Privacy Policy

Who is responsible

DEIV Intelligence (“DEIV”) is an independent web tool for players of the browser game Sim Companies. The person or organisation that runs DEIV (the “operator”) is responsible for the processing described in this policy (the “controller”, where data-protection law uses that term).

The operator is David S.

Country of residence or establishment

PENDING: to be provided by the operator

Privacy requests: use the form on the Contact page (type “Privacy request”), or write to billbuffett on Discord.

How DEIV is built: your data stays with you

DEIV has no user accounts. Visitors sign in with the same shared access code; the operator signs in on the same screen with a separate credential, and the server tells the two apart. DEIV never asks for your name, e-mail address, phone number or any other real-world identity.

The company you enter, your buildings, imported accounting files, decisions, scenarios, alerts, notes and settings are saved in your browser's storage (IndexedDB) or, if you prefer, only in the memory of the current tab. When you open DEIV in a tab, your browser sends a copy of this workspace to the server so that it can calculate your results. The server keeps that copy in its memory only: it does not write your company data to disk or to its database, and normally not to its logs (see “Error logs” below). When you sign out, the copy is deleted.

What data is processed, and why

When you visit and sign in

• Network data. Like any website, the server and the hosting provider receive your IP address and standard request information, such as your browser's user agent and the page requested, in order to deliver the pages. DEIV's own code never writes an IP address to disk: the only address-derived data it saves are the keyed hashes described under sign-in protection.
• Sign-in protection. To slow down password guessing, the server keeps in its memory a record of failed sign-in attempts per client IP address (or per known browser, see below). It also keeps a list of clients that recently signed in successfully, so that attacks by others cannot lock them out: this list is saved on the server's disk as keyed hashes of the addresses, never the addresses themselves, so that a restart does not lose it. An entry counts for at most 30 days and is ignored after that; it is removed from the file when newer entries push it out (the list keeps at most 1024 entries) or the first time the file is rewritten after a server restart. To keep the service available, the server also limits, in its memory, how often each network address and each session can send a copy of a workspace, and how often each network address can ask for a live game price. Apart from that list, these records stay in memory only and disappear when the server restarts.
• Session cookie. After you enter the access code, DEIV sets one cookie (deiv_session) that contains the sign-in time, a random value and a signature. It contains no name, e-mail address, IP address or company data. When you sign out, the server saves a hash of this cookie (never the cookie itself) on its disk, so that a copy of it can no longer be used. Once the cookie would have expired, the hash is ignored; it is removed from the disk only when that file grows past 4 MB and is compacted.
• Known-browser cookie. A successful sign-in also sets a cookie (deiv_device) that contains the time it was issued, a random identifier, a one-letter marker of how it was obtained (with the access code or with the operator's secret token) and a signature. It does not sign you in by itself. It lets the sign-in protection recognise this browser for 30 days, so that failed attempts by other people do not lock you out.
• Security events. Failed or slowed-down sign-ins and refused requests are kept for the operator in a short list in memory, with a pseudonymous tag instead of your IP address. They disappear when the server restarts.

When you use DEIV

• Your workspace: the game data you enter or import, such as your company name, buildings, accounting exports, decisions, scenarios, alerts, notes and saved chat batches. This is pseudonymous game data. Accounting exports may contain the names of other in-game companies you traded with. It is used only to calculate the results you ask for. The operator's own workspace is kept on DEIV's server instead of in a browser, so that the operator finds the same company on every device.
• Temporary results. While you work, the server keeps results derived from your data in its memory for a short time (for example, answers are reused for about 20 seconds). Finished calculations are deleted together with the server's copy of your workspace; some cached intermediate results can stay in memory until they are replaced or the server restarts.
• Pasted chat. If you paste in-game chat, the server replaces player names with a keyed pseudonym (a hash made with a key kept on the server, the same for all visitors) before anything is kept, so the names are pseudonymised, not anonymised. The pasted text itself is not kept. If you choose “Analyze and save”, the recognised offers are saved as a batch in your workspace until you delete it: each line without player names and with @mentions masked, the keyed pseudonym of its author, and the room name you typed. For the operator, these batches are saved in the operator's workspace on DEIV's server.

Anonymous usage counts

• For each day, the server counts the number of distinct sign-in sessions, which screens were opened, how many requests each part of DEIV received, and how many server errors occurred. To count distinct sessions, it makes a hash of the session cookie with a random key that exists only for that day. The key and the hashes are kept only in the server's memory, so that the same session is not counted twice, and are never written to disk; they are replaced at the first count of the next day (UTC) or lost when the server restarts.
• Only daily totals are stored: date, measure, screen or area name, and count. No IP address, user agent, cookie value, company data or time finer than a day is stored. The totals are kept for 90 days. The operator's own visits are not counted.
• You can switch this off: see “Your choices” below.

Error logs

• Technical warnings and errors are written to the server log, which the hosting provider collects. They normally contain no personal data. In rare cases, for example when an accounting file cannot be read, the file name you chose may appear in the log.

When you ask for access to a Company Optimizer tool

• Access ID. If you ask for access to Best Company, Target Planner or Optimize My Company, DEIV sets the access ID cookie (__Host-deiv_vid), which holds a random identifier, a renewal counter and a signature. The server keeps only a hash of the identifier, a short public handle (such as V-AB12-CD34) and its status, never the cookie itself. It is created only by your first request.
• Your request: the tool you asked for and, only if you choose to fill them in, a company name, a contact and a message, cleaned of hidden characters (DEIV refuses anything that looks like a password or a token). The operator reads them to decide. They are deleted 180 days after the request is closed, unless an authorized run it gave is still unused; a request nobody decides expires after 30 days.
• Authorized runs and receipts: the runs the operator authorized, when each was used and how it ended. For a delivered result the server stores only a receipt — the SHA-256 hash and size of what you received and whether it was partial — never the result itself and never your company data. The result is kept in the server's memory only, so that you can open it again for up to 7 days; it is lost earlier when the server restarts or needs the memory. Your browser keeps its own copy of each delivered result in “Your runs”, checked against its receipt, until you remove it; that copy is not sent to the server.
• The operator's decisions and notes and the history of access events are kept for 365 days; daily counts of refused attempts for 90 days. An access ID not seen for 180 days is erased with everything linked to it; a blocked one keeps a minimal record for 365 days unless you delete your access data. “Delete my access data” in My access erases everything at once; an access ID cannot be recovered on another browser or device.

When you write to the operator

• The contact form stores the type of request, your message, the way to answer you that you chose (your Discord username or an e-mail address, only if you give one), the language of the page and when the message was received, read and handled. It stores no IP address, browser details or session: the limit on how many messages one network address can send is kept only in the server's memory.
• Only the operator reads your message, in DEIV's administration. It is not forwarded to any bot, e-mail service or other provider. Once the operator marks it as handled, it is deleted automatically 90 days later.

Cookies & Local Storage lists every cookie and storage item.

Public game data about other players

To show rankings, company value histories and the game's newspaper, the DEIV server collects public data about Sim Companies companies, including companies run by players who do not use DEIV. This data does not come from you, and DEIV does not ask those players for it. The operator's own company data, which DEIV keeps on its server, can also contain data about other players: the in-game company names in accounting exports the operator imports, and the keyed pseudonyms of the authors of chat offers the operator saves.

• Sources: the public leaderboard published by SimcoTools, read once a day (the top 1000 companies and the companies ranked within 150 places of the operator's company); also from SimcoTools, the public profile and the value history of the operator's own company, and the value histories (value and rank by date) of up to 25 companies the operator follows, at most 10 of them a day; and the newspaper published by Sim Companies. Also from SimcoTools, at most every 14 days, the pages of its company list that hold the companies DEIV shows, read only for their logos; and each of those logo images, downloaded once from the game's image host.
• Data: in-game company names and identifiers, ranks and rank changes, company values and value changes, building and patent values, number of workers, bonds sold and whether a company was deleted; for followed companies, their value and rank by date; for the operator's own company only, also its country, its level and the full public profile record; for newspaper articles, the author's company name, the title and an excerpt. For logos, DEIV keeps the web address SimcoTools gives for the logo of the companies it shows and a copy of each image; copies no company uses any more are deleted at the next check. These are game identities chosen by players, not real names, but a company can relate to a person. In the operator's own company data: the in-game company names of trading partners in imported accounting exports, and the keyed pseudonyms of chat authors in saved chat batches.
• Purpose and legal basis: showing public game rankings and news in DEIV, based on the legitimate interest in offering an analysis tool for the game. This assessment is pending legal review.
• Who receives it: it is stored on DEIV's server at its hosting provider, Railway (see below), and shown in DEIV's screens; the operator's own company data is shown only to the operator. It is not sold or passed on to anyone else.
• Retention: this data, the operator's own company data included, is currently kept without a time limit; a limit is still to be set (see below).

If you run a Sim Companies company and want its data removed from DEIV, or object to this processing, you can ask the operator.

To ask for removal or to object, use the form on the Contact page (type “Data removal”), or write to billbuffett on Discord.

Retention limit for this data and how removal requests are handled

PENDING: to be provided by the operator

Legal bases

Where the EU or UK General Data Protection Regulation (GDPR), or a similar law such as Brazil's LGPD, applies, DEIV relies on the following legal bases. This assessment is pending legal review.

• Providing the service you ask for (delivering pages, signing you in, calculating your results and keeping your work in your browser): the legitimate interest in providing a tool you have chosen to use (GDPR Article 6(1)(f)). The sign-in cookie, your workspace storage and your preferences are strictly necessary for that service; the Cookies page describes the other items and their status.
• Security and abuse prevention (sign-in protection, the known-browser cookie, the list of signed-out sessions and security events): the legitimate interest in protecting DEIV and its users.
• Anonymous usage counts: the legitimate interest in knowing which parts of DEIV are used and whether it works, with a simple way to object.

DEIV does not use your data for advertising, profiling or automated decisions about you. It does not sell or share personal data and does no cross-site tracking.

To use DEIV you only need to provide the access code, which is required to sign in, and your network data, which is needed to deliver the pages. Everything else you enter is optional; without it, DEIV cannot calculate the results that depend on it.

Access requests, authorized runs and their receipts rely on the legitimate interest in sharing a limited, free service fairly and in preventing abuse, and on the steps you ask for when you request access; contact messages rely on the legitimate interest in answering you and, where the law requires it, on handling your data-protection requests. This assessment is pending legal review.

Where data is processed

DEIV runs on Railway, a hosting platform operated by Railway Corporation (United States). Railway processes all traffic to DEIV and stores DEIV's server files. According to Railway's data processing agreement, processing takes place primarily in the United States, and transfers from the EU, the UK or Switzerland rely on the EU–US Data Privacy Framework where Railway is certified under it, and otherwise on the European Commission's Standard Contractual Clauses with the UK and Swiss additions. Railway's data processing agreement, which describes these safeguards, can be read at railway.com/legal/dpa.

Railway region used by DEIV, and confirmation that Railway's data processing agreement is in place

PENDING: to be provided by the operator

Your workspace and your preferences are stored in your own browser.

Who receives data

• Railway (hosting provider, processing on the operator's behalf): all requests, including IP addresses and request details at its network edge, the temporary copy of your workspace in the server's memory while you use DEIV, the server's files and the logs. Railway uses its own sub-processors: its data processing agreement says that its infrastructure runs on Google Cloud Platform, and its published list of sub-processors (trust.railway.com/item/subprocessors) names Cloudflare, Fathom Analytics, Causal, Customer.io and Stripe, without stating their purposes.
• No other website: DEIV's pages load nothing from other sites, so while you use DEIV your browser sends nothing to anyone else, unless you follow a link to another site. Company logos are copies served by DEIV itself: when the SimcoTools data gives a company a logo, only DEIV's server contacts the game's image host, once per image, never your browser. A company without one shows initials drawn in your browser.
• Sim Companies and SimcoTools (sources of public data): the DEIV server reads public market, encyclopedia, newspaper and ranking data from them. These requests come from the server, carry no cookies and contain nothing about you. Opening a product's market page can make the server request that product's public price history; only the product number and quality are sent.
• No other provider is used by DEIV itself: DEIV has no advertising, analytics, e-mail, payment or customer-support provider.

How long data is kept

• Sign-in cookie: up to 24 hours, or until you sign out. The server also refuses sessions older than 24 hours.
• Signed-out sessions: a hash of the cookie, on the server's disk. It is checked until the cookie would have expired (24 hours and 5 minutes after sign-in) and ignored after that; expired hashes are removed from the disk only when the file grows past 4 MB and is compacted.
• Known-browser cookie: 30 days after your last successful sign-in; signing out does not remove it.
• Your workspace in your browser: until you remove it (Local Data & Backup › Remove) or clear this site's data in your browser. Signing out keeps it on purpose.
• Temporary copy on the server: deleted when you sign out, or 30 minutes after your last request, or earlier when the server needs the memory or restarts.
• Temporary results on the server: finished calculations are deleted with the temporary copy; cached intermediate results stay in memory until newer results replace them or the server restarts.
• Sign-in protection and security events: in memory only, until they are replaced or the server restarts, except the list of clients that recently signed in successfully, which is saved on disk as keyed hashes. An entry counts for at most 30 days and is ignored after that; it leaves the file when newer entries push it out (the list keeps at most 1024 entries) or the first time the file is rewritten after a server restart.
• Anonymous daily totals: 90 days. The key and the hashes used to count distinct sessions: in memory only, until the first count of the next day (UTC) or a restart.
• Public game data about other players: currently without a time limit (see “Public game data about other players”).
• Server logs: kept by the hosting provider for the log retention period of the hosting plan.

Log retention period of the hosting plan in use

PENDING: to be provided by the operator

• Backups you download: on your device, under your control.
• The operator's own company data on DEIV's server, which can contain data about other players (see “Public game data about other players”): currently without a time limit; the backups of the server's state that the operator makes include it.
• Access data (only if you asked for access to a Company Optimizer tool): request texts until 180 days after the request is closed; decisions, notes and access events 365 days; daily counts of refused attempts 90 days; an access ID not seen for 180 days is erased with everything linked to it (a blocked one keeps a minimal record for 365 days). Delivered results are not kept on the server, only their receipts; the copy in your browser stays until you remove it.
• Contact messages: until the operator handles them, then 90 days.

Your rights, and how to use them

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to processing based on legitimate interests, and to restrict processing. DEIV has no accounts, and the server keeps no record that links your workspace or your activity to you (the only address-derived data on its disk are the keyed hashes used for sign-in protection), so the operator cannot look up “your” data on the server. Most rights are therefore exercised directly in the app:

• Access and portability: Local Data & Backup downloads a complete copy of your workspace as a file that you can restore in any browser.
• Correction: edit your data directly in DEIV.
• Deletion: Local Data & Backup › Remove deletes the workspace stored in your browser. It does not yet remove the last inputs of some calculators and tools, your display preferences or the offline copy of DEIV's files; to remove everything, also clear this site's data in your browser settings. The temporary copy on the server is deleted when you sign out, or by itself 30 minutes after your last request. If you asked for access to a Company Optimizer tool, “Delete my access data” in My access erases your access data at once.
• Objection to the usage counts: use “Don't count my visits” under “Your choices”.
• Shared devices: signing out keeps your workspace and your tool inputs in this browser. On a device other people use, remove your data and clear this site's data before you leave.

You can also contact the operator (see Contact). If you believe your data-protection rights have not been respected and data-protection law such as the GDPR applies, you can complain to a data-protection authority, for example where you live or work.

Your choices

Don't count my visits: you can ask DEIV to leave your visits out of its anonymous daily totals. DEIV then sets a small cookie that remembers this choice. DEIV treats your browser's Global Privacy Control or Do Not Track signal as the same request.

Session-only mode: in the introduction or in Local Data & Backup, you can choose to keep your work only in the current tab instead of in this browser.

Children

DEIV is not designed for children and does not knowingly collect children's personal data. It does not ask for age, name or contact details. Sim Companies' own terms apply to playing the game.

Minimum age for using DEIV, if any

PENDING: to be provided by the operator

Security

Data & Security describes the measures in place and their limits.

Changes to this policy

This policy is updated when DEIV changes how it handles data. The version and date at the top of the page identify the current text.

Contact

Contact & Legal Notice explains how to reach the operator.