An honest account of what this game stores, where it goes, how long we keep it, and what we will never do with it.
1. What We Collect
When you play the game and consent to data collection, we store:
Your yes-rate for each of the 8 Lifton criteria (L1–L8) — how you responded to each influence mechanism
Your overall cultability score
Your individual card responses — which way you swiped on each question
How long you took to complete the game
How many questions you answered
A random session identifier (not linked to your device or identity)
A timestamp — when you played
Your consent level — whether you chose anonymous or personal data sharing
We do not collect your IP address, device fingerprint, location, or any cross-site tracking identifiers. We do not use cookies.
2. Where It Goes
Your game data is sent to a secured database hosted by Supabase. Supabase infrastructure is hosted in Singapore. The database is protected by row-level security policies — only aggregate queries are permitted without authentication, and individual session data cannot be read by other users.
Your data contributes to the Sri Lankan average shown on the radar chart. This aggregate is displayed to all players but contains no individual responses.
3. How Long We Keep It
Anonymous game session data is retained for up to 12 months from the date you played. After that period, individual session records are deleted. Aggregated averages (which contain no individual data) may be retained indefinitely for research purposes.
If you sign in and later request deletion, your linked sessions will be removed within 30 days of the request.
4. If You Sign In
Signing in is entirely optional. The game works identically whether you sign in or not.
If you choose to sign in via email, two additional things happen:
Your email address is stored securely in our authentication system (managed by Supabase Auth, hosted in Singapore)
Your anonymous session identifier is linked to your user account — this lets us associate your game sessions with your identity
We use your email only for authentication (magic link sign-in). We will not send marketing emails, share your address with third parties, or use it for any purpose beyond letting you sign in.
5. Your Controls
You can change your data consent at any time using the controls below. Opting out means your future game sessions will not be stored or contribute to the Sri Lankan average. The game plays identically either way.
To request deletion of your data, or to ask any questions about what we hold, email riz@dgtl.lk.
6. Parent Policy
This game is a project of DGTL Holdings. All DGTL services are governed by a constitutional data protection policy built on seven core principles:
Data serves users — never exploitation, never dark patterns, never weaponised against you
Default deny — no external party has access to your data unless legally compelled with proper process
Vectorisation before analytics — raw personal information never enters analytics pipelines
Right to be forgotten — you can request deletion of all your data at any time
Transparency — we tell you what we collect, where it goes, and why
No third-party data monetisation — your data is never sold, traded, or exchanged for commercial value
Governance — data access requires Founder or Data Protection Board approval