City of Chances Privacy Notice

v2 · October 17, 2026

## 1. Who is responsible and what this covers

City of Chances at https://citychances.com and its installed web-app form are operated by **HamidReza Gharahzadeh**, an individual in Surrey, British Columbia, Canada. The operator is the privacy lead. Contact **support@citychances.com** for privacy questions, access or correction requests, account closure/deletion requests and complaints. This notice covers the publicly reachable, currently free early test. It is intended for adults who have reached the legal age of majority where they ordinarily live. An invitation is not required to visit or register; entry to a particular city still depends on its join rules and available seats.

## 2. Information we handle and why

If you use Google sign-in, we receive and verify a Google identity token. We use its account identifier and a suggested given name to create or recover your game account. Your chosen game nickname is separate from your Google name; later sign-ins do not overwrite it. Our account records contain the Google identifier, internal account identifier, chosen nickname/character, friend code and account-creation information. The current game does not store your Google password or use sign-in to access Gmail or Drive. Google handles its own sign-in processing under https://policies.google.com/privacy.

After you accept the current agreement and notice, we may also receive a profile-photo reference in your verified Google sign-in and associate it with your account. We retrieve a limited image through our server for your own profile header and Settings. You can choose Google photo or your game character in Settings. The photo is optional, is not shown to other players by this feature, and does not replace your in-game character artwork. If a suitable photo has not been supplied, we show the character or another local fallback; a later Google sign-in may supply one. An existing account's acceptance-free city recovery does not collect a newly supplied picture claim before the current agreement is adopted.

For accounts and guest seats we handle game/seat credentials, session and security records, chosen names/characters, city membership, fictional financial/game history and results, friendships, parties and invitations. We use them to provide multiplayer play, matching, recovery, consistent game settlement and security. We also retain the agreement version, associated document hashes, acceptance time, language and adult-eligibility affirmation. We do not ask for a date of birth for that affirmation; it is not identity or age verification.

For guest play we use an opaque browser-profile identifier in an HttpOnly cookie and store its associations with guest seats. This lets us apply the limit of five unfinished actual cities to that browser profile and connect its guest play across visits. Actual city lobbies and paused cities count; finished cities and permanently left seats do not. A bankrupt observer seat remains associated while its city is unfinished. Browsing or editing a personal party is not itself an actual city. Existing over-limit cities and old guest-seat credentials remain recoverable. This browser profile does not verify a real person: clearing its cookie or using another browser can create a separate anonymous profile. We do not use an IP address or device fingerprint to identify or combine guest profiles; connection addresses are still processed for the security purposes below.

Chat contains the messages you submit. Reports contain the reporter/target identifiers and relevant names, selected message and limited evidence, your category/note, timestamps and review status. We use these for communication, mute preferences and report review. Do not include sensitive information in chat or reports. A report is not an emergency channel and does not guarantee immediate action or an account sanction.

Our server processes connection addresses and security counters to limit abuse and maintain the service. Hosting and identity providers also process information needed to deliver their services. If you email support, we receive your address, message and any attachments you choose to send. We use that correspondence to handle your request; do not send passwords or unnecessary identity documents.

## 3. Other players and service providers

Other participants in the relevant city or social interaction can see your chosen name, relevant game activity and messages. Friends can see the relevant profile/presence information used by the friendship features. Chat is not confidential. Report evidence is restricted to the authorized operator's review tools, subject to lawful disclosure and service-provider access needed to operate the service. We may disclose information when required or otherwise lawfully permitted, for example to address a valid legal process or a security incident.

The optional Google profile photo is visible only in its owner's signed-in header and Settings in this version. Other players continue to see the chosen game nickname and existing game/social information, not this photo. Our server contacts Google's image service to retrieve it, and your browser receives the image through the game's authenticated route. Google processes that server request under its own policies.

We use **Fly.io** for hosting and persistent game/account storage, **Google** for sign-in and **Porkbun email** for support correspondence. Providers may use their own service providers. The primary game database is hosted in Fly's San Jose, California, United States region. Provider infrastructure, support, email or copies may involve processing outside Canada and outside that primary region, and information may be subject to the laws of those places. We do not promise Canadian-only processing. Provider information: https://fly.io/legal/privacy-policy/, https://fly.io/legal/sub-processors/, https://policies.google.com/privacy and https://porkbun.com/legal/agreement/privacy_policy.

This notice describes the public Fly-hosted test. A separate private home-test environment uses separate local storage; it is not the public test database.

## 4. Browser storage, security and optional uses

The browser stores guest-seat credentials, language/audio and other preferences, and local mute choices where applicable. Signed-in sessions use cookies; the ordinary session is valid for up to 30 days and a login challenge for about five minutes, subject to revocation. An installed web app caches its application shell for loading; game APIs, authentication and live streams are not stored in that shell cache. Clearing browser storage can remove preferences or guest recovery credentials. Signing out revokes the relevant game session; it does not delete every account or game record.

The guest-browser profile cookie is separate from a Google account session. It is an opaque identifier, not a name or fingerprint, and cannot be read by the page's JavaScript. It can be removed or expire under the browser/server cookie settings. Removing it can break the link to that guest profile, but it does not invalidate any existing guest-seat credential you still hold. Do not share guest-seat credentials or authenticated session information.

The current game includes no advertising or analytics SDK and does not request optional marketing permission. We do not use your game messages for advertising, sale of your content or general AI-model training. Google's separate sign-in processing still applies. We will explain new unrelated or optional uses and obtain consent where required rather than treating agreement acceptance as permission for them. We use access controls and other reasonable security measures, but no internet service can promise perfect security.

## 5. Retention and deletion

We retain information while needed for the test, your account and recovery, shared game history, security, report handling, and applicable legal or legitimate business requirements. The current test does not have a fixed automatic deletion schedule for all account records, finished cities, agreement receipts, reports or support correspondence. We assess requests and continuing retention needs; this does not authorize keeping information indefinitely after those purposes no longer justify it. Information supporting decisions affecting a person may need to be kept for a legally required period.

The guest-browser identifier and seat associations, and any stored verified photo reference, are account/recovery/profile records subject to these retention limits; clearing a browser cookie or hiding a photo does not itself erase the corresponding server record. Choosing Character in Settings stops the photo's display and new image requests. The verified reference can remain until replaced or removed following a privacy/account request. We do not keep a separate profile-photo history. Any operational image copy or existing backup remains subject to the applicable retention and deletion limits; immediate removal from every prior copy is not promised.

Each city retains its latest 100 ordinary chat messages; this is a message limit, not a deletion deadline. Qualifying abandoned unfinished cities can be retired and their full room data removed, while a minimal retirement summary, account records and separate report evidence may remain. Dismissing a report does not itself delete its evidence. Expired session records may remain until routine cleanup. Removing a live record does not promise immediate removal from shared history, lawful report evidence or any existing backup or exported copy. Contact us to discuss the records concerned and applicable retention rather than assuming that closing a tab, leaving a city or clearing browser storage deletes them.

## 6. Your choices, requests and complaints

You may use guest play instead of Google registration, subject to the browser-profile and guest-recovery limitations above, and may stop using the service. You can change your game nickname and choose Google photo or Character in Settings. Using the character fallback does not remove account access or require a forced logout. You may ask about your information, request access/correction, withdraw consent where applicable, or request account closure/deletion at support@citychances.com. We verify requests proportionately and explain any lawful limits, retained records or effect on ongoing play. There is currently no immediate automatic account-deletion button; requests are handled through support. We respond within applicable legal time limits and explain a lawful extension or refusal where required. Withdrawal does not undo lawful prior processing or remove another person's rights.

For a BC privacy concern, you may consult or complain to the Office of the Information and Privacy Commissioner for British Columbia: https://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint/. The Office of the Privacy Commissioner of Canada may be relevant where federal privacy law applies: https://www.priv.gc.ca/. These routes and other mandatory rights are not waived by the agreement. We will publish material notice changes and seek renewed consent when the change requires it.