Boroughs is run by [Company name] ([Registered address]), which is responsible for your information. This page says what we keep about you, why, who else sees it, how long we keep it and what you can do about it. If anything's unclear, email [contact email].
The short version
- We keep what we need to run the game and keep players safe. No adverts, no tracking, and we never sell your information.
- Boroughs is for adults, 18 and over.
- You can download everything we keep about you, or delete your account, any time from Phone → Settings.
What we keep
Your account
- Your name, username and email address, and your password and recovery code, each stored only as a one-way hash (we can't read them).
- The month and year you were born (never the day), to check you're old enough.
- Whether you're playing as a guest, whether you've confirmed your email, and your Google account's ID if you sign in with Google.
Your game
- Your character, your city, where you are in the game, your needs, jobs, home, furniture, business and the in-game money you've earned and spent (in-game money only: Boroughs never handles real money between players).
What you say and do with other players
- What you say in venue chat, your private messages, your friends and the people you've blocked, and reviews of businesses.
- Reports you make, and reports other players make about you, each with a copy of what was reported. What moderators did about them.
Technical information
- Your IP address, only to slow down repeated log-in tries, sign-ups, recovery-code tries and reset emails (kept for up to a day).
- Our hosting provider keeps standard server logs for a short time to keep the service running and secure.
Why we use it
| What for | Legal basis (UK GDPR) |
|---|---|
| Running the game for you: your account, your save, delivering your messages | Our contract with you |
| The age check, reports, moderation and stopping abuse and cheating | Legitimate interests (keeping players safe and keeping children out), and legal obligations |
| Emails about your account: confirming your email, resetting your password | Our contract with you |
We don't send marketing emails, and we don't use your information to profile you or show you adverts.
Age
- Boroughs is for adults, 18 and over: it has crime, drugs and gangs in it. Everyone tells us their month and year of birth before playing.
- If we find out someone under 18 has an account, we close it and delete their information. Parents can email us.
Who else sees it
Other players
Other players see your username and character, what you say in venue chat, who's at the same place as you, your business and its reviews, and (for friends, if you're 18 or over) where you are.
Companies that help us run Boroughs
They only use your information to provide their service to us, under contracts that protect it:
- Hosting: [hosting provider], which runs the game's servers.
- Database: [database provider, e.g. Turso], which stores the game's data.
- Email: [email provider, e.g. Resend], which sends account emails.
- Google, only if you choose “Continue with Google” (Google's own privacy policy applies to your Google account).
- Payments: [payment provider, e.g. Stripe], only if you buy something. We never see your card details.
Some of these may store information outside the UK. Where they do, we use the protections UK law requires (such as the UK's International Data Transfer Agreement or adequacy regulations). We'd also share information if the law requires it, or to protect someone at risk of harm.
How long we keep it
| What | How long |
|---|---|
| Your account and game | Until you delete your account |
| Venue chat and in-game alerts | 90 days |
| Private messages | Until you or the other person deletes your account |
| Reports and what moderators did | [2 years], so repeat problems can be spotted |
| IP addresses (with log-in tries) | Up to 1 day |
| Email links (confirm, reset) | Until they're used or run out (an hour to a week) |
When you delete your account, your character, save, payments record, messages, friends and alerts are deleted straight away. An empty, locked account record stays so other players' records still make sense.
Your rights
- See your information: Phone → Settings → Download my data gives you everything we keep about you as a file.
- Delete it: Phone → Settings → Delete my account.
- Correct it, object to how we use it, or ask us to restrict it: email us.
- Complain: to us first if you can, or to the UK Information Commissioner's Office (ico.org.uk).
- If you live somewhere with its own privacy law (such as a US state like California), you have similar rights; email us. We don't sell or share personal information for advertising.
Cookies and storage
We only use what the game needs to work, so there's nothing to accept or turn off:
| Name | What it does | How long |
|---|---|---|
| session | Keeps you logged in | 7 days |
| google_state | Checks a Google sign-in really came from you | 10 minutes |
| age_check | Stops a too-young answer being changed straight away | 1 day |
| grindtown.graphics (in your browser's storage) | Remembers your graphics setting | Until you change it |
| Notifications (if you turn them on) | Your browser's push address for this device, so we can send you alerts | Until you turn them off or delete your account |
Keeping it safe
Everything travels encrypted (HTTPS). Passwords are hashed, email links work once and only a hash of them is kept, and repeated log-in tries are slowed down. Only a few moderators can see reports, and everything they do is logged.
Changes
If we change this page in a way that matters, we'll tell you in the game first. See also the terms and community rules.