Privacy
What this game stores, why, and how to get rid of it. It is short because the game does not collect much.
What we store
Your account
A username, a display name, and an email address if you gave one. Your password is never stored — only a PBKDF2 hash of it, which cannot be turned back into your password. You can play as a guest, in which case there is no email at all.
Your game
The state of your city: your businesses, your money, your parcels, what day you are on. This is what lets you close the game and come back to it, and what puts you on the leaderboards.
Messages
Mail you send to and receive from other players, kept so it can be delivered and read. Reported messages are copied onto the report so we can review them.
How you use the game
Events like signing in, opening a business, or watching an ad, with the app version. We use this to see which parts of the game people actually play and which parts are broken.
Sessions
When you sign in we keep the browser or device description and a one-way hash of your IP address. We do not store the address itself. The hash exists so we can spot one machine attacking the sign-in endpoint, and it cannot be turned back into a location.
Push notifications
If you turn them on, a device token so we can send them. Turning them off removes it.
Adverts
The game shows one kind of advert: a short video you choose to watch in exchange for something — a cash injection when you are struggling, a day off a build, a busier morning. Adverts never interrupt you. Nothing plays unless you tapped a button asking for it, and there are no banners anywhere in the game.
They are served by Google AdMob. When one plays, Google receives your device model and operating system, your language and region, your IP address, and whether you watched it through. That is Google's collection, not ours — we never see or store any of it. Their policy for partner sites and apps covers what they do with it.
The advertising identifier
On iPhone, Apple asks you once whether this game may see what you do in other apps. That permission controls a single thing: whether Google may read your device's advertising identifier to pick an advert matched to your interests.
Say no and nothing about the game changes. You still get adverts, they are the same length, and you get every reward. They are simply chosen from context rather than from you, and advertisers pay us less for them. We do not ask twice, and we never offer a reward for saying yes — that is against Apple's rules and it would be a lie besides, since the reward is paid either way.
If you are in the UK or the EEA
You will see a consent form the first time you open the game, from Google's consent platform. Whatever you choose there, the adverts and the rewards work the same.
What we record ourselves
That an advert was watched, and which reward it paid. No more than that — it is the same gameplay record described above, and it carries nothing from Google.
What we do not do
- We do not sell your data.
- We do not track you across other apps or websites ourselves, and we do not receive anything about you from anyone who does. Google may, for advertising, and only if you allowed it when asked.
- We do not show adverts you did not ask for. No banners, no pop-ups, nothing between you and the game.
- We do not store payment details. There is nothing to buy.
What other players can see
Your display name, your rank, and anything you list on the marketplace. Not your email, not your username if it differs from your display name, and not anything about your device.
Getting rid of it
Account → Delete your account, in the game or on the website. It removes your account, your city, your mail in both directions, your marketplace listings and your leaderboard entries, immediately and permanently.
Two things survive, and it is fair to say so plainly. Moderation reports that name your account stay, with your name removed — otherwise deleting and re-registering would be a way to erase a record of abuse. And daily totals like "how many people played on Tuesday" stay, because they are counts with no identity in them.
Children
This game is not directed at children under 13, and we do not knowingly keep accounts for them. If you believe a child has created an account, email us and we will remove it — that removes the account and stops any advert being served to it.
Where it lives
Your account, your city and your messages are on Microsoft Azure, in the United States. Everything travels over HTTPS.
The only data that goes anywhere else is what Google receives when an advert plays, which is described above and never passes through us.