Policies

Privacy policy

Last updated 1 November 2026. See also the terms of use.

NESTS Satellite HQ is an unofficial, non-commercial fan site for The King of Fighters AFK, run by its admin. This page says what the site keeps about you, why, for how long, and who else sees any of it. The short version: it keeps what it needs to give you an account and keep it safe, shows no ads, runs no analytics or tracking, and sells nothing to anyone.

What the site keeps

Your account

• Username and password. Your password is never stored as you typed it: only a one-way hash of it (Argon2), which can check a password but can't be turned back into one.
• Two-factor sign-in, if you turn it on (admins always have it): the secret your authenticator app shares with the site, and your recovery codes, kept hashed.
• Email address, only if the admin has turned on email confirmation when you sign up. It is used to send you the link that confirms it and, if you ask, a link to choose a new password. Nothing else: no newsletters, no marketing.
• Account details: when you joined and last signed in, the invite key you joined with (if any), the access the admin has given you, your avatar and the look you picked.

What you add

• Saved teams, private to you unless you share one to the team library, where other members can see it with your name.
• Insights, ranks, roles and scores written by editors, and videos members share (a link with a title and description). Other members (and, while the admin lets visitors in without an account, anyone) can read these, with the name of who added them.
• The activity log: the admin page keeps a record of who changed ranks, roles and scores, who removed or edited someone else's insight, video or library team, and what the admin changed (the latest 5,000 entries).

Kept briefly, to keep accounts safe

• Sign-in attempts: to stop password guessing, the site counts recent attempts by IP address and by username. These counts are deleted after 24 hours.
• Server logs: like most web servers, it logs each request (your IP address, the time, the page asked for and the answer) to spot problems and abuse. These logs stay on the server and are cleared by its log rotation.

Cookies

The site sets only the cookies it needs, and none for tracking or advertising:

• kof_session: keeps you signed in. It holds a random code (the site keeps only a hash of it) and lasts 30 days for members, 12 hours for admins, or until you sign out.
• theme: remembers the look you picked, so this device's sign-in pages show it. Up to 400 days, or until you switch back to the standard look.

Your browser may also keep a few settings on your device (such as the team you're building and filters you've chosen); these never leave it.

Who else sees anything

• Fonts: the site's fonts are loaded from Google Fonts, so your browser asks Google's servers for them, which tells Google your IP address. See Google's privacy policy.
• Shared videos play from where they're hosted (YouTube's privacy-enhanced mode, Vimeo, Google Drive or Streamable). A video loads from that service when you open the page it's on, and that service's own policy applies.
• Email, when the site sends you one, goes out through the mail service the site uses (its own mail server, or Gmail), which handles the message to deliver it.
• Discord and Ko-fi are only links: nothing is sent to them unless you follow one.

Nothing about you is sold, rented or given to anyone else, except where the law requires it.

How long it's kept

Your account and what's in it stay until your account is deleted. Then your account, sessions, recovery codes and saved teams are deleted with it; insights and videos you added stay on the site without your name, and the activity log keeps the name as it was. Copies of the database made before an update to the site, and the server's own backups if it has any, can hold data for a while longer.

Your choices and rights

You can change your password, avatar and look, and turn two-factor sign-in on or off, on your account page. You can ask the admin to show you what the site keeps about you, correct it, or delete your account, through the site's Discord server. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may have further rights, such as to object to how your data is used or to complain to your data protection authority.

The site needs your account details to provide your account (the service you asked for), and keeps sign-in attempts and logs because it has a legitimate interest in keeping accounts and the site secure.

Children

The site isn't meant for children under 13 (under 16 where local law sets that age), and doesn't knowingly keep their data. If you think a child has an account, tell the admin and it will be removed.

Changes

If this policy changes, the date at the top changes with it, and anything significant is announced on the Discord server.