Economies of Scale

Your account

We keep your email address, which is your login and where we send your verification and password-reset links. We keep your password only as a salted hash — we cannot read it and neither can anyone who runs the game.

We also keep when the account was created, your light or dark theme choice, and when you were last active, to within about five minutes. Your company — its name, its country and how it is doing — is part of a shared world, and other players can see it. Other players can also see the hour you were last active, not the time: its profile says “within the last hour”, or how many hours or days ago.

Logging in and signing up

To stop people guessing passwords or flooding the game with accounts, we record:

• Each failed login — the email address that was typed, and the time. These are cleared when that address next logs in successfully or resets its password.
• Your IP address and the time, each time someone at that address fails a login, tries to sign up (whether or not it works), asks for a password reset, asks for another verification email, sends feedback, starts a donation, or checks on a donation that has not been paid.
• A scrambled copy of your email address and the time, each time a verification email is sent to it, so that one inbox cannot be sent more than a few. It is a one-way code worked out from the address, not the address itself.

All three are deleted after 14 days. The limits themselves only ever look at the last 15 minutes; the rest of the fortnight is so that an attack on someone's account can still be looked into after it has happened.

A login lasts 24 hours. A verification link lasts 48 hours and a password-reset link 60 minutes. Each is deleted once it has expired.

Server logs

Apart from those records, and like most websites, the game's server keeps a log of every request it answers: each page you open, and each update a page asks for while it is open. For each one, the web server in front of the game records your IP address, the time, the address you asked for — including anything after a question mark in it, such as the code in a verification or password-reset link — and the other details your browser sends with it, such as which browser it is and which page you came from. Your password is never in it. That log is kept until it reaches 100 MB, and then for up to 90 days more.

Until 1 November 2026 the game itself also logged each request, with your IP address, the address you asked for and the time, in the server's system journal. It no longer does. The entries from before then have no time limit: the oldest are deleted only when the journal runs out of the space set aside for it, so they can be kept for months.

If you delete your account

You can delete your account from the Settings page. That removes your login, your company, and everything the company owned or had recorded against it.

These things are kept:

• Your email address, your company's number and the date you deleted it, in a list of deleted accounts. This is kept for ever. The email address of every account ever created is kept permanently, and the game is built so that it cannot be deleted or changed.
• Any feedback you sent, with your email address — see below.
• The record of any donation — the payment reference, amount and date, against your company's number.
• Trades your company made stay in the market's history, identified only by the company's number.

If you stop logging in

A company that nobody logs into is not kept indefinitely. We email you a reminder once it has gone 1 week, 2 weeks and 3 weeks without a login. After 6 weeks we email a final warning, and if nobody has logged in within 72 hours of that warning, the company and its account are deleted.

Logging in at any point resets the clock. A company deleted this way is treated exactly as if you had deleted it yourself: what is removed and what is kept are as described above, and your email address stays in the list of deleted accounts.

To send these emails we keep a note of which ones you have been sent and when. It is deleted with the account.

Feedback

When you send feedback we store what you wrote together with your email address, your company's name and its country, and we email the same to the person who runs the game.

The email address is kept on purpose, and it stays if you later delete your account, so that we can still reply to you. Feedback is kept with no expiry.

Other companies involved

• Resend sends the game's email. It handles your email address and the contents of your verification email, any password-reset email, any reminder that you have not logged in, and any feedback you send.
• PayPal takes donations. You pay on PayPal's own site, so the game never sees your card or bank details. We keep PayPal's reference for the payment, the amount, the date and whether it went through.
• Google Fonts supplies the typefaces. Your browser fetches them from Google directly, so Google sees your IP address when a page loads.
• DigitalOcean rents us the one server the game runs on, in Sydney, Australia. Everything above is stored there.

Backups

The whole game is backed up every night and before every update. Every backup is kept for 10 days, and after that one a week is kept until it is 45 days old. Anything deleted from the game — by you or by the 14-day rule above — can remain in a backup until that backup is itself deleted.

In your browser

The game sets no cookies. It stores a few things in your browser's own storage, on your device: the token that keeps you logged in, your light or dark theme, and small display preferences such as the resource you last looked at on the Market page.

Questions, or something you want removed

Email hello@econofscale.com, or use the Feedback page if you are logged in. Both reach the person who runs the game. The one thing that will not be removed is the email address an account was created with.