Privacy Policy

Presidential ("Presidential.app", "the game", "we", "us") is a multiplayer strategy game. You govern a fictional version of a real country for one week, and the next player inherits it. This policy explains what we collect, why we collect it, and the choices you have. It covers the Presidential web game at presidential.app (in any desktop or phone browser), the Presidential apps for iPhone and Android, and the presidential.app website.

The short version:

• You can play as a guest. We don't ask for your name, phone number, contacts, photos or location.
• Signing in is optional. If you sign in with Google, Apple or an email link, we receive your email address and an account identifier, and we keep nothing else about you: no name, no photo.
• We don't show ads, we don't sell data, and we don't track you across other apps or websites. There are no advertising SDKs or advertising cookies.
• On the website and in the web game, we use PostHog analytics to see how the game is used and where it breaks. Analytics linked to you, and session replays, only start if you choose Accept. Before you choose, or if you decline, we only count visits anonymously, without cookies. The iPhone and Android apps don't include it.
• AI replies are your choice. Unless you allow them, nothing you write, and not your handle, is sent to an AI provider.
• You can block other players, and you can delete your account from inside the game at any time.

#1. What we collect

Swipe the table sideways to see every column →

We do not collect precise location, contacts, photos, health data, financial information, advertising identifiers or your browsing history on other websites. The apps don't collect coarse location either; on the web, analytics include an approximate location (country and city), as described above.

In your browser. The web game keeps a few things in your browser's local storage so you stay signed in: your guest device identifier, your session token, and preferences such as light or dark mode. If you sign in, Firebase Authentication also keeps its own sign-in state in your browser's storage. PostHog sets analytics cookies only if you choose Accept. Section 10 and the Cookies page list everything we store. Clearing the site's data in your browser signs you out on that browser; it does not delete your account (see section 6).

#2. How we use it

We use this data only to:

• operate the game
• keep the world fair and safe (rate limits, the text filter, blocking, moderation, preventing abuse)
• fix problems and improve balance
• understand how the website and the web game are used, and make them faster and easier to use (analytics, see section 9)
• alert the team quickly when something breaks or a player files a report (see "Operational alerts" below)

We do not use it for advertising or to make automated decisions about you, and we do not sell or rent it.

Keeping the game safe:

• Text filter. An automatic filter on our servers checks messages, handles, treaty names, handoff notes and report details before they are saved. It refuses text with slurs or hate speech, replaces other profanity with "•••", and replaces contact details (email addresses, phone numbers, links, "add me on…" handles) with "[contact removed]". We store only the filtered text, so what you see after sending is what everyone else sees. The filter runs on our own servers; no third party is involved.
• Blocking. When you block a player, we keep a record of the block so that their messages, and any notifications their messages would trigger, never reach you. They aren't told. The block is tied to the person, so it follows them to another seat.
• Moderation. When content is reported, a person on the Presidential team reviews it. They see the report, the reported content, and account details of the players involved: when the account was created, its devices, how it signs in, its terms, and the reports filed by and about it. A moderator can remove a message (its text is replaced with "[removed by a moderator]" for everyone) and can suspend an account. A suspended account can't use Presidential, except to delete itself.

Operational alerts. When something goes wrong on our servers or in the web game, or a player files a report, an alert is posted to the Presidential team's private Slack workspace so a person can act quickly. An alert can include players' handles and countries, the error and the page it happened on, and, for a report, its reason, the reporter's note and a short excerpt of the reported content. Alerts never include email addresses, IP addresses, device identifiers or sign-in tokens.

#3. AI-generated replies

Ministers, AI presidents, briefings and press headlines in Presidential are written by AI language models. AI presidents are labelled as AI in the game. Whether anything you write goes to an AI provider is up to you.

Your choice. Before your first message to an AI president or your first question to a minister, the game asks you once whether to allow AI replies. You can change your answer at any time in Settings → Privacy → AI replies.

Earlier beta versions. iPhone beta builds 1.0.0 (4) and earlier can't ask this question. Until you open a version that can (including the web game), AI replies stay on as they were before the question existed, and the updated game asks you. To turn them off before then, email support@presidential.app.

If you allow AI replies, to write a reply or a briefing we send the model the relevant game context (country names and figures, open decisions, treaties) and can include:

• your handle
• your messages to AI presidents and your questions to ministers
• the recent lines of a conversation an AI president is replying to, including yours
• your handoff note, which is quoted to the AI that writes your successor's briefing

If you don't, nothing you write, and not your handle, is sent to the AI provider:

• your questions to ministers and your messages to AI presidents get pre-written replies instead
• your lines are left out of what an AI president sees of a conversation
• your successor still reads your handoff note in the game, but it isn't quoted to the AI that writes their briefing
• wherever a request would name you, it says "the president" or "your predecessor" instead

Either way, game state (figures, country names, events) is used to write briefings and headlines.

We send these requests through OpenRouter, a routing service, to the model provider. Today that is a DeepSeek model, which may be hosted by DeepSeek or by OpenRouter's infrastructure partners.

These providers process the request to return a reply. We don't send your device identifier, your email address, your IP address or any data outside the game. Don't put personal information in in-game messages. If an AI provider is unavailable, the game falls back to pre-written text. AI-written text goes through the same filter as players' messages (section 2) before anyone sees it.

#4. Who we share it with

• Other players see your handle, your country, your public actions (treaties, votes, scores) and the messages you send them. The next president of your country reads your handoff note. A player who has blocked you doesn't see your messages.
• The public: your handle, the country you govern and your public actions (for example, treaties signed, crises handled, scores) may appear on the public world feed at presidential.app/live. Messages are never shown there. Your email address is never shown to anyone.
• Your public president page: your president has a public page at presidential.app/president/@yourhandle, with share images made from it, that anyone can view, including people who don't play. It shows only what other players already see in the game: your handle, when you joined, the country you're running and its public numbers (National Index, approval, stability, growth, inflation, debt, credit rating, world rank, term day), your finished terms (country, dates, handoff and audit grades, legacy against the caretaker, what was flagged for your successor) and your badges. It never shows your email address, how you sign in, your device, your AI choice, blocks, reports, messages or handoff notes. The page is on by default and, while it's on, search engines may list it. Turn it off at any time in Settings → Profile → Public profile: the page, its term pages and its images then show "not found" to everyone within about two minutes. Previews that other apps (for example X or WhatsApp) saved when a link was shared are kept by those apps. Deleting your account removes the page. Flag images on these pages are served from presidential.app, so viewing a profile sends no request to third parties.
• Service providers process data on our behalf, only as needed to run the game:
  • Railway: application hosting, the database and the web game at presidential.app
  • Vercel: website hosting
  • Google (Firebase Authentication, provided by Google LLC as our processor): sign-in with Google, Apple or an email link, only if you choose to sign in. It handles your email address and account identifier, and sends the sign-in email when you use an email link.
  • OpenRouter and model providers: AI replies, only as described in section 3
  • PostHog (PostHog, Inc., United States; our project is hosted in PostHog's US region): analytics, heatmaps, session replays, and error and performance monitoring for the website and the web game, as described in section 9. It isn't used in the iPhone or Android apps.
  • Slack (Slack Technologies, LLC): the team's internal alerts about errors and reports (section 2)
  • Apple: Sign in with Apple (if you use it), TestFlight and App Store distribution, crash reports you choose to share
  • Google: Google Play distribution and testing
• The law: we may disclose data if required by law or to protect players and the service.

#5. How long we keep it

• Your account and gameplay data: kept until you delete your account.
• Sign-in details: your sign-in provider, account identifier, email address and its verified status are kept until you delete your account.
• In your browser: your guest device identifier and session token stay in your browser's local storage until you sign out, clear the site's data, or delete your account. If you accepted analytics, PostHog's cookies expire after a year without a visit (section 10).
• Your AI choice and your blocks: kept until you change them or delete your account.
• Worlds: shared and persistent. When you delete your account, your handle is removed from past records and replaced with "Former president". Anonymous game history (for example, a country's economic figures) stays, because the next president inherits it.
• Messages and reports: kept for up to 12 months for moderation, then deleted. When a moderator removes a message, its text is replaced at once; the copy in the report about it is kept with that report.
• Suspensions: the date and the reason stay on the account until the suspension is lifted or the account is deleted.
• Technical logs: kept for up to 30 days.
• Analytics (web): analytics events, and the analytics profile linked to your account (your account ID, handle and the account details in section 9), are kept for up to 12 months. Session replays are kept for up to 30 days. Anonymous, cookieless counts are never linked to you.
• Operational alerts: kept in Slack for up to 12 months.

#6. Your choices and rights

• AI replies: turn them on or off at any time in Settings → Privacy → AI replies. The change applies to everything sent from then on.
• Analytics and session replays (web): the first time you open presidential.app, a banner asks whether to allow analytics and session replays. Until you choose Accept, we only count visits anonymously, without cookies (section 9). Change your mind at any time with Privacy choices at the bottom of every page of the website, or in the game in Settings → Privacy → Analytics & replays. If you decline, PostHog removes its cookies and stops recording. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a decline and don't ask.
• Public president page: turn it on or off at any time in Settings → Profile → Public profile (section 4).
• Blocking: open a conversation or a player's country, open the "…" menu and choose Block. Settings → Blocked presidents lists the players you've blocked and lets you unblock them.
• Delete your account: in the game (on the web or in the app), open Settings → Delete account. This removes your device identifier, your sign-in details (sign-in provider, account identifier, email address and whether it was verified), your handle, messages and personal records from our systems within 30 days, except where we must keep data for legal reasons. You can delete your account even while it is suspended. The web game also stops linking analytics to you in that browser; analytics already linked to your account ID in PostHog is deleted on the schedule in section 5, or sooner if you email us. If you can't use the game, request deletion at presidential.app/delete-account, which also lists what is deleted and what stays.
• Access, correction or deletion requests: you can also email support@presidential.app. Depending on where you live (for example the EU/UK under the GDPR, or California under the CCPA), you may have additional rights to access, correct, delete or port your data, and to object to processing. We honour these requests wherever you live. We don't sell your personal information or share it for cross-context behavioural advertising, and we honour Global Privacy Control.
• Legal bases (EEA/UK):
  • contract: to provide the game you asked for
  • legitimate interests: security, the text filter, blocking and moderation, improving the game, error monitoring and operational alerts, and anonymous, cookieless counting of visits on the web
  • consent: where we ask for it, such as AI replies, and analytics and session replays on the web (with the cookies and browser storage they use). You can withdraw it at any time in Settings, or with Privacy choices on the website.

#7. Children

Presidential is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 is using Presidential, contact us and we will delete the account.

#8. Security

Data travels over HTTPS. Sign-in tokens are stored in your device's secure storage in the app, and in your browser's local storage in the web game (anyone who uses your browser profile can use them, so clear the site's data on a shared computer). Session replays mask what you type and what players write, hide email addresses entirely, and pause on sign-in pages; sign-in codes, email addresses and search terms are removed from page addresses before analytics are sent. Access to our systems, including the moderation tools, is restricted. No system is perfectly secure, but we work to protect your data and will notify affected players of a breach where the law requires it.

#9. Analytics

On the website and in the web game (not in the iPhone or Android apps), we use PostHog, a product analytics service, to understand how Presidential is used. What it does depends on your answer to the banner.

Before you choose, and if you decline: anonymous, cookieless counting. PostHog counts page views, clicks, game actions (for example, that a decision was signed), errors and load times without setting cookies or storing anything in your browser. To tell one visit from another, PostHog's servers compute a one-way hash of your IP address, your browser's user agent, our site and a random value that changes every day and is then deleted. These events carry no analytics ID, no account ID and not the world, country or term you're playing, and we don't link them to you, to your account, or from one day to the next. No session replay is recorded.

If you choose Accept: analytics and session replays.

• PostHog keeps a random analytics ID in cookies and in your browser's local storage (section 10), so it can tell that visits are yours. While you play, it links them to your account ID and handle, with a few account details: how you sign in, when the account was created, your AI replies choice, and the world, country and term you're playing. Never your email address.
• It records the pages and screens you open, the site or link that brought you here, clicks and taps (including repeated clicks and clicks that do nothing), game actions such as opening a decision, sending a message or signing a treaty, errors in the page, and how fast pages load and respond (web vitals and request timings). It also records your browser, operating system, device type, screen size, language and theme, and an approximate location (country and city) that PostHog estimates from your IP address.
• We build heatmaps from this: where people click and how far they scroll on each page.
• It records session replays: a reconstruction of the page as you used it, including mouse movements, clicks, taps, scrolling and the page's console messages.

What we never send. The words you type: for a message we record that one was sent and how long it was, not what it said. Clicks on text written by players or by the game's AI are counted without that text. In replays, every text field is masked; text written by players or by the game's AI in the game is masked wherever it appears (messages and the notifications that quote them, handoff notes, treaty names, minister replies, briefings and term recaps); email addresses are hidden entirely; and recording pauses on sign-in pages. Sign-in codes, email addresses, search terms and advertising click IDs are removed from page addresses before anything is sent.

PostHog processes this data on our behalf, as our processor. It doesn't sell it or use it for advertising. How long we keep it is in section 5, and how to change your answer is in section 6.

#10. Cookies and similar technologies

We set no advertising cookies, and nothing that follows you to other websites. On presidential.app, your browser keeps:

• What the game needs (always on): your guest device identifier, your session token and your account details (ID, handle and, if you signed in, email address) in local storage, so you stay signed in; small preferences, such as light or dark mode, the world map's mode, which summaries you've seen and an unsent handoff note; and a cache of the public world feed. Minister conversations stay in session storage until you close the tab. If you sign in, Firebase Authentication keeps its sign-in state in your browser's storage.
• Your analytics answer: once you choose, a note of Accept or Decline in local storage, so we don't ask again.
• Analytics (only if you choose Accept): PostHog's first-party cookies and local storage entries (named ph_…_posthog), which hold the random analytics ID, the current session and the account it is linked to, plus a few ph_… entries in session storage for the open tab, and a note that you've already opened the game's desk in this browser. The cookies expire after a year without a visit. If you decline later, they are removed.

Google and Apple sign-in pages, which open on their own websites, use their own cookies under their own policies. The iPhone and Android apps don't use cookies: they keep your device identifier and session token in your device's secure storage. The Cookies page lists each item, and your browser's settings let you clear or block them (clearing the site's data signs you out; see section 6).

#11. International transfers

We and our providers process data in the United States and other countries. PostHog keeps our analytics in its US region, and Google (Firebase), OpenRouter and Slack are based in the United States. When data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses (with the UK addendum where it applies) in our providers' data processing terms, or on the EU-US Data Privacy Framework where a provider is certified under it.

#12. Changes

If we change this policy in a meaningful way, we'll update the date above and tell you in the game.

#13. Contact

Questions or requests: support@presidential.app · presidential.app/support