// Privacy
What these sites collect
This covers nebulagames.ch, superpositionvr.com, playbombvr.com and arcaneriftvr.com. They are marketing sites for our games. There are no accounts, no sign-ups, no newsletter and no purchases, so we never ask you for your name, your email address or anything else about you.
What we do use is website analytics, and on one site an optional session recording that only runs if you say yes. The detail is below.
Who is responsible
Nebula Games [TO CONFIRM: registered entity name and postal address], Switzerland. Questions, or any request about your data: [email protected].
Google Analytics — on all four sites
We use Google Analytics 4 to count visits and see which pages and games people look at. Each site reports to its own data stream. It is how we know whether anyone reads a page or plays the little browser games at the bottom of them.
It collects, via cookies set in your browser:
- pages you view on the site, and when
- roughly where you are, derived from your IP address — Google shortens the address before storing it, so this is city-level at best
- your device, browser and screen size
- the site or search that sent you here
- clicks on outbound links, file downloads and video plays
- if you play one of the browser games: that it started, that it ended, how it ended and how long it lasted — the game itself, never anything about you
It is a random identifier in a cookie, not your identity. We never upload your email address or any other identifier to Google, and we do not use Google Signals, advertising features or remarketing.
Analytics currently runs without asking you first. We think that is proportionate for plain visitor statistics on a site that sells nothing and asks you for nothing, and Swiss data protection law leans on telling you clearly — which is what this page is for — rather than on a consent pop-up. If you would rather not be counted, the opt-out below works on every site that uses Google Analytics, not only ours.
Google’s analytics opt-out add-on
Blocking cookies or using a tracker-blocking extension also works, and nothing on these sites breaks if you do. Google processes this data in the United States under its standard contractual clauses. Google’s own explanation is in their privacy policy and their note on how Analytics uses data.
Session recording — only on superpositionvr.com, and only if you agree
That one site can record what you do on the page: mouse movement, clicks, scrolling, and a replay of your visit. We use it to find the parts of the page that confuse people. It is done by Contentsquare (formerly Hotjar).
Nothing is recorded unless you press “Allow” on the banner. Watching someone move around a page is closer to observation than to counting, so it asks first. Say no, or ignore it, and the recorder is never loaded at all. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as a no and do not even show you the banner.
Your choice is remembered on your own device and nowhere else. To change it, clear this site’s data in your browser and the banner will ask again.
Things stored on your device
These stay in your browser. They are never sent to us and we cannot read them.
nebula.consent— whether you allowed session recordingsuperposition.depth,bombvr.wins,arcanerift.wave— your best score in the browser games
Clearing your browsing data removes them.
Other companies these pages touch
- Cloudflare hosts the sites and serves every page. It handles your IP address to do that, and keeps short-lived logs for security.
- Google Fonts supplies the typeface. Your browser fetches it from Google, so Google sees your IP address when a page loads.
- Valve — superpositionvr.com embeds a Steam store widget, which is a small window onto Steam. Valve may set its own cookies inside it.
Links out to the Meta Quest Store, Steam or LinkedIn are ordinary links. Once you follow one you are on their site under their privacy policy, not ours.
How long it is kept
Analytics data is kept for the retention period set on our Google Analytics property [TO CONFIRM: current setting], after which Google deletes the user-level records; aggregate reports remain. Session recordings are kept by Contentsquare under their own retention schedule. Scores in your browser stay until you clear them.
Your rights
Under the Swiss Federal Act on Data Protection, and the GDPR if you are in the EU or the EEA, you can ask for a copy of the data relating to you, ask us to correct or delete it, or object to it being processed at all. Write to [email protected] and we will answer.
In practice we hold no way to identify you, so for most requests the honest and most effective route is the Google opt-out above and clearing your browser data — that removes you from the only records that exist. If you are not satisfied with how we handle a request you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to your national supervisory authority in the EU/EEA.
Children
Bomb VR is a family game and we expect younger visitors. These sites do not ask anyone for personal information, and we do not knowingly build profiles of children. If you believe a child’s data has reached us, write to us and we will delete it.
Changes
If we add anything that collects data, this page changes before it goes live. Last updated .