Privacy Policy
Last updated: 24 August 2026
1. Summary
We collect the minimum needed to run a game you can come back to. We do not sell your data or use it for advertising profiles. We never send your identity or payment details to an AI model.
2. What we collect
- Account: if you sign in with Google, your email address, display name and avatar URL.
- Session cookie: a signed identifier that keeps you signed in. It contains no personal data beyond your account id.
- Gameplay: your runs, the choices you made, resulting balances and metrics, and credit transactions.
- Payments: purchase status and an order reference from Creem. We never see or store your card number.
- Technical: request logs needed for security, abuse prevention and debugging.
3. What we send to AI models
To write each briefing we send a deliberately narrowed summary of your game state:
- your chosen identity, the day number, and the theme the engine selected;
- your allocation as percentages, never exact amounts;
- your five life metrics;
- a one-line recap of your three most recent days.
We do not send your email address, name, payment information, IP address, or full activity history. This restriction is enforced in code and covered by automated tests.
4. Why we process it
To provide and secure the service, to save and resume your runs, to generate briefings, to process purchases, to prevent abuse, and to meet legal obligations.
5. Who processes data for us
- Cloudflare — hosting, database storage, security and AI request routing.
- Google — sign-in, if you choose it, and Google Analytics for aggregate usage measurement.
- Creem — merchant of record for payments.
- AI providers reached through Cloudflare, which receive only the narrowed summary described above.
6. Cookies and analytics
We use cookies to keep you signed in and to store your language preference. We do not use advertising cookies and we do not sell your data.
We use Google Analytics 4 to understand how the game is used in aggregate — which pages are visited, how far into a month players get, and whether a purchase completed. This is what tells us where the game loses people, which is the only way we can fix it.
What we send is deliberately limited. Report pages are addressed by a random identifier, never by your email or account id, so no page address we record identifies you. We do not send your email address, name or any content from your runs to Google Analytics.
Opting out. If your browser sends a “Do Not Track” signal, we do not load Google Analytics at all. You can also block it with any content blocker, or with Google’s own opt-out browser add-on. Nothing about the game changes if you do.
7. Retention
We keep account and gameplay data while your account exists. Deleting your account removes your personal data, except records we must retain for tax or fraud-prevention purposes.
8. Your rights
You may request access to, correction of, or deletion of your personal data, and you may object to certain processing. Email hello@tycoonmonth.com and we will action deletion requests within 30 days.
9. International transfers and security
Data is processed on globally distributed infrastructure. All traffic is encrypted in transit. Access to production data is restricted.
10. Children
TycoonMonth is not directed at children under 13, and we do not knowingly collect their data.
11. Changes
We will post updates on this page and revise the date above.