Last updated: 25 October 2026
Nullifier is a small independent clothing label. We collect as little about you as we can get away with, we do not sell it to anyone, and this page explains exactly what happens to what we do collect.
1. Who is responsible
This site is run by the holder of ABN 14 240 869 663, trading as Nullifier, in Australia. For privacy questions, email hello@nullifier.io.
2. What we collect
When you place an order: your name, email address, delivery address, phone number if you give one, and what you bought. We need all of it to print your order and get it to you.
Payment details: card and Afterpay payments are handled by WooPayments, which is run by Automattic on Stripe. Your card number never reaches our website and we never see or store it. We receive only a confirmation that payment succeeded, plus the last four digits for matching up orders. Paying in ADA or NIGHT is described below.
If you create an account: your email address, a password we store only as a one-way hash, your order history, and any pieces you save. Accounts are optional. You can buy as a guest and we would rather you did if it suits you.
If you join our mailing list: your email address, the time and page you signed up from, and a shortened form of your IP address as a record of your consent. Our newsletter provider also records whether you opened the emails.
When you browse: basic technical information such as your IP address, browser and pages viewed. This is ordinary web server activity and we use it to keep the site working and secure.
We do not collect anything about your race, health, politics, religion, sexuality or any other sensitive category, and we would ask you not to send it to us.
If you sign in with Discord
Discord sign-in is optional. If you use it, Discord tells us your Discord user ID, your name and your verified email address, whether you belong to our community server, and if you do, your eligible roles and the date you joined. We keep an encrypted token so we can re-check your membership later. Disconnecting Discord in your account, or deleting your account, removes the link and revokes that token.
If you link a wallet
If you link a Cardano wallet, we store its stake address, its payment address and the wallet’s name; the link is proven by a signature from the wallet. If you link a Midnight wallet, we store its address and the wallet’s name. We never hold your keys and cannot move anything in your wallet.
Midnight City and the Arena
Your avatar’s look is saved in your browser, and to your account when you are signed in. Trainer cards and game progress are saved to your account. In a match your opponent sees your trainer name, look and stats, never your email address or Discord details. Finished matches are deleted after 30 days.
If you pay in ADA or NIGHT
A crypto payment is a public transaction: the sending address, the amount and the time are visible to anyone on the blockchain, permanently, and that is outside our control. We keep the transaction ID and the amount with your order. To confirm a payment we look it up with Blockfrost (Cardano) or the Midnight indexer; they receive our receiving address and the transaction ID, not your details. Price lookups carry no personal data.
3. Why we have it
- to take, print and deliver your order
- to email you about that order
- to answer you when you contact us
- to handle returns and faults
- to keep the records the tax office requires
- to protect the site against fraud and abuse
- to send you marketing, but only if you asked for it
If you are in the UK or EU, our lawful bases are performance of a contract for order handling, legal obligation for tax records, consent for marketing, and legitimate interests for security and fraud prevention.
4. Who we share it with
Only the businesses we need to run the shop, and only the parts they need:
- Tapstitch prints, packs and ships your order, so it receives your name, delivery address, phone number if you gave one, and what you ordered. Tapstitch is registered in the United States; its privacy policy says it processes data in the United States and Canada, and it prints in Los Angeles and at facilities overseas.
- WooPayments (Automattic, using Stripe) processes card and Afterpay payments under its own privacy policy. We never see your full card number.
- MailerLite sends our newsletter. If you join the list, it receives your email address and when and where you signed up. When you are signed in and open your account details, we check your subscription status with MailerLite.
- Discord, only if you sign in with Discord, as described in section 2.
- Blockfrost and the Midnight indexer, only if you pay in ADA or NIGHT, as described in section 2.
- Our web host and email provider (Namecheap; the servers are in the United States), who necessarily handle data passing through the site.
- Delivery carriers, who need your address to deliver.
- Our accountant and the ATO, where tax law requires it.
- Google Fonts: some Midnight City pages load their typeface from Google, which sees your IP address when it serves the file.
We do not sell your personal information, and we never will. We do not share it with advertisers or data brokers.
5. Information going overseas
Our printing partner, payment provider, newsletter provider and web host all operate from outside Australia, so your details will be handled overseas, mostly in the United States and Canada. We only use providers who commit to protecting it, but privacy laws elsewhere differ from Australian law. By ordering, you accept that this is necessary to get your item made and delivered.
6. Cookies
The site uses cookies that are strictly necessary to work at all, such as remembering what is in your cart and keeping you logged in. Without these, checkout cannot function.
If we ever add analytics or advertising cookies, we will ask you first and you will be able to say no. We would rather run a site that does not need them.
Midnight City also keeps your avatar’s look in your browser’s own storage so it is there next time. Signing in, including with Discord, sets a cookie so the site knows it is you.
You can clear or block cookies in your browser settings, though blocking the necessary ones will break the bag.
7. How long we keep things
- Completed orders: seven years, because tax law requires it.
- Failed, cancelled and pending orders: one month.
- Inactive accounts: twelve months, then deleted.
- Mailing list: until you unsubscribe.
- Emails you send us: up to two years, so we have context if you come back.
- Finished Arena matches: 30 days.
- Newsletter consent records: for as long as you are on the list.
8. Keeping it safe
The site runs over an encrypted connection, passwords are hashed rather than stored, access to the admin is limited and protected, and we deliberately do not hold card details because the safest data is the data you never have.
No system is perfectly secure. If a breach ever occurred that was likely to cause you serious harm, we would tell you and notify the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
9. What you can ask us to do
Email hello@nullifier.io and we will act within 30 days. You can ask us to:
- tell you what we hold about you
- send you a copy of it
- correct anything wrong
- delete it, where we are not required to keep it for tax
- stop sending you marketing
You can also delete your account yourself from My Account. That removes your Discord link and its token, linked wallets, saved pieces, trainer cards and game progress, your avatar and your newsletter consent record. Orders are kept for the tax period but are detached from the account. Your newsletter subscription itself is separate: use the unsubscribe link in any email, or ask us.
There is no charge, and you do not need to give a reason. If you are in the UK or EU you also have the right to object to processing, to restrict it, and to receive your data in a portable format.
10. Marketing emails
We only email you marketing if you asked for it. Every one has an unsubscribe link that works immediately, and we act on unsubscribes within five working days as the Spam Act requires. Order confirmations and delivery updates are not marketing and will still be sent, since you need them.
11. Children
This shop is not aimed at children and we do not knowingly collect information from anyone under 16. If you believe a child has given us their details, email us and we will delete them.
12. Other sites
We link to places like Discord, blockchain explorers and social platforms. Once you follow a link you are on their site under their policy, not ours.
13. Changes
If we change this policy we will update the date at the top. If a change materially affects you, we will tell you directly.
14. Complaints
Come to us first at hello@nullifier.io and we will try to fix it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the UK or EU, you can complain to your local data protection authority.