Privacy policy

What we collect

• Account details: your email address, the display name you choose, and your password, which our sign-in provider stores hashed. If you sign in with Google, we get your email address and basic profile from Google.
• Game data: your runs, decisions, scores, daily drill answers, societies, reactions, invites and any feedback you send us.
• Purchases: if you buy a plan, Paddle handles the payment. We receive your plan, subscription status, order and customer IDs and your email address. We never receive your card or bank details.
• Usage analytics: which pages you visit, what you click, which game features you use, your browser and device type, the referring site, and your approximate location (country or city) derived from your IP address. See "Analytics and cookies" below.
• Technical data: server logs and error reports, which can include your IP address, used to keep the Service running and secure.

What other players can see

Your display name, scores and achievements appear on leaderboards, on your public player page and inside any society you join. Your email address is never shown to other players.

Why we use it

• To run the Service and your account, including paid plans (performance of our contract with you).
• To keep it secure, prevent cheating and abuse, and understand overall usage through anonymous, cookie-free statistics (our legitimate interest in running and improving the game).
• For analytics cookies, session recordings and linking usage to your account, only if you accept them (your consent).
• To meet legal obligations, such as keeping records for tax purposes.

We don't sell your data, we don't show ads, and we don't use your data to train AI models.

Analytics and cookies

We use PostHog, hosted in the EU, to see how the game is used. There are two levels:

• Before you choose, or if you decline: we count page views and feature use anonymously. Nothing is stored on your device, and nothing is linked to your account.
• If you accept: PostHog sets a cookie so visits can be connected over time. If you're signed in, activity is linked to your account ID (never your email or name). We may also record sessions to find confusing parts of the game, with everything you type hidden.

You can change your choice at any time with Cookie settings (also in the footer).

We also use essential browser storage that doesn't need consent: your sign-in session, theme and sound settings, a pending invite code, and daily drill progress if you play without an account.

Who processes your data for us

• Supabase: database and sign-in.
• Lovable: building and hosting the app.
• Paddle: payments, invoicing and tax, as Merchant of Record. Paddle is an independent controller for payment data under its own privacy policy.
• PostHog (EU hosting): product analytics.
• Google: "Sign in with Google", if you use it, and the web fonts the site loads from Google Fonts, which means Google receives your IP address.

Some of these providers are based in or transfer data to the United States. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Account and game data: as long as you have an account. We delete it within 30 days of a deletion request.
• Purchase records: as long as tax law requires, which is 7 years in the Netherlands.
• Analytics events: at most 2 years. Session recordings: at most 30 days.
• Server logs and error reports: up to 90 days.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to receive it in a portable format. You can also object to processing based on legitimate interest, and withdraw consent at any time. Email support@financeascent.app and we'll respond within a month.

If you're unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Children

The Service is meant for people aged 16 and over. Younger players need permission from a parent or guardian. If you believe a child has given us data without that permission, email us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll update the date at the top and, for significant changes, tell signed-in players by email or in the Service.