Legal

Privacy Policy

Last updated September 4, 2026

This policy explains what information NukeSimulation.com uses when you run the simulator, search for a place, or buy Pro. The first-run disclaimer is also our cookie notice: you cannot use the simulator until you accept.

The controller is the operator of NukeSimulation.com. For privacy requests, email support@nukesimulation.com.

What this site does with information

You can use the free simulator without creating an account. We do not ask for a name. We collect the least we need to run the globe, estimate casualties, take payment for Pro, and understand how the site is used.

Information we process

When anyone uses the site

Connection data. Our host, Cloudflare, sees your IP address, browser, approximate location derived from IP, and the pages or APIs you request. We use this to serve the site, keep it up, and investigate abuse.
Place search. If you type a city or place, your browser sends that query to Komoot Photon (OpenStreetMap data) so we can suggest locations.
Casualty estimates. When a burst is on the globe, the browser asks our server for an estimate. That request includes the hypocenter coordinates and simplified blast/thermal radii. We cache results so repeat queries are cheaper. We do not attach them to a named account.
Camera position. The address bar can hold a map pose (#@lat,lng,...) so you can share a view. That stays in your browser unless you share the link.
Disclaimer choice. After you accept the educational disclaimer, we store a flag in your browser’s local storage so we do not show it every visit.
Analytics. The site loads DataFast, which uses cookies to recognise returning visitors. We also send a detonate event with a city-level place name, country, weapon name, and coordinates rounded to two decimal degrees (roughly city-block to neighbourhood scale, not a street address).

When you buy or restore Pro

Checkout. Polar Software, Inc. is the merchant of record. Polar (and its payment processor) collects the payment details, email, billing country, and IP address needed to sell Pro, invoice you, and collect tax. We send Polar the Cloudflare connecting IP when checkout starts so tax and fraud checks work.
Entitlement. After a paid order we store Polar’s customer id, your email, Pro expiry, and ids that prevent granting the same payment twice. That lives in Cloudflare KV on our Worker.
Session cookie. After checkout or a successful email sign-in we set a first-party nsim_session cookie (HttpOnly, SameSite=Lax, up to 180 days). It holds a signed customer id and email so the browser can keep Pro without sending a password. This cookie is only set when you actually sign in or complete a purchase.
Sign-in codes. If you restore Pro, we email a one-time 6-digit code through Loops. We hash the code and store it briefly (about 10 minutes) with a short cooldown. Loops is told not to add you to a marketing audience.
Photorealistic 3D. Pro map tiles come from Google. Your browser requests those tiles from Google using an API key our server gives Pro sessions. Google then processes whatever its Maps Platform terms and privacy policy cover, including the area you are viewing.

We do not read the contents of your payment card. Polar’s customer portal (“Receipts” in the Pro dialog) is the place for invoices and payment-method changes.

Why we use it

To provide the simulator you asked to use (including search and estimates).
To sell, deliver, and restore Pro, and to revoke it if Polar refunds an order.
To keep the service secure and to understand which places and weapons people simulate.
To meet tax, accounting, and fraud obligations that Polar handles as reseller.

Where GDPR or similar laws apply, those purposes rest on performing a contract (running the sim and Pro), legitimate interests (security, cached estimates), consent (analytics cookies, via I understand on the first-run disclaimer), and legal obligation (records Polar must keep).

Cookies and similar storage

nsim_session — first-party, HttpOnly, set only after Pro checkout or email sign-in. Needed to keep you signed in. Maximum age 180 days.
Disclaimer flag — localStorage key nukesimulation.disclaimer.v4. Remembers that you accepted the disclaimer, terms, and analytics cookies. Not a cookie.
DataFast — third-party analytics cookies from datafa.st. Used to recognise returning visitors and attribute usage. You accept these by clicking I understand on the first-run disclaimer.

Cloudflare or Polar may also set cookies on their own domains when you hit their networks or checkout pages. Polar’s checkout is Polar’s service, under Polar’s privacy policy.

The first-run disclaimer is also our cookie notice. You cannot use the simulator until you click I understand, which is consent for DataFast analytics cookies. You can still block or delete cookies in your browser; the simulator still works, but Pro sign-in will not persist without nsim_session.

Who else sees it

Cloudflare — hosting, DNS, caching, and Worker logs.
DataFast (JustShipIt Pte. Ltd.) — analytics. DataFast may process data on infrastructure outside the EU, including the United States.
Polar Software, Inc. — checkout, invoices, tax, refunds, and the customer portal. See Polar’s buyer terms and privacy policy.
Loops — transactional sign-in emails only.
Komoot Photon — place search and reverse geocoding from your browser.
Google — photorealistic 3D tiles if you use Pro 3D. See Google’s privacy policy.

We do not sell your personal information, and we do not use it for our own advertising. We do not put sign-in emails on a newsletter.

Population numbers on screen come from WorldPop 2020 data we host ourselves. That dataset is about where people live in aggregate. It is not a file of your personal details.

How long we keep it

Worker and CDN caches for casualty estimates: about 7 days.
Sign-in codes: about 10 minutes, then deleted.
Session cookie: until it expires (up to 180 days) or Pro lapses and we clear it.
Entitlement records (email, Polar customer id, expiry, payment grant ids): for as long as we need them to honour Pro, process refunds, and prevent double grants.
Analytics: according to DataFast’s retention for our site.
Payment records: Polar keeps what a merchant of record must keep.

International transfers

The site is served from Cloudflare’s network. Polar, DataFast, Loops, Google, and Photon may process data in the United States and other countries. Where a law requires safeguards for those transfers, we rely on the contracts those providers offer (including Standard Contractual Clauses where they use them).

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or export personal data, to object to or restrict certain processing, and to complain to a data protection authority. Email support@nukesimulation.com and we will handle the request or point you to Polar when the data lives in Polar’s systems (payments, invoices, card details).

If you are in the EEA, UK, or Switzerland, you can also lodge a complaint with your local supervisory authority. California residents can request the categories of information we collect and ask us not to sell or share personal information; we do not sell it.

Children

The site is not directed at children under 16. Do not buy Pro if you are under 18. We do not knowingly collect personal information from children. If you think we have, email us and we will delete it.

Changes

If this policy changes in a material way, we will update the date above and post the new version at this URL. Continued use after an update means the new policy applies, except where a law requires us to ask again.

Questions: support@nukesimulation.com · Terms of Use · Back to the simulator