privacy policy
v0.1 draft · last updated August 31, 2026 · under legal review
The short version: we collect the minimum needed to run a training game — your Google identity if you choose to sign in, and your play results. We run no ads, no analytics trackers, and no third-party cookies, and we never sell your data.
1 · Who is responsible
DarkMind ([legal entity name], [registered address]) is the data controller for TraitSpotter. Privacy questions and requests: [privacy contact email].
2 · What we collect
- If you sign in with Google: your name, email address, and profile picture (from Google), plus your play history — the scenario, difficulty, the calls you made, your scores, and when you played. This exists so you can track your own progress.
- If you use a team demo code: your email address — used to send the one-time code, and stored as a minimal account record (the email itself, nothing more) when you redeem it. Demo sessions expire after 24 hours, demo play is never saved, and demo account records are deleted on request.
- Everyone: server logs and abuse-prevention rate-limit counters (kept per IP address, or per account for signed-in users), and one flag in your browser's local storage remembering that you acknowledged the content notice. Anonymous play is not recorded.
3 · What we never do
No advertising, no analytics or tracking cookies, no cross-site tracking, no profiling, and no selling or renting of personal data — to anyone, ever.
4 · AI processing
Conversations are generated by Anthropic's Claude models. What you type in a conversation, together with the game's scenario context, is sent to Anthropic's API to generate the characters' replies. We use Anthropic's commercial API, under terms that do not permit training models on this data by default. Don't put personal information about real people into conversations — the terms of service also forbid it.
5 · Where your data lives
Our service providers (“subprocessors”):
- Anthropic — AI conversation generation
- Google — sign-in
- Neon — database (play history, accounts), hosted in [region]
- DigitalOcean — application hosting
- Cloudflare — network and delivery
- Resend — demo access-code emails
6 · Retention
Play history is kept while your account exists and deleted on request, as are demo account records. Demo access codes expire after 10 minutes; demo sessions after 24 hours. Rate-limit counters reset within minutes; operational logs are kept only for troubleshooting and abuse prevention. Administrative edits to game content are logged with the acting admin's identity and retained for accountability.
7 · Your rights
Wherever you are, we honour the core rights of the GDPR and CCPA: ask us what we hold about you, have it corrected, exported, or deleted. Email [privacy contact email] and we will handle it directly — we are a small team and requests are processed manually, within [30] days.
8 · Cookies
Only the essential cookies that power sign-in (a session cookie and its security companions), plus one local-storage flag remembering the content notice. No advertising or analytics cookies of any kind — which is why there is no cookie banner.
9 · Children
TraitSpotter is for adults (18+) and is not directed at children. We do not knowingly collect children's data.
10 · Changes
We will update this policy as the product evolves; the “last updated” date above always reflects the current version, and material changes will be flagged in the product.