Privacy Policy

What Build a Syndicate collects, why, how long it is kept, and how to make it go away. No legalese.

Last updated: 20 July 2026 · Version 2026-07-20

1. Who runs this

Build a Syndicate is run by a single individual, referred to here as the operator. The operator is the data controller for the information described below. Contact goes through the in-game Support system, described in section 12.

2. What we collect and why

Your account

• Username and display name. Needed to have an account and to be visible to other players.
• Email address, optional. You are not required to give one to register. You can link one later in Settings, confirmed with your password. It is used for account recovery and for the operator to reach you about your account. It is not used for marketing.
• Password, stored as a one-way hash with a per-account random salt. See section 3.
• A session token, so you stay logged in.
• Account creation time, plus an admin flag and any ban state that applies to you.

Anti-abuse and anti-alt

• IP addresses. We record the IP you registered from and the IP you last used, and we keep a history of every account-and-IP pair we have seen. This exists to catch alt farming, ban evasion and abuse, which is what keeps the leaderboard meaningful.
• Country-level location. Each unique IP is looked up once to get a country, which is cached and shown on the moderation dossier. We do not track your street, city or precise location.
• A device tag. Your browser generates a random identifier and keeps it in local storage under bas_dev. It is not tied to your hardware and it tells us nothing about you. It is used for exactly two things: limiting how many accounts one browser can create (two), and enforcing one live session per device. It is not an advertising identifier, it is not sold, and it is not shared with anyone.

Gameplay

Everything your character is and does: cash, gold, bank, inventory, army and equipment, syndicate membership and rank, territory, marches, battle history, contracts, jobs, research, casino play, friends list, and playtime. This is the game. Without it there is no save file.

Communications

• Chat (world, syndicate and group), direct messages, and answers to in-game questions and polls are stored on the server so threads persist and so moderation and abuse reports are possible. Treat in-game messages as recorded, not private correspondence.

Payments

Payments run through Stripe on Stripe's own hosted checkout pages. Card numbers, CVCs and billing details never touch our server and we never see them. What we receive is a confirmation from Stripe that a payment happened. What we store is a Stripe customer reference (so a subscription renewal finds your character) and a ledger row per purchase: the Stripe event id, what was bought, the amount, and when. Stripe's own handling of your payment data is governed by Stripe's privacy policy.

Support

A support ticket stores your message, the issue category, any replies, and which account it came from. Tickets opened from the login screen, where you are not signed in, also require a contact email, because otherwise there is no way to answer you.

Terms and age confirmation

When you create an account we record that you accepted these terms: the time you accepted, which version you accepted (currently 2026-07-20), and that you confirmed you are 18 or older. This is kept as proof of consent and so we can re-prompt you if the terms change materially.

Signing in with Google, optional

If you choose Sign in with Google instead of a password, Google sends us the account's stable identifier, your email address, and basic profile information such as your name and picture. We store the identifier and the email address, and use them only to recognise you at sign-in. We never receive and never store your Google password. You can use the game without Google sign-in.

3. Passwords

4. Cookies and local storage

Build a Syndicate does not use advertising cookies of its own and does not sell data to advertisers. The game itself stores a handful of keys in your browser's local storage, which stays on your device:

• bas_user, bas_session, bas_token, bas_pid - who you are and that you are signed in. Strictly necessary.
• bas_dev - the random device tag described above. Strictly necessary, for anti-abuse.
• bas_world - which world you last played, so you land in the right one.
• bas_muted, bas_audio, bas_amb, bas_pokeramb - your sound and music preferences.
• bas_pk_fp - a poker table preference.

Clearing your browser's site data removes all of these. Clearing bas_dev mints a fresh device tag on your next visit.

Separately, the pages of this site load Google Analytics and Google Ads (gtag), which sets its own cookies and identifiers to measure visits and ad performance. That is a third party and it is described next.

5. Third parties

These are the only third parties involved. There are no data brokers, no ad networks beyond Google's tag, and we do not sell your personal information to anyone.

• Google Analytics / Google Ads (gtag, AW-18331411725) - measures visits and advertising performance across the site's pages. Governed by Google's privacy policy. You can block it with browser settings or an ad blocker and the game will still work.
• Stripe - payment processing. Receives your payment details directly. We do not.
• Google Identity Services - only if you choose Sign in with Google, as described in section 2.
• Hosting and database infrastructure - the servers the game runs on, which necessarily process the data above in order to store and serve it.

6. Why we are allowed to hold it (lawful basis)

In plain English, and in the language the GDPR uses:

• To give you the game you asked for (contract): your account, your progress, your messages, your purchases.
• To keep the game fair and safe (legitimate interests): IP history, device tags, moderation records, ban and appeal records.
• Because you said yes (consent): linking an email, signing in with Google, and analytics or advertising cookies where your local law requires consent for them.
• Because we have to (legal obligation): keeping records of payments.

7. Children

This service is 18+ and is not directed at children. We do not knowingly collect data from anyone under 18. If we discover that an account belongs to someone underage, the account is closed and the data behind it is deleted. If you believe a child has an account here, tell us through Support and we will act on it.

8. How long we keep things

• Your account and progress are kept for as long as the account exists.
• Guest accounts. A guest account is created for you with a machine-assigned name so you can play immediately. It holds real progress, exactly like a normal account. A guest account that has not been claimed and has been inactive for 7 days is permanently deleted, along with its progress. If you want to keep what you built, claim the account with a real username and password before then.
• Account deletion. When you delete your account from in-game Settings, and confirm with your password, the account goes invisible immediately and is scheduled for permanent erasure after a 2-day grace period. During the grace period you can restore it simply by logging back in. After it passes, a sweeper erases the account and its data permanently, and it cannot be brought back. An account deleted by the operator for rule breaking cannot be restored by the player.
• Moderation records such as IP and device history, ban reasons and appeals are kept while they are needed to prevent ban evasion and repeat abuse.
• Payment records are kept as long as required for accounting and tax.
• Chat and message history is kept while the game world it belongs to exists. A world reset clears the progress in that world.

9. Your rights

Wherever you live, you can ask us to:

• Access the data we hold about you, and get a copy.
• Correct anything that is wrong.
• Delete your account and data. The self-serve route is in-game Settings.
• Object to or restrict some processing, or withdraw a consent you gave.

If you are in the UK or the EEA, these are your rights under the UK GDPR and the GDPR, including the right to complain to your local data protection authority. If you are in California, the CCPA gives you rights to know what is collected, to request deletion, and not to be discriminated against for exercising them. We do not sell or share personal information as those terms are used in the CCPA.

To exercise any of this, open a ticket in the in-game Support system. We will ask you to prove the account is yours before we hand over or erase anything, which protects you more than it protects us. We aim to answer within 30 days.

10. Security

What we actually do, without overselling it:

• Passwords are scrypt hashed with a per-account salt and compared in constant time. A database leak alone does not reveal passwords.
• Sessions use random tokens, not your password, and a token is cleared when you delete or disable the account.
• Traffic to the site is served over HTTPS / TLS.
• Payment card data is never handled by our server at all, which is the strongest protection available: we cannot leak what we never had.
• Login attempts are rate limited, and the Stripe webhook is signature verified so purchases cannot be forged.

No system is perfectly secure, and we will not pretend otherwise. If a breach happens that affects you, we will tell you and, where the law requires it, the relevant authority.

11. Changes to this policy

We can update this policy. When we do, the version string at the top of this page changes. The current version is 2026-07-20. Significant changes will be flagged in-game.

12. Contact

Everything goes through the in-game Support system, which reaches the operator directly. There is a Support option on the login screen too, for when you cannot sign in, and that route asks for a contact email so you can get an answer. You can also reach us on Discord. We do not publish a postal address, since the service is run by an individual.

The rules of play live on the Terms of Service page.