Privacy Policy · Corporation Wars

Pending. This policy is ready for review but not yet in force. Its effective date, our legal entity name, some retention periods and the regional disclosures are still to be confirmed. Each open item is marked like this.

Corporation Wars is an online idle business game for iPhone, made by Moxiebytes (“we”). You play in a city shared with other players, and our server keeps the game. Playing requires Sign in with Apple and an internet connection. This policy explains what we keep, why, and how to delete it.

Pending: the legal name and address of the company that makes Corporation Wars.

What we collect

Your Sign in with Apple identifier. Apple gives us an identifier that is the same every time you sign in to Corporation Wars. We store it so you can return to your company, also on another iPhone. We don’t request your name or email address from Apple. Apple’s one-time sign-in codes and tokens are used only while you sign in or delete your account, and are never stored.
Your account and company. An internal account number, a random public company ID and the company name you choose. Your company name is shown to every player in the city, for example as the owner, landlord or seller of a property, and it can’t be changed.
Game data. Your land, businesses, apartment blocks, leases, offers and sales, investments, loans, bank, daily contract progress, balances and transaction history, and the time of your last activity, which decides how long your businesses keep producing.
Messages. When messages are switched on, your company can post in the world room, which every company reads, and hold direct conversations, which only the two companies read. We store each message’s text, the company that wrote it, the room or the two companies in the conversation, when it was posted, and how far your company has read in each room. A new direct message adds an entry to the recipient’s company activity. Messages appear under your company’s name and public company ID, never your Apple identity.
Reports, blocks and mutes. If your company reports a message or a company name, we keep the report, which company made it, and a copy of the reported text or name so an operator can review it. Once an operator has reviewed a message report, we delete its copy of the message text. We keep the list of companies your company blocks, and any time-limited mute an operator places on your company.
Sessions. When you sign in, your iPhone keeps a session credential in its secure Keychain. We store a one-way fingerprint of it, the installation it belongs to, and when it was created, expires and was ended. A session works for up to 7 days, and signing out ends it.
Device-check data. Apple’s App Attest lets our server confirm that requests come from a genuine copy of Corporation Wars. For each installation we keep its App Attest key identifier, the public part of the key, a counter, the app build, the kind of installation Apple reports (for example, from the App Store), and whether that installation has created a company. It doesn’t reveal who you are.
Connection data. Our server receives your requests through Cloudflare. To limit abuse, it keeps fingerprints of the network address a request comes from for 60 seconds when the app asks for a security check or a sign-in attempt fails. Because they are derived from the address, we treat them as address data. Server logs record each request’s path, result and timing, with credentials and sign-in data removed. They don’t record your account.

The sound, music and haptics switches are stored only on your iPhone and are never sent to us.

We don’t collect your contacts, location, photos, real name or email address (unless you email us). We don’t use advertising, analytics or crash-reporting tools, we don’t track you across apps or websites, and we don’t sell or share your data for advertising.

Credits, units and dividends exist only in the game. There are no in-app purchases, payments or cash-outs, so we have no payment data.

Why we use it

Only to run the game: to sign you in, keep your company and the shared city, settle every purchase, rent payment and trade, show other players the names and properties in the city, deliver your messages, and protect the game and its players from fraud, abuse and offensive content.

Who else handles it

Apple provides Sign in with Apple, App Attest and the App Store. Apple’s handling is covered by Apple’s privacy policy.
Cloudflare carries traffic between the app and our server, and sees your IP address and your requests.
Our server runs on hosted hardware.
Email to hello@corporationwars.com is handled by our email provider.

These providers handle your data only to provide their service to us.

Pending: the names of our server host and email provider, and confirmation that each provider is bound to protect your data at least as well as this policy describes.

Other players see your company name and what your company does in the city: its properties, businesses, leases, sales and investments. Every company can read what your company posts in the world room; only the other company in a direct conversation can read that conversation. Our operators can read messages that are reported, and use them only to review reports and enforce the rules. Nobody else sees who reported or blocked a company. Other players never see your Apple identifier or account number.

Messages, reporting and blocking

Messages are plain text, up to 280 characters. Links are not tappable, and images and voice can’t be sent. A word filter refuses messages with offensive words.

Report a message by long-pressing it, or a company name with Report name. A reported message hides for you at once, and for everyone once three established companies have reported it, until an operator reviews it. We aim to review reports within 24 hours.
Block a company with Block under its name or on one of its messages. Its messages and activity are hidden from you, and neither company can message the other. Trading and offers are unaffected. Unblock it under Menu, Messages.
Delete your own message by long-pressing it. Messages can’t be edited.
Operators can delete messages and mute a company for a set time. Each action is recorded.

To report something else about messages, email hello@corporationwars.com.

How long we keep it

Your account, Apple identifier and company name: until you delete your account, or until online play ends.
Your company’s game data: for as long as online play runs. If you delete your account, it stays in the city as the anonymous estate described below.
Device-check records: for as long as online play runs, because they stop one installation from creating more than one company. After you delete your account they are no longer linked to you.
World-room messages: 7 days. Direct conversations: 90 days. Older messages are never shown again and are deleted the next time someone posts in that room, or when the account that wrote them is deleted. A message you delete is emptied at once.
Reports: a copy of a reported message’s text until an operator reviews the report; the report itself, and a copy of a reported name, until the reporting or the reported company’s account is deleted, or until online play ends. Blocks stay until you unblock or either account is deleted; mutes end at their set time.
Sessions: a session works for up to 7 days. Its record stays until you next sign in, when ended and expired sessions are removed, or until you delete your account.
Address fingerprints: 60 seconds, then removed at the server’s next cleanup of that record.
Deletion confirmations: 7 days, then removed at the next cleanup. They hold no Apple code or token.

Pending: how long server and network logs and backups are kept, what happens to deleted data if a backup is restored, and the notice period and data deletion if online play ends.

Deleting your account

In the app, open Menu, then Account, and tap Delete account. Before you have named your company, the same option is under Account & access. Confirm, then authorize again with the same Apple Account.

Deletion is immediate and permanent:

We ask Apple to revoke Corporation Wars’ Sign in with Apple authorization, then remove your account, your Apple identifier, your company name and your sessions. Your company’s name is also removed from past snapshots of the city.
Every message your company wrote is deleted, with its read positions, the reports it made or that name it, its blocks and any mute. In a direct conversation the other company keeps its own messages and sees your side as a removed company.
To protect other players, your company’s buildings, cash, investments and active leases stay in the city as an unowned “Abandoned company”. Transaction history stays balanced under that anonymous name, other players’ leases and trades are honored, and any dividend obligation your company took on when it issued units continues. Unaccepted offers are cancelled. Nobody can reclaim or control the estate, including you.
The device-check records of the installations you used remain. The installation that created your company stays marked, so it can’t create another company. They are no longer linked to you.

Deleting the app doesn’t delete your account. We can’t revoke Sign in with Apple for you from our side, because we store no Apple token, so also remove Corporation Wars in your iPhone’s Settings as described below.

Pending: how to request deletion by email if you can no longer open the app. Until that procedure is published, delete your account in the app.

You can stop using Sign in with Apple with Corporation Wars at any time in your iPhone’s Settings, under your name, then Sign in with Apple.

Pending: what we do when Apple tells us you have stopped using Sign in with Apple, or that your Apple Account was deleted.

Your choices and rights

You can see your company and its history in the app, and delete your account there at any time. For a copy of your data, a correction, or any other privacy request, email hello@corporationwars.com.

Pending: our response time, and the disclosures for players in the EU, the UK and US states with their own privacy laws (legal bases, international transfers and your right to complain to a regulator).

Children

Corporation Wars isn’t directed at children under 13, and we don’t knowingly collect their data.

Security

Connections are encrypted. We store fingerprints rather than session credentials, check the app’s sign-in and account requests, every request that changes the game and the opening of each live connection with App Attest, and keep Apple’s sign-in codes and tokens out of storage. No system is perfectly secure.

Changes

We’ll post changes on this page and update the effective date. We’ll mention significant changes in the app.

Contact

Email hello@corporationwars.com.