Privacy Policy

Nostamia is a Nepal-based digital storefront for video games, digital subscriptions, and in-game currency top-ups. This Policy applies when you browse our website, create an account, place an order, use My Collection, or contact support.

By using Nostamia, you acknowledge the practices described here. This Policy does not govern third-party websites or services that have their own privacy notices.

Account information: name, email address, user identifier, authentication provider, and account timestamps. Passwords are processed by Supabase Auth; Nostamia does not store readable passwords.

Order information: product, price, order UUID, payment provider, status, purchase and payment timestamps, and gateway reference. For top-ups we also collect the player or character ID and server/region you submit.

Technical information: essential session cookies, IP address and request/device information ordinarily produced when accessing a web service, plus security and error logs needed to protect and operate the platform.

Support information: messages and details you voluntarily send through WhatsApp, Instagram, or another announced support channel. Those services independently process your account and message data.

• Create and secure accounts; authenticate email/password and Google users.
• Validate orders, preserve exact prices, verify payments, fulfil digital products and top-ups, and display successful purchases.
• Prevent fraud, unauthorized access, payment abuse, and incorrect top-up delivery.
• Provide customer support, investigate disputes, and keep transaction records.
• Maintain performance, diagnose failures, comply with legal obligations, and enforce our Terms.
• Send transactional messages. We will not use your contact details for unrelated marketing without an appropriate choice or consent.

Payments may be handled by eSewa or Khalti. Nostamia sends the server-verified order amount, order reference, and necessary transaction details to the selected provider. Card, wallet PIN, OTP, and full payment credentials are entered with the provider and are not intended to be stored by Nostamia.

We receive status and reference information needed to confirm whether a transaction succeeded. A product enters My Collection only after a verified successful status.

We disclose only information reasonably necessary to operate the service: Supabase provides hosting, database, and authentication; Google provides optional sign-in; eSewa and Khalti process payments; WhatsApp and Instagram provide optional support channels; and infrastructure providers may process technical requests.

We may disclose information when required by Nepalese law, lawful process, fraud prevention, protection of users, or a business transfer. We do not sell personal information.

We use essential cookies to maintain Supabase customer sessions and a separate secure, HTTP-only administrator session. These are necessary for requested authentication and security functionality. We do not currently describe or deploy advertising cookies.

If analytics or marketing technologies are added later, this Policy and any required consent controls should be updated before deployment.

Account data is kept while your account remains active. Order, payment reference, fulfilment, fraud-prevention, and dispute records may be retained for the period reasonably required for support, accounting, legal compliance, and establishment or defence of claims.

Top-up identifiers should be retained only as long as required to fulfil and evidence the order. Backups and security logs may remain for a limited additional period before deletion or anonymization.

We use access controls, encrypted transport, Row-Level Security, server-side price validation, restricted administrator sessions, and payment verification. No internet system is completely secure, so users should use unique passwords, protect their devices, and report suspected unauthorized access promptly.

You may request access to, correction of, or deletion of appropriate account information; withdraw consent where processing depends on consent; object to certain uses; or ask questions about retention and disclosure. Some transaction records may be retained where legally or operationally required.

You can disconnect Google sign-in through your Google account and can avoid WhatsApp or Instagram by requesting another published support channel. Account deletion requests must be verified to protect the account holder.

Nostamia is not directed to children who cannot lawfully enter a digital purchase or provide the required information without a parent or guardian. A parent or guardian who believes a child submitted personal information without authorization should contact us for review.

Some service providers may process information outside Nepal. Their terms, safeguards, and applicable laws may differ. Links to game publishers, payment providers, Google, WhatsApp, Instagram, or other services are governed by those parties’ privacy practices.

We may update this Policy when the service, providers, or legal requirements change. Material updates will be identified by a revised date and, where appropriate, an additional notice. We aim to handle personal information consistently with applicable Nepalese privacy, consumer-protection, and electronic-transaction requirements.