Privacy
Privacy
This privacy notice is a placeholder and has not been reviewed by a lawyer.
It needs legal review before launch. The factual description of what the product does is accurate and written from the code; the legal language is not finished, and nothing here should be relied on as a binding term.
Playing as a guest
A guest company is stored in this browser, in IndexedDB. It is not uploaded, it is not readable by us, and it is not backed up anywhere. Clearing site data for this site, or using a different browser or device, means the save is gone.
Guest play needs no email address and no account. The installed app and the service worker cache the pages and the decision content locally so a guest company keeps working with no connection.
Playing with an account
With an account, saves are stored in a PostgreSQL database instead of the browser: your companies, their quarters, the decisions you resolved, and the free text you wrote when you created the company. Rows are readable only by the account that owns them, enforced in the database itself rather than only in the application.
The account itself holds your email address, an optional display name, and the sign-in records the authentication provider keeps. There is no payment information, because there is nothing to buy, and there are no social logins.
Sign-in uses a cookie-based session that is validated on the server on every request. Sign-in links and reset links expire, and each can be used only once.
Analytics
Analytics is provider-agnostic and off unless a deployment configures one. In the default configuration events are discarded in the browser and nothing is sent anywhere.
Where a provider is configured, three rules hold:
- The payload is small and fixed. An event is a name — a company was created, a quarter completed, a run ended — plus a few properties such as the difficulty, the stage, the turn number, or the industry.
- The free-text business description is never included. Neither is the real company behind a decision, nor your email address. Payloads are passed through a redaction step before they leave.
- Do Not Track is honoured, and so is an opt-out. If the browser reports Do Not Track, no events are produced at all — not anonymised ones. An opt-out stored in this browser has the same effect.
There is no advertising, no third-party advertising identifier, and no cross-site tracking.
The research content
Historical summaries are drawn from the cited sources. Alternative choices, effects, and delayed outcomes are original game-design hypotheses for play, not claims about what would certainly have happened.
Every case cites its source, and the sources are listed in full on the research page.