Privacy Policy

Last updated: August 17, 2026

No Overall Control ("we", "the site") is a turn-based strategy game about a fictional city council election. This policy explains what information we collect when you use the site, why we collect it, and what we do with it. We keep things simple: the site has no advertising, no ad trackers, and no analytics beacons.

1. What we collect

Account data

When you create an account you give us:

• an email address (used only to confirm the account and for account-related messages),
• a username and an optional display name (these are public and shown in games),
• a password, stored only as a salted, hashed value (scrypt); we can never read it back,
• a permanent user ID (e.g. NOC-XXXXXX) that is public and identifies you across games.

Google sign-in data

If you choose to sign in with Google, Google Identity Services returns your Google name, email address, and a stable account identifier. We never receive or store your Google password. Google's own privacy policy applies to the sign-in step itself; you can read it at policies.google.com/privacy.

Session data

When you sign in, the server issues a session token that expires after 24 hours. The token is stored in your browser's local storage, and only a hash of it is kept on the server. You can sign out at any time, which revokes the token immediately.

Game data

Guest players and accounts alike can create and join games. We store the party name you choose, the actions you take during a game, and the final results, so the game can be resumed and replayed. Guest games are tied to a browser-stored game token, not to a personal identity.

Presence data

The footer shows how many people are on the site. To do this, each browser sends a random identifier every 30 seconds; records older than 10 minutes are deleted. This identifier cannot be used to identify you.

2. How we use the data

• to create and run games, and to let you sign in,
• to link your games to your account when you sign in,
• to send the account confirmation email,
• to keep the site working and safe, and to fix problems.

We do not use the data for advertising, profiling, or selling to anyone.

3. Where the data lives

The site is hosted on Render, with a PostgreSQL database hosted in Frankfurt, Germany. Confirmation emails are sent through Resend. These providers act on our behalf and only process data to provide their services.

4. How long we keep data

• Session tokens: deleted after 24 hours or on sign-out.
• Unverified sign-up attempts: deleted after 24 hours.
• Accounts and game data: kept until you delete your account. Deleting your account (from the Profile page) removes your email, username, and sign-in sessions; games you played keep running as guest games and are kept.

5. Your choices

• You can change your username and display name from the profile page.
• You can use email + password instead of Google sign-in.
• You can delete your account yourself from the Profile page (Profile > Delete account): it removes your email, username, and sign-in sessions. There is no need to contact us.

6. Children

The site is not directed at children under 13, and accounts may only be created by people aged 13 or older.

7. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will be called out in the in-game patch notes.

8. Contact

Questions about this policy can be sent to support@nooverallcontrol.com.