← Back to MRR Wars

Privacy Policy

Last updated: March 13, 2026

1. Overview

MRR Wars ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have over it.

By using MRR Wars, you agree to the collection and use of information as described in this policy.

2. Data We Collect

2.1 Account Data

When you register, we collect:

  • Username — displayed publicly on the leaderboard and public profile pages.
  • Email address — used for authentication, account communications, and support. Not displayed publicly.
  • Password — stored as a one-way bcrypt hash. We never store or have access to your plaintext password.
  • Avatar URL — only if you sign in via Google or X (Twitter) OAuth; sourced from your social profile.

2.2 Profile Data (Optional)

You may optionally provide:

  • X (Twitter) handle — displayed publicly on your profile and leaderboard.
  • LinkedIn URL — displayed publicly on your profile.

These fields are entirely optional and can be left blank or removed at any time.

2.3 Game Activity Data

We record game events as part of normal gameplay, including:

  • Startups bought and sold, purchase prices and dates
  • Attacks launched and received, outcomes
  • Acquisitions initiated or responded to
  • Boosts, defenses, and market manipulation actions
  • In-game currency balances (Cash, Victory Points)
  • Leaderboard rank and score

Summary statistics (attacks won, attacks launched, defenses held) are displayed publicly on your profile page.

2.4 Technical Data

We automatically collect limited technical data when you use the Service:

  • IP address — captured in server logs for security, abuse prevention, and rate limiting. Not stored long-term in user records.
  • Browser / device type — captured in standard HTTP headers for debugging purposes.
  • Authentication tokens — a JWT (JSON Web Token) is stored in your browser's localStorage to keep you signed in. It contains your user ID, username, and email, and expires after 7 days.

2.5 Payment Data

If you subscribe to a paid plan, payments are processed by Stripe, Inc. We do not collect or store your payment card details. Stripe provides us with:

  • A Stripe Customer ID — used to manage your subscription
  • A Stripe Subscription ID — used to track your current plan status
  • Your plan tier (free, pro, or elite)

Full payment data (card numbers, billing address) is handled entirely by Stripe and subject to their Privacy Policy.

3. How We Use Your Data

We use the data we collect to:

  • Provide the Service — authenticate you, run the game, calculate portfolios and leaderboards.
  • Send transactional emails — account confirmation, password reset, and billing-related notifications.
  • Process subscriptions — create and manage your Stripe customer and subscription records.
  • Prevent abuse — detect multi-accounting, cheating, and automated access.
  • Improve the Service — analyse aggregated, anonymised gameplay statistics to balance game mechanics.
  • Respond to support requests — when you contact us via the Contact page.

We do not sell your personal data to third parties. We do not use your data for advertising.

4. Public Information

The following information is publicly visible to anyone — including non-logged-in visitors:

  • Username
  • X (Twitter) handle (if provided)
  • Leaderboard rank and score
  • Attack/defense statistics
  • Portfolio value and holdings count

Holdings details (which startups you own) are gated — only visible to paid subscribers viewing another player's profile, or to the account owner. Free-tier viewers see anonymised placeholder data instead.

Your email address and LinkedIn URL are never shown publicly.

5. Data Sharing

We share data only with the following third-party services necessary to operate MRR Wars:

  • Stripe — for subscription billing. Receives your email and plan information to create a customer record.
  • Resend — for transactional email delivery (account confirmation, support replies). Receives your email address and the email content.
  • TrustMRR — we query the TrustMRR API for startup data. We do not send your personal data to TrustMRR.
  • Google / X (Twitter) — only if you choose to sign in via OAuth. They provide us with your name, email, and profile picture.

We may also disclose your data if required by law, court order, or to protect the rights, property, or safety of MRR Wars, its users, or the public.

6. Cookies and Local Storage

MRR Wars does not use advertising or tracking cookies.

We use browser localStorage to store:

  • Authentication token (mrrwars_token) — your JWT, expires in 7 days.
  • Tutorial state (mrrwars_tutorial_done) — a flag to avoid showing the tutorial repeatedly.

We use a server-side session cookie temporarily during OAuth sign-in flows (Google, X/Twitter). This cookie is discarded once authentication completes.

You can clear localStorage and cookies at any time through your browser settings. Clearing the auth token will sign you out.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account:

  • Your profile, username, email, and game data are permanently deleted from our database.
  • Server logs (IP addresses, request logs) are retained for up to 30 days for security purposes, then deleted.
  • Stripe retains billing records for legal and financial compliance purposes, subject to their own retention policy.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Correction — update your username or email via the Profile page at any time.
  • Deletion — delete your account and all associated data via the "Danger Zone" section of your Profile page. Deletion is immediate and irreversible.
  • Portability — request an export of your game data.
  • Objection / Restriction — object to or request restriction of certain processing activities.

To exercise any of these rights, use the Contact page or delete your account directly from your Profile.

9. Security

We implement reasonable technical and organisational measures to protect your data, including:

  • Passwords stored as bcrypt hashes (never in plaintext)
  • HTTPS/TLS encryption for all data in transit
  • JWT-based authentication with expiry
  • Rate limiting on authentication endpoints
  • No payment card data stored on our servers (handled entirely by Stripe)

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach.

10. Children's Privacy

MRR Wars is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the Service after updates constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, requests, or concerns, please reach us via the Contact page.