Privacy policy

01. About this policy

Chatmachine OÜ, Estonia, provides the services covered by this policy: syndicatetycoon.com (the website, including the early development build at syndicatetycoon.com/alpha), the Syndicate Tycoon game in a web browser or installed as a desktop app, Syndicate Tycoon for Android (package com.syndicatetycoon.game, including any Google Play release), and Syndicate Tycoon game servers operated by Chatmachine OÜ for connected play, chat and rankings.

Chatmachine OÜ is responsible for the processing it determines for these services. The game can also connect to a game server that someone else runs, for example on their own computer or local network. Whoever runs that server holds the data on it and is responsible for it; this policy describes what the game software sends and stores so you know what they receive.

Privacy contact: email renno.east@hotmail.com for privacy questions, access or deletion requests, or concerns about any covered service. Please give your username and the server you play on so we can locate your data; never send your password.

02. Information processed

On your device

• Local company: your company, its full history and your settings are saved in your browser (IndexedDB and local storage) or in the Android app's storage. They are not sent to us. You can export a save file from Settings; that file stays wherever you put it.
• Preferences on the device: display settings, notification choices and quiet hours, whether you hid the first-steps guide, the game server address, and the sign-in token for your account. These stay in local storage on your device.
• Offline copy of the game: the browser keeps a cached copy of the game files so it opens offline. It contains no personal information.
• Notifications: if you turn on browser notifications, the game shows them from your device. No push service or notification server is used, and declining permission changes nothing in the game.

On the game server, only if you create an account

• Account: the username you choose, a salted hash of your password (never the password itself), when the account was created, hashes of any recovery codes you make, your privacy choices (whether your company name shows in rankings and whether others may send you private messages), and whether you accepted the community rules. We do not ask for an email address, real name, phone number, location or date of birth.
• Signed-in devices: for each session, a hash of its token, when it was created and last used, and a short label such as "Chrome on Windows" derived from your browser's user-agent text, so you can review and sign out devices under Online → Account.
• Connected company: the company's verified state and every game action it synced (with game timestamps), checkpoints, season progress, ranks and awards, active playtime counted from foreground heartbeats, raids and reconnaissance you sent or received, alliance membership and invitations, and referrals (who named whom as their inviter, and whether the invite has counted).
• Things you write: public chat, private messages, forum topics and replies, reactions, follows, alliance chat and descriptions, and support tickets. A support ticket also records the game context shown to you before sending: game time, company name and level, save and rules versions, sync revision and your browser's name and version.
• Safety records: blocks you set, reports you file (including a copy of the reported content as evidence), sanctions such as mutes or bans, appeals, and the moderation audit log.
• Request data: the server sees your IP address on each request. It uses it only in memory to limit repeated sign-in attempts and does not store it. When Chatmachine OÜ hosts a server, the hosting provider also receives request data to deliver and protect the service.

Website

• Request data: GitHub Pages, which hosts syndicatetycoon.com, receives your IP address and browser request details to deliver the website and protect it from abuse. The website sets no cookies and runs no advertising, analytics or tracking scripts.

Market prices in the game are simulated, and the game makes no real financial transactions. The Android app requests only internet access; it does not use the microphone, camera, contacts, location or advertising identifier.

03. How information is used

Local data lets you keep playing where you left off. Account data lets you sign in and protects your account. A connected company's actions are replayed by the server under the same rules so that progress, seasons, rankings and raids between players are fair and cannot be faked by an edited save or a changed clock. Messages, posts and alliance chat are delivered to the people they are meant for. Support tickets let us investigate problems at the moment they happened. Safety records let us enforce the community rules, handle appeals and keep a record of moderation decisions.

Rankings and public profiles show your company name, level, market age, active playtime, season ranks, awards and recruiter badge, never balances, security details or messages. If you turn off "Show my company name in rankings", it appears as "Private company" and has no public profile.

Legal bases under the GDPR: providing the game and connected play you ask for (Article 6(1)(b)); our legitimate interests in fair competition, preventing cheating and abuse, securing the service, moderating the community and answering support requests (Article 6(1)(f)); and legal obligations where we must keep information or report unlawful activity (Article 6(1)(c)). Browser notifications use your device's own permission, which you can withdraw at any time.

04. Community and moderation

Before posting, players accept the community rules: be civil, share no real-world personal information, no spam, scams or real-money trading, and no cheating tools. Public chat, the forum and rankings are visible to every signed-in player on the same server; private messages are visible to the two people in the conversation; alliance chat is visible to that alliance's members.

You can block a player, which hides their messages and stops private messages both ways (blocking does not stop raids, which are part of the game), and report content. Moderators see reported content, a copy kept as evidence, and the reporter's username, and can hide content, mute or ban. Every moderation action is recorded in an audit log, and a sanctioned player can appeal once. Moderators are players appointed on that server; the first account on a new server moderates it until it appoints others. Moderators can read the support queue to answer tickets.

Do not post personal information about yourself or anyone else. Messages are plain text; the game has no file, image, voice or video uploads.

05. Third-party services

• GitHub Pages: hosting for syndicatetycoon.com. See the GitHub Privacy Statement.
• Google Play: distribution of the Android app, when it is released there. See the Google Privacy Policy.
• Microsoft Outlook/Hotmail: email enquiries and safety reports sent to our contact address. See the Microsoft Privacy Statement.
• Server hosting: if Chatmachine OÜ hosts a public game server, we will name its hosting provider here before it opens.

Providers may process information outside the European Economic Area under their own transfer safeguards, such as adequacy decisions and standard contractual clauses. The game itself contains no third-party SDKs for advertising, analytics or crash reporting. We do not sell personal information.

06. Data retention and deletion

On your device: a local company stays until you delete it. In a browser, clear site data for the site you play on; on Android, use Settings → Apps → Syndicate Tycoon → Storage → Clear data, or uninstall the app. This cannot be undone unless you exported a save file. The Android app does not include game data in Android cloud backups.

On the game server, records are removed automatically on this schedule:

Deleting your account: in the game, open Online → Account → Delete account. Without the game, open delete-account.html on the server you play on (for a server we host, the address will be listed here) and confirm with your username and password, or email the privacy contact. Deletion removes the account, the connected company and its synced actions, raids and seasons, sessions, recovery codes, privacy choices, alliance membership, referrals, blocks and support tickets. Messages and posts you wrote stay visible as "deleted" so other people's conversations still make sense, until the retention periods above remove them; ask us if you want them removed sooner. Deleting the account does not touch a local company on your devices.

Your data in one file: Online → Account → Download my data gives everything the server keeps about your account as JSON.

We may keep information required by law or for an unresolved legal claim. Emails you send us are kept as long as needed to resolve the matter, then deleted. Copies held by providers follow their own retention policies.

07. Data security

Passwords are stored only as salted hashes, and sign-in tokens and recovery codes only as hashes. Sign-in attempts are rate limited. Changing your password signs out your other devices; a recovery code works once and signs out every device. The server verifies every action against the game rules rather than trusting the device. Servers we host are served over HTTPS; the website is served over HTTPS. We limit access to reports, tickets and moderation records to the moderators and staff who need them. No system can be guaranteed completely secure, and anyone with access to your unlocked device or browser profile may be able to see your local company and use your signed-in session.

08. Age suitability

Syndicate Tycoon is a business strategy game with fictional crime, intimidation and raid themes and chat with other players. It is intended for adults aged 18 and over and is not directed at children. If you believe anyone under 18 has created an account or shared personal information, contact us so we can assess and delete it. Parents can also use the device's and Google account's parental controls.

09. Your privacy rights

Where applicable under the GDPR, you may request access to, correction or erasure of your personal data, restrict processing, receive portable data, object to processing based on legitimate interests, and withdraw consent. These rights depend on the data and circumstances. The in-game export and deletion controls handle most requests directly.

For anything else, email the privacy contact above. We normally respond within one month, subject to lawful extensions, and may ask for proportionate information to verify that the account is yours, for example a message sent while signed in. We cannot retrieve a local company from your device. For a server someone else runs, contact the person who runs it; for information processed by GitHub, Google or Microsoft, their linked policies explain their request procedures.

You may lodge a complaint with Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority. Raid outcomes, rankings and other game results are decided by the published game rules; Chatmachine OÜ makes no automated decisions with legal or similarly significant effects about players. Moderation decisions are made by people and can be appealed.

10. Child safety standards

Chatmachine OÜ prohibits child sexual abuse and exploitation (CSAE), including grooming, sexual exploitation, sextortion, trafficking for sexual purposes, and creating, possessing or distributing child sexual abuse material (CSAM). These standards apply to syndicatetycoon.com, Syndicate Tycoon on every platform, game servers we operate, and communications sent to us about these services.

Syndicate Tycoon has text-only public chat, private messages, forum posts and alliance chat between players. It has no photo, video, voice or file uploads, no matchmaking with strangers outside the game, and no real-world location or contact sharing. The community rules forbid sexual content and sharing personal information. Players can block anyone and report any message or post, and moderators can hide content and mute or ban accounts.

Reporting a concern

In the game, use Report on the message or post, or open Online → Support. You can also email renno.east@hotmail.com, the child-safety contact for Chatmachine OÜ and Syndicate Tycoon. This is our designated point of contact for child-safety reports and enquiries about our prevention practices and compliance.

Describe the concern and give the usernames, server and approximate time involved. Do not send, attach, download or redistribute suspected CSAM. Do not include unnecessary identifying information about a child. If a child is in immediate danger, contact emergency services directly; this email is not an emergency service.

How we respond

We assess reports and take appropriate action within our control, including hiding or removing content and suspending or deleting accounts on servers we operate. If we become aware of suspected CSAM or child exploitation, we act in accordance with applicable child-safety laws, report to the relevant national or regional authorities where required, and cooperate with lawful investigations.

Privacy of reports

We use report information to investigate concerns, communicate with the reporter, protect children and comply with legal obligations. Where applicable, processing is based on our legitimate interest in protecting users and investigating misuse, or on a legal obligation. Access is limited to people who need it for these purposes. Information may be shared with competent authorities when required by law or necessary to address a child-safety concern. Reports are kept only as long as the investigation and legal obligations require, then deleted.

11. Changes to this policy

We will update this policy when the game or its data practices change, for example before a public game server opens, and revise the date above. Rule changes in the game are listed in its dated changelog under Help. Where required, we will give further notice or ask for new consent.