PRIVACY POLICY

1. Who we are

AMS.ceo is an airline management simulation game operated from the United Kingdom. The data controller is the operator of AMS.ceo, contactable via the Contact page. We are a small independent project, not a large corporation.

2. Information we collect

• Account data — the name and email address you register with, and your password (stored only as a secure bcrypt hash; we never see or store your plaintext password).
• Session data — a session cookie and your IP address, used to keep you signed in and protect against abuse.
• Game data — the airline, fleet, routes, finances and activity you generate while playing.
• Payment data — if you purchase credits, the transaction is processed by Stripe. We receive a transaction reference, the amount paid and your email, but we never see or store your card details. Stripe's own privacy policy governs the data they collect.
• Contact form data — if you message us, the name, email and message you submit.

We do not collect or process any special category data (e.g. race, health, political opinions).

3. Legal basis for processing

Under the UK GDPR and EU GDPR, we process your data on the following bases:

• Contract — account data, game data and payment data are necessary to provide the game service you signed up for (Art. 6(1)(b)).
• Legitimate interest — session/IP data for security, fraud prevention and service stability (Art. 6(1)(f)).
• Consent — contact form submissions are voluntary; you choose what to send us.
• Legal obligation — payment records may be retained as required for tax and accounting law (Art. 6(1)(c)).

4. How we use your data

Your data is used solely to operate the game: to authenticate you, run your airline, process purchases, show leaderboards and competition within worlds, and respond to support requests. We do not sell, rent or share your data for advertising or marketing purposes.

5. Cookies and local storage

We use a single essential session cookie to keep you logged in. We also use localStorage in your browser for preferences such as your light/dark theme and sidebar state. No advertising, analytics or tracking cookies are used. Because we only use strictly necessary cookies, no cookie consent banner is required.

6. Third-party services

• Stripe — processes credit pack purchases. Your payment details are handled entirely by Stripe and are subject to Stripe's Privacy Policy.
• Railway — application hosting and database infrastructure (servers located in the United States).
• Map tiles — the live map loads tiles from CARTO / OpenStreetMap; your IP address is visible to those providers when tiles load.

We do not use Google Analytics, Facebook pixels, or any other tracking or advertising services.

7. International data transfers

Our servers are hosted on Railway infrastructure in the United States. If you are located in the UK, EU or EEA, your data is transferred to and processed in the US. We rely on Railway's compliance with applicable data transfer mechanisms. Stripe processes payment data in accordance with its own international transfer safeguards. By using the Sim, you acknowledge this transfer. You can request deletion of your data at any time (see "Your rights" below).

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure ("right to be forgotten") — ask us to delete your account and associated personal data.
• Data portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us via the Contact page. We will respond within 30 days. See the Data Handling page for retention and deletion details.

9. Do Not Sell or Share My Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. This applies to all users, including California residents under the CCPA/CPRA. Because we do not sell or share data, there is no need to opt out — but if you have concerns, please contact us.

10. Non-discrimination

We will not discriminate against you for exercising any of your privacy rights. You will not receive a different level of service or pricing for making a privacy request.

11. Children's privacy

AMS.ceo is not directed at children under 13 (or under 16 in jurisdictions where the GDPR sets a higher age of consent). We do not knowingly collect personal information from children. If you believe a child has provided us with data, please contact us and we will delete it promptly.

12. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). EU residents may contact their local data protection authority.

13. Changes to this policy

We may update this policy as the Sim evolves. Material changes will be reflected by the "last updated" date above. If we make significant changes that affect how your data is used, we will notify registered users via email or an in-app notice.