Legal

Privacy Policy

Last updated September 7, 2026

This policy explains what information NukeSimulation.com uses when you run the simulator, search for a place, or buy Pro. The first-run disclaimer is also our cookie notice: you cannot use the simulator until you accept.

Open the 3D simulator

The controller is the operator of NukeSimulation.com. For privacy requests, email support@nukesimulation.com.

What this site does with information

You can use the free simulator without creating an account. We do not ask for a name. We collect the least we need to run the globe, estimate casualties, take payment for Pro, and understand how the site is used.

Information we process

When anyone uses the site

Connection data. Our host, Cloudflare, sees your IP address, browser, approximate location derived from IP, and the pages or APIs you request. We use this to serve the site, keep it up, and investigate abuse.
Place search. If you type a city or place, your browser sends that query to Komoot Photon (OpenStreetMap data) so we can suggest locations.
Casualty estimates. When a burst is on the globe, the browser asks our server for an estimate. That request includes the hypocenter coordinates and simplified blast/thermal radii. We cache results so repeat queries are cheaper. We do not attach them to a named account.
Camera position. The address bar can hold a map pose (#@lat,lng,...) so you can share a view. That stays in your browser unless you share the link.
Disclaimer choice. After you accept the educational disclaimer, we store a flag in your browser’s local storage so we do not show it every visit.
Analytics. The site loads DataFast, which uses cookies to recognise returning visitors. After the globe is visible, the browser also pings our Worker about once a minute so the leaderboard can show how many people are online. That ping sets no cookie. We store a hash of the connecting IP for about 10 minutes, then delete it. One network address counts as one person. A page view is stored in Cloudflare Analytics Engine when the page's own script runs, not when the HTML document is served. The connecting IP is not the visitor id. We store a random visitor id from a first-party cookie named nsim_visitor, kept for about 90 days, plus the country, the city, and that city's approximate latitude and longitude. The coordinate is a city center from the network address, not a street address. We also store the page path and the referring site as the browser reports them for that navigation. From the browser's user agent we keep the operating system, the browser name, and whether the device is a phone, tablet, or computer, not the full user-agent string. When the link includes them, we store the campaign tags utm_source, utm_medium, and utm_campaign, so we can chart visitors, place them on a map, and see which pages, sites, and campaigns send people in. While the simulator tab is visible, about once a minute and again when you leave, the browser reports how many seconds that visit has been in the foreground. A random visit id for that tab is kept in sessionStorage and replaced after 30 minutes away, or when the tab closes. We store a hash of that id together with a hash of the connecting IP and the number of seconds. Time in a background tab is not counted. Each HTML page also sets a first-party cookie named nsim_sid for 30 minutes. It holds a random visit id so we can tell a visit that leaves after one page from one that opens another page, detonates, or starts Pro. Later pages and those actions refresh it. The first HTML page of a visit also sets a first-party cookie named nsim_touch for about 90 days. It stores that page's channel, referring site, path, campaign tags, country, operating system, browser, and device type, and later pages on this site do not replace it. Opening Pro, starting checkout, and completing a purchase are stored the same way, with the plan, price, and that IP hash. A completed purchase also stores the labels from that cookie, so revenue can be grouped by the visit that arrived. When you detonate, the browser also posts a first-party detonate event to our Worker with a city-level place name, country, weapon name, and coordinates rounded to two decimal degrees (roughly city-block to neighbourhood scale, not a street address). Country totals feed the on-site leaderboard. The event itself is stored in Cloudflare Analytics Engine.

When you buy or restore Pro

Checkout. Polar Software, Inc. is the merchant of record. Polar (and its payment processor) collects the payment details, email, billing country, and IP address needed to sell Pro, invoice you, and collect tax. We send Polar the Cloudflare connecting IP when checkout starts so tax and fraud checks work.
Entitlement. After a paid order we store Polar’s customer id, your email, Pro expiry, and ids that prevent granting the same payment twice. That lives in Cloudflare KV on our Worker.
Session cookie. After checkout or a successful email sign-in we set a first-party nsim_session cookie (HttpOnly, SameSite=Lax, up to 180 days). It holds a signed customer id and email so the browser can keep Pro without sending a password. This cookie is only set when you actually sign in or complete a purchase.
Sign-in codes. If you restore Pro, we email a one-time 6-digit code through Loops. We hash the code and store it briefly (about 10 minutes) with a short cooldown. Loops is told not to add you to a marketing audience.
Photorealistic 3D. Pro map tiles come from Google. Your browser requests those tiles from Google using an API key our server gives Pro sessions. Google then processes whatever its Maps Platform terms and privacy policy cover, including the area you are viewing.

We do not read the contents of your payment card. Polar’s customer portal (“Receipts” in the Pro dialog) is the place for invoices and payment-method changes.

Why we use it

To provide the simulator you asked to use (including search and estimates).
To sell, deliver, and restore Pro, and to revoke it if Polar refunds an order.
To keep the service secure and to understand which places and weapons people simulate.
To meet tax, accounting, and fraud obligations that Polar handles as reseller.

Where GDPR or similar laws apply, those purposes rest on performing a contract (running the sim and Pro), legitimate interests (security, cached estimates), consent (analytics cookies, via I understand on the first-run disclaimer), and legal obligation (records Polar must keep).

Cookies and similar storage

nsim_session — first-party, HttpOnly, set only after Pro checkout or email sign-in. Needed to keep you signed in. Maximum age 180 days.
nsim_touch — first-party, HttpOnly, set on the first HTML page of a visit. Remembers the channel, referring site, landing path, campaign tags, country, operating system, browser, and device type so a later Pro purchase can be attributed to that visit. Maximum age 90 days. Later pages do not replace it.
Disclaimer flag — localStorage key nukesimulation.disclaimer.v4. Remembers that you accepted the disclaimer, terms, and analytics cookies. Not a cookie.
DataFast — third-party analytics cookies from datafa.st. Used to recognise returning visitors and attribute usage. You accept these by clicking I understand on the first-run disclaimer.
Online count — not a cookie. About once a minute the simulator pings our Worker. We keep a hash of the connecting IP for about 10 minutes.
nsim_sid — first-party, HttpOnly, set on each HTML page. A random id for this visit, used to measure bounce rate. Maximum age 30 minutes, refreshed when you open another page, detonate, or start Pro.
Session length — not a cookie. sessionStorage key nsim.session holds a random visit id for this tab. It is cleared when the tab closes, and a new id starts after 30 minutes away. While the tab is visible we store how long that visit has been open.
nsim_visitor — first-party, HttpOnly, set when a page reports a visit. A random id so the same browser counts as one visitor across pages. Maximum age about 90 days, refreshed on later visits.
Page views — recorded when the page script runs, not when the HTML document is served. With the visitor id we store the country, the city, the city's approximate coordinates, the page path, the referring site, the operating system, the browser, the device type, and any utm_source, utm_medium, and utm_campaign tags on the link.

Cloudflare or Polar may also set cookies on their own domains when you hit their networks or checkout pages. Polar’s checkout is Polar’s service, under Polar’s privacy policy.

The first-run disclaimer is also our cookie notice. You cannot use the simulator until you click I understand, which is consent for DataFast analytics cookies, the first-party nsim_touch, nsim_sid, and nsim_visitor cookies, the cookieless online-count ping, and the session-length report. You can still block or delete cookies in your browser; the simulator still works, but Pro sign-in will not persist without nsim_session.

Who else sees it

Cloudflare — hosting, DNS, caching, Worker logs, and Analytics Engine for detonation events.
DataFast (JustShipIt Pte. Ltd.) — analytics. DataFast may process data on infrastructure outside the EU, including the United States.
Polar Software, Inc. — checkout, invoices, tax, refunds, and the customer portal. See Polar’s buyer terms and privacy policy.
Loops — transactional sign-in emails only.
Komoot Photon — place search and reverse geocoding from your browser.
Google — photorealistic 3D tiles if you use Pro 3D. See Google’s privacy policy.

We do not sell your personal information, and we do not use it for our own advertising. We do not put sign-in emails on a newsletter.

Population numbers on screen come from WorldPop 2020 data we host ourselves. That dataset is about where people live in aggregate. It is not a file of your personal details.

How long we keep it

Worker and CDN caches for casualty estimates: about 7 days.
Sign-in codes: about 10 minutes, then deleted.
Session cookie: until it expires (up to 180 days) or Pro lapses and we clear it.
Entitlement records (email, Polar customer id, expiry, payment grant ids): for as long as we need them to honour Pro, process refunds, and prevent double grants.
DataFast analytics: according to DataFast’s retention for our site.
Online-visitor IP hashes: about 10 minutes.
Pageview events in Cloudflare Analytics Engine: about 3 months.
Session-length samples in Cloudflare Analytics Engine: about 3 months.
First-visit attribution cookie: about 90 days, or until you delete it.
Visit cookie used for bounce rate: about 30 minutes, or until you delete it.
Purchase attribution stored with a Pro goal: about 3 months.
Detonation events in Cloudflare Analytics Engine: about 3 months.
Payment records: Polar keeps what a merchant of record must keep.

International transfers

The site is served from Cloudflare’s network. Polar, DataFast, Loops, Google, and Photon may process data in the United States and other countries. Where a law requires safeguards for those transfers, we rely on the contracts those providers offer (including Standard Contractual Clauses where they use them).

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or export personal data, to object to or restrict certain processing, and to complain to a data protection authority. Email support@nukesimulation.com and we will handle the request or point you to Polar when the data lives in Polar’s systems (payments, invoices, card details).

If you are in the EEA, UK, or Switzerland, you can also lodge a complaint with your local supervisory authority. California residents can request the categories of information we collect and ask us not to sell or share personal information; we do not sell it.

Children

The site is not directed at children under 16. Do not buy Pro if you are under 18. We do not knowingly collect personal information from children. If you think we have, email us and we will delete it.

Changes

If this policy changes in a material way, we will update the date above and post the new version at this URL. Continued use after an update means the new policy applies, except where a law requires us to ask again.

Questions: support@nukesimulation.com · About · FAQ · Terms of Use · Back to the simulator