1.The short version

• We collect what it takes to run your account and keep the game fair: your email, your username, what you do in the game, what you write, and your IP address.
• We use your IP address to catch multi-accounts, cheating, and fraud. That's a big part of keeping the game playable.
• Staff can read private mail and chat when investigating reports or rule breaks.
• We don't sell your information, and we don't use advertising trackers.
• Payments are handled by a payment processor. We never see your full card number.

2.What we collect

Information you give us

• Account details: username, email address, password (stored only as a one-way bcrypt hash, so we can't see it), and the gender you pick for your character.
• Optional profile details: a display picture, forum avatar and signature, profile text, and personals ads. Anything you put there is your choice, and most of it is visible to other players.
• Phone number (optional): if you turn on text alerts, we store your number and your carrier's text gateway so we can send them.
• What you write: private mail, chat messages, forum posts, profile comments, bounty reasons, newspaper ads, support tickets, bug and player reports, staff and gang applications, and suggestions.
• Messages to us: when you use the Contact page or Support, we get the email address and details you include.

Information collected automatically

• IP address: recorded when you sign up, log in (including failed logins), and as you use the site. It's also attached to some records, such as transfers of money or items between players and staff actions.
• Game activity: everything your character does: crimes, attacks, jail and hospital time, trades, transfers, market activity, casino play, and so on. Many of these are logged.
• Online status: when you were last active.
• Cookies: see section 7.

From payment processors

When you make a Purchase, the processor tells us whether the payment went through, the transaction ID, the amount, and what was bought for which account. We don't receive or store your card number, bank details, or billing address.

We don't ask for your real name, date of birth, or home address, and we don't record your browser's user agent.

3.How we use it

• To run the game: create and secure your account, save your progress, deliver messages, and show your profile.
• To keep it fair: detect multi-accounts, account sharing, bots, scams, and exploits. This includes comparing IP addresses between accounts and blocking some actions between accounts on the same network.
• To moderate: investigate reports, enforce the Game Rules, and handle appeals.
• To process Purchases and handle refunds, disputes, and fraud.
• To contact you about your account (see section 8).
• To protect the site: stop attacks, abuse, and illegal activity, and comply with the law.
• To improve the game: fix bugs and tune balance using gameplay data.

If you're in a place whose laws ask for a legal basis (like the EU or UK): we rely on performing our contract with you to run your account, on our legitimate interests in keeping the game fair, safe, and working, on legal obligations for things like tax records, and on your consent where we ask for it, such as text alerts.

4.What other players see

Other logged-in players can see your public profile: username, level and rank, gender, sign-up date, last-active time and online status, city, gang, money and points, property, donator status, staff rank, jail, hospital, and Fed Jail status, friend and enemy counts, your display picture and profile text, and comments others leave there. Leaderboards and online lists show some of the same. Visitors who aren't logged in may see a random player's username, gender, and level on the front pages.

Anything you post in chat, forums, bounties, ads, or profile comments is visible to the players who can see that channel. Images you link from another website are loaded by other players' browsers straight from that website, which can see their IP addresses.

5.What staff can see

Game staff are volunteers and employees who help run and moderate the game. Depending on their role, they can see account details, IP addresses and network hostnames, accounts that share an IP address, game logs, staff notes about an account, and the contents of private mail and chat. They use this only to run the game, investigate reports, and enforce the rules. Staff access to private messages is itself logged. Don't send anything through the game that you'd need to keep from staff.

6.Who we share it with

We don't sell or rent your personal information, and we don't share it for advertising. We share it only with:

• Payment processors (currently PayPal; we plan to move to Stripe) to take payments. Your in-game username is included in the order details. They handle your payment information under their own privacy policies.
• Service providers who host the site and deliver email for us, only as needed to provide those services.
• Font and code libraries: a few pages load fonts or scripts from Google's public servers, which receive your IP address when they do.
• Your phone carrier's text gateway, if you turn on text alerts.
• Authorities, when the law requires it, or when we believe in good faith it's needed to protect someone's safety, investigate fraud or abuse of the site, or defend our rights.
• A new owner, if the game or the business running it is sold, merged, or transferred. This policy would continue to apply to your information.

7.Cookies

We use a small number of cookies. All of them are our own, and each one either keeps the site working or remembers a choice you made. No advertising or tracking cookies.

Chat doesn't use a cookie. The chat dock keeps which panels you had open and how far you've read in each room in your browser's local storage, on your device. It stays there until you clear your browser's site data, and clearing it only resets those panels.

You can block or delete cookies in your browser settings, but the game won't work without the session cookie.

8.Emails and texts

We send account emails you can't opt out of while you have an account: verifying your email, password resets, security alerts such as repeated failed logins, purchase receipts, and notices about changes to these policies or your account. We may also send game news, inactivity reminders, and prize notices. You can opt out of those by contacting us, and every such email will tell you how. Text alerts are off until you turn them on, and you can turn them off in Preferences any time.

9.How long we keep it

• Active accounts: we keep your account and game data while your account exists.
• Inactive accounts: regular player accounts that haven't been used for 28 days may be deleted automatically. We'll email a warning first.
• Deleted accounts: when an account is deleted, by you or by us, we delete or anonymize its personal information within 30 days. Some records are kept longer: purchase records for as long as tax and accounting law requires (usually up to 7 years), and records of serious rule breaks (such as IP addresses tied to a ban) for as long as needed to enforce the ban.
• Messages and posts: private mail stays until the recipient deletes it. Chat, forum posts, and other content you posted may remain visible after your account is gone, shown without your username where possible.
• Backups are overwritten on a rolling schedule, so deleted data can take longer to disappear from them.

10.Your choices and rights

You can:

• See and change most of your information in Preferences and on your profile.
• Download your mail from the mailbox archive.
• Ask for a copy of the personal information we hold about you.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and personal information.
• Opt out of non-essential emails and text alerts.

To make a request, contact us through our Contact page, from the email address on your account or while logged in, so we can confirm it's you. We'll respond within 30 days (or sooner if your local law requires). We won't treat you differently for using these rights. Depending on where you live (for example California, other U.S. states with privacy laws, the EU, or the UK), you may have additional rights, including the right to complain to your local data-protection authority. We honor those rights as the law requires.

Deleting your account ends your access to it and its Virtual Items for good.

11.Security

We protect your information with measures such as encrypted connections (HTTPS), hashed passwords, limited staff access, and logging of staff actions. No website is perfectly secure, so we can't guarantee that information will never be accessed without permission. Use a password you don't use anywhere else. If we learn of a breach that affects your personal information, we'll notify you as the law requires.

12.Age limit

The game is for people 18 and older. We don't knowingly collect information from anyone younger. If we learn an account belongs to someone under 18, we close it and delete its information. If you think that's happened, tell us through our Contact page.

13.Where data is stored

We're based in the United States, and the game's servers are in the United States. If you play from another country, your information is transferred to and processed in the U.S., where privacy laws may differ from yours.

14.Changes

When we change this policy, we'll update the date at the top. If a change materially affects how we use your information, we'll announce it in the game and, where the law requires, by email or by asking for your consent.

15.Contact

Privacy questions or requests: our Contact page. The Cocco Group, New York, USA.