Privacy Policy

What we collect, why, where it lives, and how to delete it.

Last updated: 23 May 2026 · MQ City Builder Beta

1. Who we are

MQ City Builder ("MQ City Builder", "we", "us", or "our") is an independent browser-based city-building game operated by a sole developer. The service is reachable at mqcity.app. For privacy questions or requests, contact hello@mqcity.app.

2. What we collect

2.1 Without an account

If you play without signing in, we do not collect any personal information on our servers. Your save data is held entirely on your own device in your browser's IndexedDB, plus a small set of preferences in localStorage. Nothing is uploaded.

2.2 With an account

When you create an account or sign in, we collect:

• Email address. Used to identify your account and to send sign-in links and security-related messages.
• An account identifier (UUID). Generated by our authentication provider so we can associate your saved cities with your account.
• A hashed password if you create an account with email + password. We never see or store your password in readable form.
• Authentication timestamps (account created, last signed in) used for security and abuse prevention.
• Your saved city snapshots. When you have an account, your cities are uploaded as game-state snapshots so you can resume on another device. These contain only game data (tile grid, treasury, settings, etc.) — no personal content.

2.3 Technical data

Our hosting provider (GitHub Pages) and our authentication / database provider (Supabase) may log standard request data such as IP address, browser user-agent, and request timestamps for security, abuse prevention, and platform operations. We do not use this data for advertising or profiling, and we do not combine it with your game data.

We do not currently run any analytics, telemetry, or behavioural-tracking tools on the game itself. If we add gameplay analytics later, we will update this page first and disclose what is collected.

3. Cookies, IndexedDB, and local storage

MQ City Builder does not use advertising or tracking cookies. We use the following client-side storage mechanisms for the game to function:

• IndexedDB (city-builder database) — stores your save slots locally on your device so the game can resume offline. Required for the game to work.
• localStorage — stores preferences such as the active save slot, settings (volume, palette, UI scale, difficulty), tutorial state, and which transient prompts you have already dismissed. Required for the game to remember your choices between sessions.
• Supabase authentication tokens (stored in localStorage when you sign in) — keeps you signed in across sessions. Cleared when you sign out.

None of these are used for tracking, advertising, or sharing with third parties. Clearing your browser data will reset the game and sign you out.

4. How we use your information

We use the limited data described above to:

• Sign you in and keep you signed in.
• Save and restore your cities across devices.
• Send security and account messages (sign-in links, deletion confirmations).
• Diagnose technical issues and prevent abuse of the service.

We do not use your data for advertising, profiling, or automated decision-making, and we do not sell or rent it to anyone.

5. Who we share it with

We share data only with the third-party providers that operate the service on our behalf, and only the data needed to provide their part of it:

• Supabase (authentication and database) — handles your account, password hashing, sign-in emails, and storage of your saved cities. Supabase processes data on our behalf as a processor. See Supabase's privacy policy.
• GitHub Pages (web hosting) — serves the game's static files. See GitHub's privacy statement.
• Cloudflare (DNS and routing) — directs requests for mqcity.app. See Cloudflare's privacy policy.

We may also disclose data if required to do so by law (e.g. a valid court order), or to protect the rights, safety, or property of MQ City Builder or its users.

6. Where your data lives

Account and save data is stored on Supabase's infrastructure. Supabase operates data centres in multiple regions, including the United States and the European Union. By using the service you understand that your data may be processed in countries other than your own. We rely on Supabase's compliance posture and contractual safeguards for international transfers.

7. How long we keep it

We keep your account and saved cities for as long as your account is active. If you delete your account, we delete the account record and any cloud-stored saves associated with it. Backups may retain a copy for up to 30 days before they roll off; after that the data is gone.

Local data on your own device (IndexedDB and localStorage) is under your control — clear your browser data to remove it.

8. Your rights

Depending on where you live, you may have rights under laws such as the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and Canada's PIPEDA. These typically include:

Access

Ask us what data we hold about you.

Correction

Ask us to correct inaccurate data.

Deletion

Ask us to delete your account and associated data.

Portability

Ask for a copy of your data in a portable format.

Objection

Object to certain processing of your data.

Withdraw consent

Where processing relies on consent, withdraw it at any time.

We respond to verified requests within 30 days. To exercise any of these rights, email hello@mqcity.app from the email address on your account.

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we collect and the right to non-discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

9. How to delete your account

During the beta, account deletion is a one-step request:

• Open Settings in the game and tap "Delete my account", which will draft an email containing your account ID; or
• Email hello@mqcity.app from the email on your account with the subject "Account deletion request".

We confirm and process deletion within 30 days, usually much sooner. A self-service in-game deletion button is on the roadmap.

10. Children

MQ City Builder is not directed to children under 13 (or under 16 in jurisdictions that set that higher age for data-processing consent). We do not knowingly collect personal information from children under those ages. If you believe a child has provided us with personal information, contact hello@mqcity.app and we will delete the account.

11. Security

We use industry-standard safeguards via Supabase (TLS in transit, encryption at rest, hashed passwords, row-level security so each user can only access their own data). No service can guarantee perfect security, but we work to reduce risk and will notify affected users of any material breach as required by law.

12. Changes to this policy

We may update this policy as the game evolves (new features, new providers). When we make material changes we will update the "Last updated" date at the top and, for significant changes affecting how your data is used, notify signed-in users by email or an in-game notice.

13. Contact

For any privacy question or request: hello@mqcity.app.