, time, and duration of sessions, visited pages, and actions on the website;
• Referrers, meaning the source from which the user came to the website;
• Server log file data.

2.3. Game Data

During gameplay in Spaceclipse, the Operator collects and processes:

• Game statistics, including score, levels, achievements, battle results, and other gameplay activity indicators;
• Logs of gameplay actions, including movement and interactions with in-game objects and other players;
• In-game chat messages, for the purpose of enabling communication between players and moderation.

Please note that chat messages are visible to other game participants within the functionality provided by the game mechanics.

Chat messages may be processed by automated tools or moderators to enforce the Service rules, prevent violations of the law, and protect the rights of other users.

2.4. Bot Protection System Data (Cloudflare Turnstile)

When actions are performed on the website, including registration, login, and other forms, the Cloudflare Turnstile service is used to protect against automated abuse. The service automatically analyzes technical signals including the IP address, TLS fingerprint, User-Agent header, and form identifier. This processing is carried out by Cloudflare, Inc. (USA); the company does not identify the User based on this data.

2.5. Data Collected by the Anti-Fraud Protection System (Anti-Cheat)

If an anti-cheat system is implemented, the game client and/or launcher may collect and process technical data necessary to detect and prevent cheating and other abuse. Such data may include, without limitation:

• Hardware configuration details, including CPU model, amount of RAM, and OS characteristics;
• A list of running processes and their names;
• Checksums and hashes of certain game client files;
• Selective snapshots, meaning fragments, of RAM for integrity verification and detection of injected modules;
• Information about client file versions and integrity;
• Unique device identifiers, to the extent necessary to protect against account substitution.

Note: if third-party anti-cheat providers are used, the Operator will specify their names and links to their privacy policies in the section "Transfer of Personal Data to Third Parties."

3. PURPOSES AND LEGAL BASES FOR PERSONAL DATA PROCESSING

The Operator processes Users' personal data solely on lawful grounds provided by Federal Law No. 152-FZ "On Personal Data." The main purposes of personal data processing and their corresponding legal bases are set out below.

• Performance of an agreement, including the EULA and Terms of Service, for registration, account management, operation of the Services, interaction between players, and handling of User inquiries;
• The Operator's legitimate interest under paragraph 7, part 1, article 6 of Federal Law No. 152-FZ, for security, prevention of abuse, analytics, and improvement of the Services, provided that the User's rights are not infringed;
• User consent, for newsletters and update notifications;
• Compliance with the Operator's legal obligations under the laws of the Russian Federation.

4. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

The Operator does not sell or transfer Users' personal data to third parties for advertising or commercial purposes.

Personal data may be transferred to the following parties:

• Cloudflare, Inc. (USA). As regards technical signals collected by Cloudflare Turnstile to protect forms against automated attacks. Cloudflare does not identify the User from this data. Such transfer is necessary for performance of the agreement and to ensure security of the Services. More details: https://www.cloudflare.com/turnstile-privacy-policy/.
• Government authorities. The Operator may disclose personal data upon lawful requests from authorized public authorities in the manner established by the laws of the Russian Federation. Where possible, if not prohibited by law or investigative restrictions, the Operator will notify the User of such request.
• The Operator's legal successors. In the event of reorganization, sale of the business, or transfer of rights to the Services, personal data may be transferred to the legal successor solely under the conditions of this Policy.

In all other cases, personal data is not transferred without the User's explicit consent.

5. DATA STORAGE LOCATION AND PROCESSING PERIODS

5.1. Storage Location

Servers on which Users' personal data is stored are located in the Russian Federation, which complies with the requirements of article 18.1 of Federal Law No. 152-FZ.

Part of the data may be processed by Cloudflare on servers outside the Russian Federation, including in the United States. In such cases, the Operator ensures reasonable data protection measures in accordance with applicable law.

5.2. Retention Periods

All categories of personal data are stored for the duration of the account and after its deletion subject to the following periods:

• Basic account data deletion period: personal data such as email, nickname, password hash, newsletter data, and marketing preferences is blocked and then deleted or anonymized within 30 calendar days after account deletion;
• Technical copies and backup systems: backup copies of data and technical logs may be retained for up to 90 calendar days after account deletion to ensure stability and recovery of the Services;
• Legally justified retention of certain information: certain data needed to protect the Operator's rights and legitimate interests, including IP addresses, information about User violations, and login history, may be retained for up to 12 months after account deletion.

After these periods expire, the data is deleted or anonymized unless otherwise required by the laws of the Russian Federation. If deletion is impossible because the data is stored in backup copies, such data is isolated from further processing until its scheduled destruction.

5.3. Account Deletion

The User may delete the account at any time by sending a request to privacy@spaceclipse.com.

After the account deletion request is received:

• account data is blocked immediately;
• personal data is deleted or anonymized according to the periods specified in section 5.2, meaning 30 days as the basic period, 90 days for backups, and 12 months for legally justified retention of certain information.

Messages posted in the general game chat before account deletion may be retained in anonymized form and are subject to deletion or anonymization within the periods established by section 5.2.

6. PERSONAL DATA SECURITY

The Operator takes organizational and technical measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. In particular:

• Passwords are stored only in hashed form and are not available in plain text;
• Data transmission between the User and the Services is carried out over the secure HTTPS protocol;
• Access to personal data is limited and granted only to the extent necessary to perform a specific function;
• A system protecting against automated attacks, Cloudflare Turnstile, is used.

At the same time, the Operator cannot guarantee absolute security of data transmitted over the Internet. The User must independently ensure confidentiality of the User's credentials, meaning login and password, and immediately notify the Operator of any unauthorized access at privacy@spaceclipse.com.

If a security incident involving unlawful access to personal data is identified, the Operator takes measures to localize and eliminate the consequences of the breach, and also notifies the authorized authority for the protection of personal data subjects' rights and, where necessary, affected Users in the manner established by the laws of the Russian Federation.

7. USER RIGHTS

7.1. Rights of Users Who Are Residents of the Russian Federation

In accordance with Federal Law No. 152-FZ, the User has the right to:

• receive confirmation that the User's personal data is being processed and obtain access to it;
• require clarification, update, or correction of incomplete, outdated, or inaccurate data;
• require termination of processing and/or destruction of personal data in cases provided by law;
• withdraw previously given consent to personal data processing;
• object to the processing of personal data;
• appeal the Operator's actions to the Federal Service for Supervision of Communications, Information Technology and Mass Media, Roskomnadzor.

7.2. Users from Other States

The Operator conducts its activities primarily within the Russian Federation and does not specifically target the Services at users from the European Union or other foreign jurisdictions.

If foreign personal data protection laws apply to a particular User, such User requests are considered individually and within reasonable periods taking into account applicable legal norms and the technical capabilities of the Services.

7.3. How to Exercise Rights

To exercise rights, the User sends a request to privacy@spaceclipse.com. The request must specify the nickname or email address associated with the account, as well as a description of the requested action. The Operator reviews requests within a period not exceeding 30 calendar days from the date of receipt of a complete request. The period may be extended up to 60 days if there are objective grounds, with notice to the applicant.

Fulfillment of a request may be limited where the processing of data is necessary to comply with legal requirements or to protect the Operator's legitimate interests.

8. CHILDREN AND AGE RESTRICTIONS

The Services are intended for persons who have the legal capacity and active legal capacity necessary to conclude user agreements and provide consent to personal data processing in accordance with the laws of their country of residence. The Services are not intended for persons under the age of 14 in the Russian Federation.

By registering in the Services, the User confirms that the User has reached the age allowing independent consent to personal data processing and conclusion of user agreements under the laws of the User's country.

If the User has not reached the age of full legal capacity, registration and use of the Services are allowed only with the consent of a parent or other legal representative. In such case, the legal representative accepts this Policy and other documents governing the use of the Services on the legal representative's own behalf and bears responsibility for the actions of the minor User.

The Operator does not intentionally collect personal data of persons who do not have the necessary legal capacity. If the Operator becomes aware that such person registered without proper consent of a legal representative, the relevant account may be blocked until the circumstances are clarified or deleted.

9. CROSS-BORDER TRANSFER OF PERSONAL DATA

Because Cloudflare services, based in the United States, are used, certain technical data such as IP address, connection parameters, and technical identifiers may be processed temporarily outside the Russian Federation.

Such processing is carried out solely for purposes of ensuring information security of the Services and preventing automated abuse, is necessary for performance of the agreement with the User, and constitutes the Operator's legitimate interest in protecting the Services.

The main personal data of Users is stored on servers located in the Russian Federation.

By accepting this Policy, the User consents to the cross-border transfer of personal data within the framework of the use of Cloudflare services.

10. DO NOT TRACK SIGNALS

At present, there is no single technical standard for processing Do-Not-Track, or DNT, signals sent by browsers. The Operator does not process such signals automatically. If an appropriate industry standard is adopted, this Policy will be updated.

11. CHANGES TO THE PRIVACY POLICY

The Operator may amend this Policy. The current version is published at https://spaceclipse.com/legal/privacy and indicates the effective date. If material changes are made, Users are notified by posting a corresponding notice on the website or by email. Continued use of the Services after the new version takes effect means acceptance of its terms.

12. CONTACTS AND REQUESTS

For all matters related to the processing of personal data, the User may contact the Operator:

• Email for privacy inquiries: privacy@spaceclipse.com
• Operator: Ilya Grigoryevich Tkachenko, individual, TIN 230812699299

The period for review of requests is up to 30 calendar days from the date of receipt.