Privacy policy

1. Controller

The game is run by LZ/Lucz, who decides how its data is processed. For any privacy request write to privacy@lucz.dev.

2. What we process

• Your username. Public pages and the leaderboard show your shop, not your username, but do not use your real name anyway.
• Your password and recovery code, stored only as hashes (Argon2id and HMAC-SHA256), never in clear text.
• Your email, only if you choose to add one, with the date you confirmed it. It is never shown to other players.
• Sessions with an expiry date, and short-lived one-time links for email confirmation and password reset, stored only as hashes.
• Game progress: shops and their texts, stock, staff, virtual wallets, orders placed on the parody storefront. Shop names, descriptions, listed products, reviews and net worth rank are public.
• Counters of failed login and recovery attempts, keyed by a hash of the username or email. The application database does not record IP addresses or user agents.

3. Purposes and legal bases

• Creating the account, signing you in and saving your progress: performance of the service you ask for.
• Sending the confirmation and password reset emails, if you add an email: performance of the service and security of your account.
• Limiting login and recovery attempts and preventing abuse: legitimate interest in keeping the service secure.
• Complying with legal obligations, where they apply.

4. No marketing, no profiling

We send no newsletters or promotional emails, build no advertising profiles, run no analytics or tracking scripts and sell no data. The email is used only for the two messages above.

5. Cookies and browser storage

• One technical cookie keeps you signed in: HttpOnly, valid up to seven days, deleted when you log out.
• Your language choice (NEXT_LOCALE), the virtual cart and checkout of the parody storefront, and whether you closed the site disclaimer may be kept in your browser. The game also installs a service worker so it loads faster and works as an app.
• All of these are needed for the features you use, so the site shows no consent banner. There are no advertising or analytics cookies.

6. Retention

Account data and progress are kept while the account exists, or until you ask us to delete them. Email confirmation links expire after 24 hours and password reset links after 30 minutes; both work once. Expired sessions and attempt counters are deleted daily. Database backups may keep earlier copies for a limited time.

7. Providers

The site is hosted by Vercel. The database runs on a virtual private server managed by LZ/Lucz. If you add an email, confirmation and reset messages are delivered by Resend. When you play from itch.io, itch.io shows the game in its own page under its own privacy policy. These providers process data only as needed to deliver their service.

8. Transfers outside the EU

Some providers may process data outside the European Economic Area. In that case the transfer relies on the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

9. Your rights

You can ask for access, rectification, erasure, restriction, portability, and object to processing. You can add, change or remove your email yourself from your account page. You can also lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).

10. Security

Passwords, recovery codes, sessions and one-time links are stored only as hashes, the session cookie is HttpOnly, and the database is reachable only from the server. Using a pseudonym does not make you completely anonymous: network services may process technical data to handle the connection.

11. Changes

This policy may change when the game changes. The version on this page is the one that applies.