City of Chances Privacy Notice
v2 · October 17, 2026
1. Who is responsible and what this covers
City of Chances at https://citychances.com and its installed web-app form are operated by Hamidreza Gharahzadeh, an individual in Surrey, British Columbia, Canada. The operator is the privacy lead. Contact support@citychances.com for privacy questions, access or correction requests, account closure/deletion requests and complaints. This notice covers the publicly reachable, currently free early test. It is intended for adults who have reached the legal age of majority where they ordinarily live. An invitation is not required to visit or register; entry to a particular city still depends on its join rules and available seats.
2. Information we handle and why
If you use Google sign-in, we receive and verify a Google identity token. We use its account identifier and a suggested given name to create or recover your game account. Your chosen game nickname is separate from your Google name; later sign-ins do not overwrite it. Our account records contain the Google identifier, internal account identifier, chosen nickname/character, friend code and account-creation information. The current game does not store your Google password or use sign-in to access Gmail or Drive. Google handles its own sign-in processing under https://policies.google.com/privacy.
After you accept the current agreement and notice, we may also receive a profile-photo reference in your verified Google sign-in and associate it with your account. We retrieve a limited image through our server for your own profile header and Settings. You can choose Google photo or your game character in Settings. The photo is optional, is not shown to other players by this feature, and does not replace your in-game character artwork. If a suitable photo has not been supplied, we show the character or another local fallback; a later Google sign-in may supply one. An existing account's acceptance-free city recovery does not collect a newly supplied picture claim before the current agreement is adopted.
For accounts and guest seats we handle game/seat credentials, session and security records, chosen names/characters, city membership, fictional financial/game history and results, friendships, parties and invitations. We use them to provide multiplayer play, matching, recovery, consistent game settlement and security. We also retain the agreement version, associated document hashes, acceptance time, language and adult-eligibility affirmation. We do not ask for a date of birth for that affirmation; it is not identity or age verification.
For guest play we use an opaque browser-profile identifier in an HttpOnly cookie and store its associations with guest seats. This lets us apply the limit of five unfinished actual cities to that browser profile and connect its guest play across visits. Actual city lobbies and paused cities count; finished cities and permanently left seats do not. A bankrupt observer seat remains associated while its city is unfinished. Browsing or editing a personal party is not itself an actual city. Existing over-limit cities and old guest-seat credentials remain recoverable. This browser profile does not verify a real person: clearing its cookie or using another browser can create a separate anonymous profile. We do not use an IP address or device fingerprint to identify or combine guest profiles; connection addresses are still processed for the security purposes below.
Chat contains the messages you submit. Reports contain the reporter/target identifiers and relevant names, selected message and limited evidence, your category/note, timestamps and review status. We use these for communication, mute preferences and report review. Do not include sensitive information in chat or reports. A report is not an emergency channel and does not guarantee immediate action or an account sanction.
Our server processes connection addresses and security counters to limit abuse and maintain the service. Hosting and identity providers also process information needed to deliver their services. If you email support, we receive your address, message and any attachments you choose to send. We use that correspondence to handle your request; do not send passwords or unnecessary identity documents.
3. Other players and service providers
Other participants in the relevant city or social interaction can see your chosen name, relevant game activity and messages. Friends can see the relevant profile/presence information used by the friendship features. Chat is not confidential. Report evidence is restricted to the authorized operator's review tools, subject to lawful disclosure and service-provider access needed to operate the service. We may disclose information when required or otherwise lawfully permitted, for example to address a valid legal process or a security incident.
The optional Google profile photo is visible only in its owner's signed-in header and Settings in this version. Other players continue to see the chosen game nickname and existing game/social information, not this photo. Our server contacts Google's image service to retrieve it, and your browser receives the image through the game's authenticated route. Google processes that server request under its own policies.
We use Fly.io for hosting and persistent game/account storage, Google for sign-in and Porkbun email for support correspondence. Providers may use their own service providers. The primary game database is hosted in Fly's San Jose, California, United States region. Provider infrastructure, support, email or copies may involve processing outside Canada and outside that primary region, and information may be subject to the laws of those places. We do not promise Canadian-only processing. Provider information: https://fly.io/legal/privacy-policy/, https://fly.io/legal/sub-processors/, https://policies.google.com/privacy and https://porkbun.com/legal/agreement/privacy_policy.
This notice describes the public Fly-hosted test. A separate private home-test environment uses separate local storage; it is not the public test database.
4. Browser storage, security and optional uses
The browser stores guest-seat credentials, language/audio and other preferences, and local mute choices where applicable. Signed-in sessions use cookies; the ordinary session is valid for up to 30 days and a login challenge for about five minutes, subject to revocation. An installed web app caches its application shell for loading; game APIs, authentication and live streams are not stored in that shell cache. Clearing browser storage can remove preferences or guest recovery credentials. Signing out revokes the relevant game session; it does not delete every account or game record.
The guest-browser profile cookie is separate from a Google account session. It is an opaque identifier, not a name or fingerprint, and cannot be read by the page's JavaScript. It can be removed or expire under the browser/server cookie settings. Removing it can break the link to that guest profile, but it does not invalidate any existing guest-seat credential you still hold. Do not share guest-seat credentials or authenticated session information.
We do not use your game messages for advertising, sale of your content or general AI-model training. Google's separate sign-in processing still applies. We will explain new unrelated or optional uses and obtain consent where required rather than treating agreement acceptance as permission for them. We use access controls and other reasonable security measures, but no internet service can promise perfect security.
5. Retention and deletion
We retain information while needed for the test, your account and recovery, shared game history, security, report handling, and applicable legal or legitimate business requirements. The current test does not have a fixed automatic deletion schedule for all account records, finished cities, agreement receipts, reports or support correspondence. We assess requests and continuing retention needs; this does not authorize keeping information indefinitely after those purposes no longer justify it. Information supporting decisions affecting a person may need to be kept for a legally required period.
The guest-browser identifier and seat associations, and any stored verified photo reference, are account/recovery/profile records subject to these retention limits; clearing a browser cookie or hiding a photo does not itself erase the corresponding server record. Choosing Character in Settings stops the photo's display and new image requests. The verified reference can remain until replaced or removed following a privacy/account request. We do not keep a separate profile-photo history. Any operational image copy or existing backup remains subject to the applicable retention and deletion limits; immediate removal from every prior copy is not promised.
Each city retains its latest 100 ordinary chat messages; this is a message limit, not a deletion deadline. Qualifying abandoned unfinished cities can be retired and their full room data removed, while a minimal retirement summary, account records and separate report evidence may remain. Dismissing a report does not itself delete its evidence. Expired session records may remain until routine cleanup. Removing a live record does not promise immediate removal from shared history, lawful report evidence or any existing backup or exported copy. Contact us to discuss the records concerned and applicable retention rather than assuming that closing a tab, leaving a city or clearing browser storage deletes them.
6. Your choices, requests and complaints
You may use guest play instead of Google registration, subject to the browser-profile and guest-recovery limitations above, and may stop using the service. You can change your game nickname and choose Google photo or Character in Settings. Using the character fallback does not remove account access or require a forced logout. You may ask about your information, request access/correction, withdraw consent where applicable, or request account closure/deletion at support@citychances.com. We verify requests proportionately and explain any lawful limits, retained records or effect on ongoing play. There is currently no immediate automatic account-deletion button; requests are handled through support. We respond within applicable legal time limits and explain a lawful extension or refusal where required. Withdrawal does not undo lawful prior processing or remove another person's rights.
For a BC privacy concern, you may consult or complain to the Office of the Information and Privacy Commissioner for British Columbia: https://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint/. The Office of the Privacy Commissioner of Canada may be relevant where federal privacy law applies: https://www.priv.gc.ca/. These routes and other mandatory rights are not waived by the agreement. We will publish material notice changes and seek renewed consent when the change requires it.
Optional public-page statistics · 18 October 2026
This section updates the earlier statement that the site has no analytics SDK. Historical versioned notices and your game-agreement receipts remain unchanged; accepting the game agreement is not permission for optional analytics.
When enabled, we use Google Analytics only on public welcome, guide, terms and privacy pages to count visits and understand which languages and pages attract visitors. It does not run in the signed-in lobby, gameplay or admin panel. We do not send player names, emails, account IDs, city codes, invitations, chat, game actions, URL queries or fragments to Analytics. Advertising features, Google Signals, User-ID and automatic enhanced measurement are disabled.
Google receives public page addresses, browser/device information and approximate location information derived from network requests. Analytics may use _ga cookies to distinguish browsers; our cookie lifetime is limited to 180 days. Before activation, we set user/event data retention in our property to two months; aggregate reports may be retained longer. Google processes this information on its infrastructure, which may be outside your country.
In our opt-in regions, Google Analytics stays unloaded until you choose Allow statistics. You may decline without affecting access to the game. In the reviewed US opt-out configuration, public-page measurement may start unless you have declined or enabled Global Privacy Control or Do Not Track. We honour those signals. Other or unrecognised regions are not measured in this initial rollout.
Use Visitor statistics at the bottom of an eligible public page to change your choice. We store Allow or Decline, the policy version and time locally for up to 180 days. Refusal or withdrawal stops future collection and removes the Analytics cookies we set; it does not recall requests already sent. Clearing browser storage or changing browser/device may require another choice.
For regional choices, the server compares your network IP with a local DB-IP Country Lite database. We make no external IP-lookup request and do not save the lookup or IP as an analytics profile. Country estimates can be inaccurate, particularly with VPNs. An unknown or expired database leaves Analytics off. Google privacy information: https://policies.google.com/privacy. Contact: support@citychances.com.
Own-site entry channel counts · 23 October 2026. Under the same optional statistics choices and regional restrictions, we also count entries to public pages on our own server. Your browser converts an approved campaign source or referring site into a broad channel such as Reddit, Google or other; full queries and referrer addresses are not sent to this counter or to Google Analytics. Only UTC day, channel and aggregate count are stored for up to 90 days. These counts have no account, guest, browser or device identifier, IP address or individual event history. No additional attribution cookie is created. Each loaded document can count once; reloads may count again. Counts are not unique people, registrations or game starts. Refusing or withdrawing statistics permission stops future counts; already combined counts cannot be separated by person.