Statutory Directives, Terms of Service & Privacy Protocol
1. Terms of Service & Operative Agreement
1.1 Acceptance of Terms
By enrolling as an operative, creating an investigation account, participating in multiplayer syndicates, or accessing the NoShitSherlock platform ("the Service"), you enter into a legally binding contract governed by these Terms of Service. If you do not agree with all provisions stated herein, you must not access or use the platform.
1.2 Age Eligibility & Statutory Capacity
The Service is designed strictly for individuals aged 13 years and older. In compliance with the Children's Online Privacy Protection Act (COPPA), the UK GDPR, and corresponding international regulations, minors under 13 years of age are expressly prohibited from registering an account or transmitting personal identifying information. By confirming enrollment, you represent and warrant under penalty of perjury that you have reached at least 13 years of age.
1.3 Account Responsibilities & Operative Credentials
Operatives are solely responsible for maintaining the confidentiality of their account credentials, including email, passwords, authentication tokens, and unique 3-digit Agent Tags. Any activity, deduction submission, or leaderboard event occurring under your registered identity is deemed your own. You agree to notify administrators immediately of any unauthorized access or security breach.
1.4 Service Availability & Modifications
NoShitSherlock reserves the right to modify, suspend, or discontinue any case file, leaderboard feature, or technical interface at any time without prior liability. Periodic database resets during pre-release and beta testing phases may clear runtime session progress while preserving your account identity.
2. Privacy Policy & Information Disclosure
2.1 Information We Collect
We collect only the minimum required information necessary to provide an authentic, competitive, and authenticated investigation experience:
- Identity Credentials: Email address, display callsign (username), and assigned 3-digit Agent Tag.
- Third-Party OAuth Data: When authenticating via Google or GitHub, we receive your verified profile email, account ID, and verified status. We never access your contacts or external repositories.
- Investigation Runtime Records: Case progression, deduction timestamps, score tallies, hint consultations, and pinboard sequence placements.
- Technical Telemetry: Anonymized session tokens, browser client user-agents, and IP addresses utilized strictly for fraud prevention, rate-limiting, and session validation.
2.2 How We Use Your Information
Your data is utilized strictly to:
- Authenticate your identity across devices and preserve your active case files.
- Compute authoritative leaderboard scores and team syndicate achievements.
- Enforce anti-bruteforce safeguards and prevent automated solution spamming.
- Deliver case file dispatches, game releases, and operational updates when you have expressly opted into our mailing announcements.
2.3 Non-Sale of Personal Data
NoShitSherlock does not sell, rent, monetize, or trade operative personal data, email addresses, or gameplay habits to third-party advertisers or data brokers under any circumstances.
3. Data Processing & Retention Policy
3.1 Data Controller & Infrastructure
User records, authentication credentials, and game state are stored within encrypted PostgreSQL 17 databases hosted on Neon Serverless Cloud architecture. Communication between your browser and our servers occurs exclusively over TLS 1.3 encrypted HTTPS tunnels.
3.2 Data Retention & Right to Erasure (GDPR Art. 17)
Your operative records are maintained for as long as your account remains active. You possess the unconditional statutory right to request full account erasure. Upon written request or automated account deletion, your user entity, session records, team memberships, and personal gameplay progress are permanently wiped via atomic database cascade deletion.
3.3 Cookie Protocol & Session Management
We utilize strictly necessary HTTP-only authentication cookies ("better-auth.session_token") to authenticate requests and protect against Cross-Site Request Forgery (CSRF). We do not employ third-party tracking cookies, marketing pixels, or invasive surveillance scripts.
4. Investigation Rules & Anti-Tampering Protocol
To maintain the integrity of our Central Clearance Registry and competitive leaderboards:
- Server-Authoritative Validation: All deduction outcomes, correct answers, and clue sequences reside solely within our departmental backend. Correct answers never transit to the browser prior to verification.
- Prohibition on Automated Solvers: The deployment of scraping tools, headless bot runners, artificial rate-limit bypasses, or scripted brute-force dictionary attacks is strictly prohibited.
- Team Syndicate Synchronization: Squad sessions reflect shared investigative progress. Concerted cheating or coordinated abuse will lead to team disqualification and revocation of operative credentials.