Privacy Policy
Effective 16 October 2026
Null Command (nullcommand.app) is a free operations tool for EVE Online, run by Starr Studios. This page says plainly what it stores about you, why, where, for how long, and how to delete it. Questions: hello@starrstudios3d.com.
The short version
- You log in with EVE Online. We never see your EVE password or the email address on your EVE account.
- We store only what the tools need: your character, encrypted EVE login tokens, the targets and settings you save, and, if you use the Ledger, the wallet history of the characters you link.
- No analytics, no advertising, no tracking cookies, no third-party scripts. We do not sell or share your data for marketing.
- You can delete your data yourself at any time with Delete my data, or by emailing us.
What we collect and why
Your EVE login
When you log in, EVE Online's login service (EVE SSO, run by CCP) asks you to approve a set of permissions and then gives Null Command an access token and a refresh token for the character you chose. From these we read your character ID and name, and we ask EVE for your corporation ID. The main login asks to read structure markets, structures, assets, industry jobs, blueprints, skills, contracts and planetary colonies. Two optional logins ask for wallet access (to link a character to the Ledger) and for your market orders (for the order scanner).
Your login session
So that you stay logged in for up to 30 days instead of 20 minutes, we keep a session record: your character ID, name and corporation ID, the permissions you approved, your refresh and access tokens, a SHA-256 hash of the random session ID in your nc_session cookie, timestamps, and the last error EVE returned, if any. The tokens are encrypted (AES-256-GCM) with a key that is held by our hosting provider and is not stored in the database.
Linked Ledger characters
If you link more characters to your Ledger, we store each one's character ID, name, approved permissions and encrypted refresh token, tied to your main character, so the Ledger can sync them without you logging each one in again.
Things you save
Min/Max stock targets and ignored items for a destination market (structure ID, item, quantities, an optional reason), manual Ledger expenses, and your hauling rate for profit and loss.
Ledger wallet history
For each character you link with wallet access, we store its wallet transactions (item, quantity, price, date, location, the other party's ID) and wallet journal entries (amount, balance, type, description, parties, tax, reason), so that the Ledger can work out cost basis, fees and profit.
Shared market history
When you open a destination market, Null Command saves a snapshot of the public sell orders on that structure (order IDs, items, prices and quantities) to estimate demand over time. This is market data, not data about you, and it is shared between users who have access to the same structure. Each snapshot records which character captured it.
Data we read but do not keep
Assets, blueprints, skills, industry jobs, contracts, planetary colonies and market orders are read from EVE with your token when you open a tool, used to build the page you asked for, and not saved to our database. Some public market and game-reference responses are cached by our host for between five minutes and a day to avoid repeated calls to EVE.
Data that stays in your browser
Many settings never reach our database: destinations, doctrines, fuel profiles, the moon calendar, deployment plans, capital readiness, resource watch, stock targets for operations, import lists, fee assumptions and display preferences. They are kept in your browser's local storage, on that device only. They are sent to our server only as part of a request that needs them, and are not stored there.
Technical logs
Our hosting providers keep standard request logs (such as IP address, browser, time and page requested) for operating and securing the service, under their own retention rules. Our own server logs record errors; they never record your tokens.
Cookies
Null Command sets only the cookies it needs to log you in and keep you logged in. All of them are first-party, HTTP-only (page scripts cannot read them), sent only over HTTPS, and SameSite=Lax. There are no analytics or advertising cookies, so there is nothing to opt out of.
| Cookie | What it is for | How long |
|---|---|---|
nc_session | A random session ID that keeps you logged in. Only a hash of it is stored on our side. | 30 days |
eve_access_token | Your current EVE access token, used to call EVE's API (ESI) for you. | About 20 minutes, renewed while you are logged in |
eve_access_expires | When that access token expires, so it can be renewed in time. | Same as the access token |
eve_character_id | Which character you are logged in as. | Up to 30 days |
eve_market_orders_token, eve_market_orders_expires, eve_market_orders_character_id | The same three, for the optional market-order scanner, set only if you connect it. | About 20 minutes; the character ID up to 30 days |
eve_oauth_state, eve_oauth_mode, eve_oauth_return | Used during an EVE login: protection against forged logins, which kind of login it is, and which page to return to. | 10 minutes |
Logging out or deleting your data removes all of them.
Where it is stored and who else is involved
- Supabase hosts the database and the server functions that read and write it.
- Vercel hosts the website and the server code that talks to EVE.
- CCP Games runs EVE SSO and the EVE API. Requests made with your token go to CCP and are covered by CCP's own privacy policy.
These providers process data for us to run the service and may do so in the United States or other countries where they operate. Null Command also downloads public game reference data (from EVE Ref and a public GitHub file); no personal data is sent with those requests. We do not sell your data or give it to anyone else, unless the law requires us to.
How long we keep it
- The access-token cookie lasts about 20 minutes and the session up to 30 days. Logging out revokes your refresh token at EVE and marks the session revoked; the revoked record, whose token no longer works, stays until you delete your data.
- Targets, ignored items, expenses, linked characters and Ledger wallet history are kept until you remove them or delete your data.
- Shared market history is kept for as long as the service runs, because other users of the same structure rely on it. Deleting your data removes your character from it.
Deleting your data
Log in, open Quartermaster, and choose Delete my data under the Log out button. You will be asked to type DELETE to confirm. Null Command then:
- revokes every stored EVE refresh token for your character and its linked characters, at EVE;
- deletes your login sessions, linked-character authorizations, Min/Max targets, ignored items, expenses, hauling rate, linked characters and all Ledger wallet transactions and journal entries;
- removes your character ID from the shared market snapshots you captured;
- clears the Null Command settings kept in that browser, and logs you out.
Settings kept in other browsers or devices are not reachable from our side; clear them there by deleting this site's data in the browser. If one of your characters was linked into someone else's Ledger, that copy belongs to their portfolio; email us and we will remove it.
You can also email hello@starrstudios3d.com with your character name and we will delete your data for you. We may ask you to show that you control the character first, so that nobody can delete someone else's data. Separately, you can withdraw Null Command's access to your characters at any time from the third-party applications page of your EVE account.
Security
Tokens are encrypted before they are stored, and the encryption key is kept apart from the database. The database is not reachable from the browser: every table is locked down and is read and written only by our server code after it has checked your EVE login.
Children
Null Command is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has used it, email us and we will delete the data.
Changes to this policy
If what Null Command stores or how it uses it changes, we will update this page and its effective date before or when the change goes live.
Contact
Starr Studios · hello@starrstudios3d.com