Privacy - Midlife Crisis Command

What we hold about you

Your email address, to sign in. We email you a link that signs you in, and it works for 60 minutes. A password is optional. If you set one, it's stored only as a secure hash. If you add two-factor codes or a passkey, we store what's needed to check them.
When you join, you confirm you're 18 or over. We don't ask for your date of birth to join. We also keep when your account was made and which version of the Terms & Safety was showing then, and it's in your data download.
A callsign and a portrait choice, when you want them, and your units. Until you pick a callsign, you play as New Recruit. Your time zone is read once from your browser, so emails arrive at sensible hours; you can change it in game settings. Home country is optional.
Your name, if you choose to give it. It appears only as who an invitation you send is from, and nowhere else in the game: squad-mates, share cards and link previews see your callsign, or New Recruit until you pick one. It's in your data download, and you can clear it in game settings.
We no longer ask for a handle. If your account has one from before, it's in your data download. Other players never see it, and share cards never show it.
Your date of birth and whether to compare you with men's or women's published tables, if you choose to give them. Some military standards depend on age or on those tables, so we ask for them when one of your results needs them for a comparison. Armed forces publish fitness standards only in these two versions. We use your date of birth to work out your age on the day of each result.
If the date you give makes you under 18, we don't save it. We keep a note that it happened, which our admins can see, and stop asking for these details. Your data download says when. If you delete your account, the note no longer points to you.

What you log

The results you log. Once you've given your date of birth and tables, your age on the day and your chosen tables are stored with each result, to compare it with military standards that depend on them. If you correct a result, we keep what it said before.
Boots on the Ground keeps each day's step count you enter, the week it belongs to and the time zone that week ran in. A day far above your own usual asks you to confirm it once, and we note that it was asked. Your squad sees your week's total, never your separate days.
Private notes on a result are yours alone. Training logs stay private: no squad, table, duel or dispatch ever sees them.
If you send feedback, we keep your words, the screen you sent it from, whether you were on a phone, tablet or computer, and your last few game actions before you sent it. It's deleted with your account.
Once, about a month after your first result, Command may ask whether the game has changed what you do. We note when we show the question, so we stop after three visits. If you answer, we keep your answer and any words you add. If you tap "Don't ask again", we keep that too. It's in your data download and it's deleted with your account.
To improve the game, we record which screens and game actions you use, including who you salute or duel, whether a visit was on a phone, tablet or computer, and how far you got on the log form: the boxes you changed, each press of save, and which boxes a save turned down. Never what you typed or your exercise numbers. These stay while your account does, and go when you delete it.
To understand how the game is played, we sometimes study a copy of the game's data with analysis software.
We keep an admin record of decisions about accounts, like granting an admin role or the under-18 note. It holds who did what and when, never your results. It isn't in your download, and a deleted account is no longer named in it.

Signing in

For each link we keep your address, a scrambled copy of the link, the page it opens, when it was made and used and when it runs out, whether it made your account, a scrambled marker from the browser that tapped it and, encrypted, anything it carries on with: a duel or squad link (and which button shared it), a Try it result, a call-up's first name or an email change. We delete it 24 hours after the link is used or runs out.
When you ask for a sign-in link, we keep your connection's IP address for up to a day, only to limit how many links can be asked for.
While you're signed in, the session keeps your IP address and the browser string your device sends, so you can sign out everywhere and so a stolen session can be ended. A session goes 120 minutes after you stop using it, and signing out or deleting your account ends it at once.
Change your email: under Profile in settings. We email the new address a link, and your address stays as it is until you open that link while signed in to your account. Then we sign you out everywhere except the browser you confirm in and the one that asked, and email your old address to say it changed.

What your squad sees

Squads you're in see your results, including ones from before you joined. Training logs and private notes stay private.
Squad members see your callsign, or New Recruit until you pick one, and your portrait. They never see your email, time zone, date of birth, age, chosen tables, private notes or training.
Leaving a squad stops it seeing your results.
A squad captain can tap a couple of options to tell MCC what gets you moving and roughly how active you are, including on a call-up link before you join. Only that captain sees it. MCC uses it only to word that call-up and pick the tone of a few messages to you. It's in your data download. It stops being used if the squad closes, and it's deleted if you leave or are removed from the squad, or the captain hands over. You can turn captains' notes off in game settings, which deletes any about you. On a call-up the captain can also say what might put you off: that only words the call-up, never goes in your download, and is deleted within a day of the call-up being answered or closing. The tone it produced, a single word like "gentle", stays on that call-up so we can see which wording works.
The weekly dispatch's "Share the Field Report" box copies a short message with squad-mates' callsigns and the scores the squad can see, and a link. It goes only where you send it, and the link opens only for signed-in members.
If you turn down a squad-mate's duel with an excuse, only that squad-mate is told, in the app and by email. If you let it expire quietly, nobody is told.
If you call VAR on a squad-mate's number, only they are told, in the app and by email, and only they can change it. Their answer comes back to you alone. Both of you can see the whole exchange in your data download; nobody else in the squad is told.
On a squad mission your callsign shows beside what you contributed. You can leave your name off a mission when you join it, and the squad then sees the total without you named.
We don't show whether you're online, track your location, or read your contacts.

Someone you invite

If a captain asks us to email you a call-up, we send that email and, if the captain asked for it and you haven't joined, one last note about 48 hours before the call-up expires. Never more than two. Between the two we keep your address encrypted, and only for that: it goes as soon as the last email is sent, or when the call-up is answered, withdrawn or expires, or when the captain's account is deleted, or if you choose "Don't email me again", whichever comes first, and never more than 14 days. If sending crashes, the encrypted copy is deleted within two days. If the captain asks for a copy, it goes to their own account email and never shows your address.
If a player asks us to email you a duel link, we send that email and, if they asked for it and you haven't accepted or joined, one last note about 48 hours before the link closes. Never more than two. Between the two we keep your address encrypted, and only for that: it goes as soon as the last email is sent, or when you accept the duel or join MCC with that address, the link is withdrawn, voided or closes, the player stands down or deletes their account, or you choose "Don't email me again", whichever comes first, and never more than 14 days. If sending crashes, the encrypted copy is deleted within two days. It carries the same tracking image as a call-up email, and the same "Don't email me again" link, which stops call-up emails too. The player sees whether the email went, never your address, and never whether you chose not to hear from us again.
We keep a scrambled fingerprint of your address for 180 days to limit repeat emails, or for good if you choose "Don't email me again". Our email provider keeps its own delivery record for a limited time. If they tell us the address doesn't exist, or you mark the email as spam, we add that fingerprint to the same list and never write to you again.
A call-up email names up to three squad members by callsign, so you can see who's already in. Never their results, their portrait or anything else, and never anyone who hasn't chosen a callsign. Squad members can turn this off in game settings, for this email and for the message a captain sends, and are then counted, never named.
A call-up email carries our email provider's tracking image, the same as our game emails, so the provider records that it was opened. We don't keep that against you: opens are stored only for game emails to players who have an account. Nobody learns your IP address, your mail app, your device or where you were.
The first name the captain typed is on the call-up and on its page. We delete it 30 days after the call-up expires. The captain sees whether the email went and whether the link was opened, never your address, and never whether you chose not to hear from us again: that reads exactly like a withdrawn call-up.

Anyone with a link

A duel link shows your callsign and that one score to anyone who has the link, and only after you confirm that.
The duel link preview image shows your callsign and that score, with no portrait.
A duel you send to a squad-mate shows your callsign and that score in the link preview, with no portrait.
Anyone with a squad link sees the squad's name and the callsign and portrait of the member who made it. A captain's call-up also shows the first name the captain typed, which we delete 30 days after the call-up expires. While the squad has room, the link also shows how many members it has and how many of its tables are unclaimed, and the latest number to beat on one challenge, with no name beside it. Other members show only as stock portraits: a drawn portrait never appears there.
A squad-mate's duel card can show your callsign, never your handle, portrait or score. You can take your callsign off it in game settings.
The message you can copy with the squad link names the squad-mate who holds that number, with their score. It goes only where you send it.
When someone opens a call-up or a squad link, we count the opens and keep when it was first and last opened, and which share button the link came from, on the invitation itself. The captain who sent it sees whether it has been opened and when. We never record who opened it, their IP address or their device.
None of these pages asks search engines to list it, and a card stops working as soon as the result behind it is withdrawn or corrected.

Game emails

Duels, Squad competition, Military victories & PBs, Weekly squad dispatch and Command Intelligence emails are on when you join. The email box you join with says so, and you can switch any of them off in game settings.
Every game email links to notification settings and has an unsubscribe link. Account emails, like sign-in links and password resets, can't be turned off. A call-up email a captain asks us to send is separate: it's one email, and one last note only if the captain asks for it, each with its own "Don't email me again" link.
Game emails carry a small tracking image, so when your mail app loads images we record that you opened it, when you first and last did, and how many times. We never record your IP address, your mail app, your device or where you were, although our email provider offers all of that. Many mail apps block or preload images, so this is a rough count, not a record of your reading.
Our email provider also records whether each email reached your mail server, or bounced, and we keep that beside the email for the same 180 days.
Links in game emails point at midlifecrisiscommand.com and say which email they came from. Nothing rewrites them through a third party. When you follow one, we record the click and whether you reached the page signed in. After a game email, we also record whether within a day you came back, logged a result, answered or sent a duel, saluted a squad-mate or joined a mission. It shows us which emails are worth sending. We delete these records after 180 days. Your download includes all of this, and deleting your account deletes it.
We also record when you turn an email type on or off, and where you did it, and delete that after 180 days too. Your choices themselves stay until you change them.

Your controls

Download: Settings, then "Download my data", gives you everything you've put in, including your daily steps and the weeks they belong to, and the screens and game actions we recorded, as a file.
Delete: Profile in settings, then "Delete account". Your results, notes, steps and awards are removed. Other players keep their own history, with you shown as "A former recruit". Three things outlive the account on purpose: the admin record of decisions, which no longer names you; a line saying someone saluted or duelled you, without you named; and the scrambled fingerprint of any address that asked us never to email it again, because removing that would let us write to that person again.
Switches in game settings: which game emails you get, whether captains can keep notes about you, whether squad-mates can name you in invitations, and whether your callsign appears on a squad-mate's duel card. Each takes effect at once.
Stand down: stops game emails, apart from the Monday dispatch, and stops you starting or accepting a duel. Nothing is deleted, and your results, including any you log while stood down, still rank on your squads' tables. Leaving a squad takes your results off its tables.

How long we keep things

Your account and everything in it: Until you delete it. Deleting removes your results, steps, notes, awards, feedback, survey answer and the record of screens and actions.
A sign-in link: Works for 60 minutes; the record of it goes 24 hours after it's used or runs out.
The IP address behind a link request: Up to a day, only to limit how many can be asked for.
A signed-in session, with its IP address and browser string: 120 minutes after you stop using it, or at once when you sign out.
Game email records, and your changes to email settings: 180 days.
A call-up's fingerprint of an address: 180 days, or for good if that address asked never to hear from us.
The first name on a call-up: 30 days after the call-up expires.
An address held for a last note: Encrypted, until that note is sent or the call-up ends, and never longer than 14 days.
A captain's taps about someone: Deleted within a day of the call-up closing, on leaving, on a handover, or when you switch captains' notes off. The one-word tone they produced stays on that call-up.
Invitation opens: Kept with the invitation, which isn't deleted. They say how often a link was opened, never by whom.
Backups: Deleted data can stay in backups for up to 31 days, then it's gone.

Who runs the service

Operator: To be confirmed before launch
Contact: [email protected]
Postal address: To be confirmed before launch
Hosting: To be confirmed before launch
Email sent by: To be confirmed before launch

Still to do before launch

Legal review of this page.