Privacy Policy

1. The short version

• We read your precise location only while you have the app open, and only at the moment you open one of three screens. We do not track you in the background and we do not keep a location history.
• Your coordinates are used to answer the request you just made, and then discarded — with one exception: if you make an offer on another player's property, the spot you were standing in when you made it is stored with that offer. See section 4.
• Google never receives your exact position. Before we ask Google what buildings are nearby, your coordinates are rounded to the centre of a shared ~100-metre grid cell, and that rounded point is what we send.
• The game shows ads, served by Google AdMob — a full-screen ad now and then while you browse properties, and optional “watch this to double it” offers you choose to start. We run no analytics and no crash-reporting SDK. See section 3.2.
• We never see an advertising identifier, and on iOS none exists. The app does not read one, and the iOS build cannot obtain one at all. We do not sell your personal data. Section 3.2 is honest about what Google receives, because it is not nothing.
• You can delete your account from inside the app. Section 5 says exactly what that removes and — honestly — what it leaves behind.

2. What we collect

2.1 Precise location

What. Your device's latitude and longitude, requested at high accuracy.

When. Only in the foreground, and only as a single reading taken when you open one of these three screens:

Landlord does not track your location continuously, and it does not read your location while it is closed or in the background. Neither platform build asks for a background-location permission: the iOS app declares only NSLocationWhenInUseUsageDescription, with no location background mode, and the Android manifest declares only ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION, not ACCESS_BACKGROUND_LOCATION.

On Android 12 and later you may grant approximate location instead of precise. The game still works: the rule it enforces is a 500-metre radius, which is loose enough for a coarse fix.

Why. Two rules in the game depend on it, and neither can be enforced from the client:

• You can only see properties within 5 km of you.
• You can only buy a property you are within 1 km of.

Because a client could simply lie about either, both are checked on our server, which is why your coordinates are sent to us rather than kept on the device.

Where it goes. Your coordinates are sent to the Landlord server as part of these requests, and are used to answer that request:

With the single exception described in section 4, your coordinates are not written to our database and not written to our server logs. Our request log is built as a fixed list of named fields that cannot hold a URL, a query string, a request body or a header, specifically so that the latitude and longitude on the requests above cannot reach it.

2.2 Your account

To play you create an account with an email address and a password. These are handed straight to our database service, which stores the email and an Argon2id hash of the password. The Landlord game server does not keep its own copy of either, and it never stores your password in a form it could read.

You may also choose a display name. This is deliberately public — it is what other players see on the leaderboard, on property records, and on offers you send them. Display names are unique across the game.

Your session token is stored on your device in the platform keychain (iOS Keychain / Android Keystore), not in ordinary app storage.

2.3 Game activity

Playing writes ordinary game records: which properties you own, your cash and loans, your transaction history, your coin balance, your progression, and any listings, auctions or offers you take part in.

2.4 Technical data

Your IP address reaches our server as an ordinary consequence of your device connecting to it. We use it for two things and no others:

1. As a rate-limiting bucket key, so one player cannot exhaust the whole game's database budget.
2. As a daily counter key that caps how many billable map-search calls can come from one address (50 per day).

For (2), your IP address appears inside a cache key of the form places:budget:ip:<your ip>:<date>, which expires automatically after 25 hours. It is not stored in the database and is not written to our request log.

2.5 Purchases

If you buy coins, the purchase is processed by Apple or Google, and confirmed to us by RevenueCat. We never see your card details.

RevenueCat notifies our server of each purchase event. We store the complete notification — including RevenueCat's event id, the product bought, the environment, and the account identifier the event named — as an append-only audit record, so a purchase that goes wrong can be reconciled with a human.

Subscriptions (the Landlord Pass). If you subscribe, we additionally store on your account: which product you bought, when the subscription expires, whether it is set to renew, and how far the daily coin stipend has been paid. That is the whole of it — we store no billing detail, no payment method and no transaction amount, because we never receive any. Apple or Google bills you and RevenueCat tells us only that it happened.

2.6 Notifications

Landlord can remind you that your rent has landed or that your wallet is nearly full. These are local notifications, scheduled on your own device — nothing about them reaches us.

Push notifications are different. They exist for one thing: being outbid on a property, which is decided by another player's action on another device and which a closed app has no other way to learn about. If you allow notifications, your device gives us a push registration token and we store it against your account so we can send to that handset. The token identifies the device, not you, and we store nothing else about the device — no model, no OS version, no advertising identifier.

Registration tokens are held to the same rule as everything else here: they are deleted with your account. A token your device stops honouring is cleared automatically when Apple or Google tells us it is dead.

You can turn notifications off entirely at any time, from inside the app or in your device settings, and we will send none. Subscribers can additionally choose which kinds they receive. Both choices are stored on your account and are honoured on our side before anything is sent, not just on your device.

2.7 Messages you send us

More → Support inside the app sends us a message. We store what you wrote, the category you picked, the email address on your account at the time, your display name, and the app version and platform you were running — the last two so a bug report can be matched to a build.

Two of those are copies of something already on your account rather than lookups, and the reason is worth stating because it changes what deletion means: the reply has to go to the address you had when you wrote, and a message has to still make sense a year later. They are held to the same rule as everything else here — see section 5: deleting your account deletes every message you sent us along with it.

Nothing about a support message is shared with anyone else, and no other player can read one — including a message about another player.

2.8 What we do not collect

The following is stated as a positive commitment, and it is checkable: the app bundles no analytics SDK and no crash-reporting SDK. It does bundle Google's advertising SDK — section 3.2 sets out exactly what that means. Concretely, we do not collect:

• Advertising identifiers. Nothing we write reads one, and none reaches our server. On iOS none exists to read: the app declares no NSUserTrackingUsageDescription, so it can never present the App Tracking Transparency prompt, and the IDFA it would return stays all zeros for every user on every launch. On Android an advertising ID does exist on the device, and Google's ad SDK uses it — see 3.2, where that is described rather than denied.
• Contacts, photos, calendar, microphone, camera, health or fitness data.
• Your browsing or app-usage behaviour, on this app or any other.
• A location history. We keep no trail of where you have been.

We do not sell your personal data.

3. Who else receives data

3.1 Google (Places API)

To find out what buildings exist near you, our server queries the Google Places API. Two details matter:

• The request is made by our server, not by your device, so Google does not receive your IP address or any device identifier from us.
• We do not send your exact coordinates. Your position is first rounded to the centre of a shared ~100-metre grid cell, and that rounded point is what is sent. Everyone standing in the same cell produces the identical query, so Google cannot tell you apart from anyone else in it.

Google also receives place identifiers when we look up details of a specific building. Those identify a building, not you. Google's handling of this data is governed by its own privacy policy: policies.google.com/privacy.

3.2 Google AdMob (advertising)

The game shows ads, and this is the section that says what that costs you. There are two kinds, and you meet them differently:

• Interstitials — a full-screen ad that appears now and then as you open properties. You close it and the property is there; nothing is locked behind it.
• Rewarded ads — offers you start deliberately, by tapping something that says watching an ad will double a reward.

The ad request comes from your device, not from our server. That is the opposite of the Places arrangement in 3.1, and it matters: Google receives your request directly, so it sees the ordinary network information any direct connection carries, including your IP address — from which approximate location can be inferred. We do not send Google your coordinates for advertising, ever, rounded or otherwise.

Advertising identifiers differ by platform, and we are not going to blur that. On Android, your device has a resettable advertising ID and Google's ad SDK uses it. On iOS there is no equivalent: the app declares no App Tracking Transparency usage string, so the prompt is never shown and the IDFA stays all zeros. In neither case does the identifier reach us.

One thing we do send, and only for rewarded ads. When you choose to watch a rewarded ad, the app tells Google your Landlord account id, so that Google can tell our server the ad was watched and the bonus is owed. Without it we would have no way to know who to pay. It is sent for no other purpose, and never for an interstitial.

Consent, where the law requires it. If you are in the EEA or the UK, the app asks for your consent through Google's consent platform before the first ad is ever requested — not at launch, and never for a player who does not reach an ad. Declining does not remove ads; it makes them non-personalized, chosen without using stored signals about you. Declining everything means Google serves no ad at all, which is Google's rule rather than ours. Elsewhere, your device's own ad settings control ad personalization: on Android under Settings → Google → Ads, and on iOS under Settings → Privacy & Security → Apple Advertising.

What we cap. Every ad request this app makes is tagged with a maximum content rating of T — suitable for teen and older — so nothing rated for mature audiences only can be served here. Every request is also declared as not directed to children. The number of interstitials is limited on our server rather than in the app, so it cannot be raised by a modified client. Landlord Pass holders see no interstitials at all; rewarded offers remain available to them, because those are opted into.

Google's handling of this data is governed by its own privacy policy: policies.google.com/privacy, and its advertising practices at policies.google.com/technologies/ads.

3.3 Mapbox (map rendering)

The Discovery screen draws a real map using Mapbox, centred on your position. Rendering it means your device requests map tiles for the area you are looking at, directly from Mapbox. Mapbox therefore learns the approximate area you are viewing, together with the ordinary network information any direct connection carries, such as your IP address. This is the one place where a third party receives location-derived data from your device rather than from our server.

Mapbox's privacy policy: mapbox.com/legal/privacy.

3.4 RevenueCat (purchases)

As described in 2.5. RevenueCat's privacy policy: revenuecat.com/privacy.

3.5 Our own infrastructure

The game database is software we run ourselves rather than a third-party service that receives your data as a customer. Your account and game records live there.

Your IP address is forwarded from the game server to that database service, for the rate-limiting purpose described in 2.4.

Where it runs. The Landlord game server and its database are operated by MRGNHNT, LLC and hosted on Fly.io in the United States (Ashburn, Virginia). If you use Landlord from outside the United States, your data is transferred there.

4. How long we keep things

5. Deleting your account

You can delete your account from More → Delete account inside the app. There is no undo. A step-by-step version of this section lives at landlordgame.app/delete-account.

What deletion removes

• Your account record, including your email address and password hash.
• Every property you own, and its purchase record.
• Your claim on every building you held. Each one goes back on the market for anybody to buy, the same way a building lost to a lender does. Nothing else could happen to it: you are no longer there to sell it, so a claim left standing in your name would put that building permanently out of reach of every player in the game.
• Every loan.
• Your entire transaction history.
• Your coin ledger.
• Every one of your bids on auctions that have not yet settled — these are genuinely erased from the auction, not just marked.
• The coordinates recorded on every offer you made — the only precise location this game stores durably. The offers themselves are kept; the coordinate is cleared from them.
• All of your active sessions, everywhere, so you are signed out on every device.
• Your push registration tokens, so nothing can be sent to any device that was signed in to the account.
• Your display name reservation. The name you chose is released and can be taken by another player.
• Your subscription record — the product, the expiry, the renewal flag and your notification preferences. Note what this does not do: it does not cancel the subscription, which only you can do.
• Every support message you sent us, with the address and display name stored alongside it. The emails those messages produced are not reached by this — see 2.7.

Any properties you had listed for sale are withdrawn from the market first, so nobody can buy from an account that is being deleted.

When we will refuse to delete it

What deletion currently leaves behind

We would rather say this than let you assume otherwise. Deleting your account does not currently remove:

• The offers you made or received. The offer records stay — a declined or expired offer is the other player's only record that anybody wanted their building — carrying your former account identifier, the price and the date. The coordinates you made them from are cleared, as above.
• The withdrawn listing records for properties you had put up for sale. These keep your former account identifier.
• The history records for buildings you owned — the condition each was left in, and the log of what happened to it. These are about the building rather than about you, and a later owner needs to see them. They carry your former account identifier; the ownership claim itself is released, as above.
• Purchase audit records received from RevenueCat, which are append-only and retained for financial reconciliation.

After deletion these leftovers reference an account identifier that no longer resolves to anybody: the account, the email address and the password hash are gone. Your display name goes with them — names are stored only on the account and looked up when a screen needs one, so nothing that survives shows it. The leftovers are not, however, erased, and we are not going to describe them as if they were.

If you want any of the above removed as well, write to support@landlordgame.app and we will do it by hand.

6. Your choices

• Refuse location. The app asks before reading your location. If you decline, the three screens that need it will tell you so and the rest of the game keeps working. You can change your mind at any time in your device settings; the app offers a shortcut to that screen if the OS has stopped asking.
• Grant approximate location instead of precise (Android 12+). Supported.
• Limit ad personalization. In the EEA and the UK the app asks before the first ad is requested, and your answer is honoured per request from then on. Everywhere, your device controls this: Android under Settings → Google → Ads, iOS under Settings → Privacy & Security → Apple Advertising. Stated plainly, because it is a real limit: we have no in-app switch that turns ads off, and the only thing that removes interstitials is the Landlord Pass. We would rather say that than imply a control that does not exist.
• Turn notifications off, all of them, at any time, from inside the app. You do not need a subscription to do this and never will — it is honoured on our side, before anything is sent.
• Choose which notifications you receive, if you subscribe.
• Delete your account, as above — and see “When we will refuse to delete it” if you hold a subscription that is still set to renew.
• Ask us anything about your data — from More → Support inside the app, choosing Delete my data, or at support@landlordgame.app if you would rather write directly. Both reach the same person.

Depending on where you live, you may have additional rights — to access, correct, export or erase your personal data, and to complain to a data protection authority. Ask through More → Support or write to support@landlordgame.app, and we will honour them.

7. Children

Landlord is not directed to children. It reads precise location and offers in-app purchases, and it is not designed or reviewed as a children's app. It carries no age gate, and the age rating declared in the App Store and on Google Play is the one that governs who may download it.

The advertising in section 3.2 is configured to match: every ad request declares the app as not directed to children, and caps creatives at a T (teen and older) content rating, which excludes anything rated for mature audiences only.

8. What this policy does not yet state

Listed openly rather than filled with plausible text, because a privacy policy that asserts something no system enforces is worse than one that admits a gap.

1. Log retention. Server logs are written as JSON lines to standard output and collected by the host. No retention period is configured, so no number can honestly be printed in section 4.
2. Backups. No backup system is in place, so no statement is made about whether deleted data persists in one.

9. Changes to this policy

If we change this policy we will update the effective date at the top, and publish the change at the same URL. Material changes will be announced in the app.

10. Contact

MRGNHNT, LLC
support@landlordgame.app