This explains what IncomeRPG collects, why, and who else can see it. It is written to describe what the software actually does rather than to reserve every right we might one day want.
IncomeRPG is operated from Ontario, Canada. It is currently run as an unincorporated business by its founder; this page will name the registered company once incorporation completes. For any privacy question or request — including access, correction or deletion — write to support@incomerpg.com, which is monitored by the operator.
| Data | Why | Where it lives |
|---|---|---|
| Email address | To create your account and sign you in | Supabase |
| Password | Authentication only — we never store or see it; it is handled entirely by Supabase, or by Google if you sign in with Google | Supabase / Google |
| Subscription status and customer id | To know whether your account has Premium | Supabase, Stripe |
| Payment details | Taken and stored by Stripe. We never receive your card number. | Stripe |
| Game progress — your kingdom, characters, settings, milestones | So your progress follows you between devices | Your browser, and Supabase if signed in |
| Brokerage holdings, balances and transaction history | To calculate and display your own portfolio figures | SnapTrade, and cached on our server |
| Brokerage connection credentials | A token that lets us read (never write) your accounts | Stored encrypted; issued by SnapTrade |
We do not collect your name, address, phone number, date of birth or government identifiers. We do not ask for them and the app has nowhere to put them.
We use a small number of providers to run the service. Each acts on our instructions:
youtube-nocookie) mode so nothing is set unless you press play.We set no advertising or tracking cookies. The app uses your browser's local storage to keep your game save and your preferences on your own device, and Supabase sets a cookie or token so you stay signed in. Clearing your browser storage signs you out and removes the local copy of your save; a cloud save, if you made one, remains until you delete your account.
Your account data and cloud save are kept while your account exists. Delete your account and they are removed, along with your brokerage connection. Stripe retains payment records for as long as tax and accounting law requires, independently of us.
Wherever you live, you may ask us to show you the data we hold about you, correct it, or delete it. You can delete your account and all associated data yourself from ⚙️ Game Settings → Account in the app, at any time, without asking us.
Our lawful bases are: contract — to provide the service you subscribed to; and legitimate interests — to keep the service secure and working. You have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your data protection authority. Our providers may process data outside your country; those transfers rely on the providers' own standard contractual clauses.
We do not sell or share personal information as those terms are defined, and we have not in the preceding twelve months. You may request access or deletion, and we will not discriminate against you for asking.
You may access and correct your personal information, and may complain to the Office of the Privacy Commissioner of Canada.
IncomeRPG is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.
Traffic is encrypted in transit. Brokerage tokens are held in a restricted store, separate from your game data. No system is perfectly secure, and we will tell affected users promptly if a breach ever puts their data at risk.
If we change this policy materially we will say so in the app. The date at the top always reflects the current version.