Privacy
Last updated 11 October 2026. Dispatch Tycoon is in beta and this page changes as the game does.
The short version
Signing in needs an email address and a password. One message is ever sent to it, a link to confirm the address when you sign up, and another copy of that link if you ask for one. There is no newsletter, no marketing and no digest; the address is otherwise a username. It is not shared and not used for anything but signing you in. Everything else held about you is what you did in the game.
What is stored
| What | Why | Kept |
|---|---|---|
| Your email address | So you can sign in. | Until you delete your account |
| A hash of your password | To check it. The password itself is never stored, so we cannot recover it, only reset it. | Until you change it or delete your account |
| A hash of the confirmation link | To check the link you clicked is the one we sent. The link itself is not stored, the same way a session is not. | 24 hours, or until you use it |
| A hash of your session | To keep you signed in. The session token itself is not stored. | Thirty days, or until you sign out |
| Failed sign-in attempts | To slow down somebody guessing at an account. | One hour at most, then deleted. The record includes the network address the attempt came from. |
| Your company, its vehicles, its hauls and its ledger | It is the game. Without it there is nothing to come back to. | Until you delete your account |
| Token purchases: which pack, the price charged, the currency, whether it was paid, and when | So the tokens you paid for can be credited to you once, and shown to you again. Your card details are never seen or stored by us: they are typed into Stripe's page, not ours. | Until you delete your account. Stripe, as the seller, keeps its own records for as long as the law requires it to. |
| Where you put your depots | The map positions you chose. We store the coordinates you clicked, never an address, and we do not ask where you live. | Until you delete them or your account |
Usage statistics, with nobody's name on them. To see how the game is played, the game records which screen is open and for how long, when a page is loaded, and which browser, operating system and kind of device (phone, tablet or desktop) it was loaded on, reduced to a broad category. Each record has no account, company or address attached, and cannot be traced back to you. They are kept for 90 days and then deleted.
Not collected at all: your name, your location, your address, any advertising identifier. There is no tracking of you as a person and no third-party analytics, which is why there is no cookie banner. The only cookies keep you signed in, remember your language, and (only if you press Demo) tell the demo visitors apart from each other without a name; the terms list each one.
Why we are allowed to hold it
- To provide what you asked for. Running the game for you, and delivering the tokens you buy.
- Legitimate interest. Keeping the service working, and keeping enough of a record that a change to your account or your money can be explained afterwards.
Your rights
Dispatch Tycoon is run from Norway, which is in the EEA, so the GDPR applies. You can ask for a copy of everything held about you, or ask for it to be deleted, and neither is a request any more: both are buttons, under Settings → Your data inside the game.
Download a copy gives you one JSON file with your account, your company and everything it did, every vehicle, depot, contract, haul and line of the ledger. It does not include the hash of your password or the hashes of your sessions, because a hash of a secret is still a secret.
Delete your account is immediate and permanent. Your company, its vehicles, its depots, its staff and its whole history go with it; there is no grace period and nothing is kept back. It asks for your password first, so a borrowed browser is not enough to do it. Take a copy first if you want one.
Who else sees it
The map tiles are served by a third party, which means your browser asks them for the images. They see that a browser asked for a map. They are not told who you are, because we do not tell them.
The confirmation message is delivered by Resend, an email provider, which therefore sees your address in order to deliver it. That is the only purpose it is handed over for, and it happens once when you sign up.
If you buy tokens, the payment is made on a page run by Stripe, who are the seller of record and collect the card, billing address and email they need to take payment and the VAT on it. What we keep is the record that a payment for a given pack was completed, never your card details. Stripe's own privacy notice applies to what they hold.
Your data is not sold, and there is no advertising.
Where it lives
On hardware in Norway, not on rented cloud infrastructure. Backups stay in the same place.
Security
Passwords are hashed with scrypt and sessions are stored as hashes and expire. That said, no service is perfectly secure, and this one is a beta run by one person rather than a company with a security team. Worth knowing before deciding what to put in it. Do not reuse a password you use elsewhere.
Contact
For anything about your data, ask on the Discord.