Tycoon Tycoon

Privacy Policy

Effective: June 20, 2026

Tycoon Tycoon (the "Service") is operated by Exponential Enlightenment LLC, an Illinois limited liability company ("we," "us," "our"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you and — if you are a parent — your child have over it.

Tycoon Tycoon is directed to children under 13. We comply with the U.S. Children's Online Privacy Protection Act ("COPPA"), the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable privacy laws. Our separate Children's Privacy Notice provides the COPPA direct notice to parents.

1. The short version

  • We collect the minimum needed to run the games and your account.
  • We do not sell or "share" personal information for cross-context behavioral advertising. We do not show third-party behavioral ads.
  • We do not knowingly collect more from a child than is reasonably necessary to play.
  • You (or a parent, for a child under 13) can review, delete, or stop further collection at any time by contacting us at tycoon@exponentialenlightenment.com.

2. Information we collect

a. Information you give us

  • Account credentials: a username and password you choose, plus a birth year used only to decide whether AI-asset features need a parent's approval. We do not collect an email address from the account holder. The username is public on leaderboards and shared concepts. Internally we generate a synthetic identifier from your username so our authentication system can store your account; this identifier is not a real mailbox and we do not send mail to it.
  • Game saves: your in-game progress (currencies, upgrades, settings) tied to your account.
  • Feedback and submissions: messages you send via the feedback dialog and concepts you submit. Do not include personal information about yourself or others in free-text fields.
  • Parental approval records: if a parent or guardian grants approval for AI-asset features on a child's account, we retain the parent's email address, a timestamp, and the form of approval. The parent's email is used only as a contact record for that approval.

b. Information collected automatically

  • Authentication cookies and localStorage required to keep you signed in.
  • Error reports: when something crashes, we log the error message, stack trace, route path, browser/OS string, and your account ID if signed in. We do not log form contents, keystrokes, or page contents.
  • Server request logs (IP address, timestamp, requested URL, user-agent), retained for up to 30 days for security and abuse prevention, then deleted or aggregated.

c. Information we do not collect

  • We do not collect precise geolocation.
  • We do not collect contacts, photos, microphone, or camera data.
  • We do not place third-party advertising or analytics trackers that build cross-site profiles.
  • We do not knowingly collect more than the minimum from children, and we never condition a child's participation in a game on disclosing more than is reasonably necessary.

3. How we use information

  • To create and secure your account and sign you in.
  • To save and sync your game progress across devices.
  • To respond to feedback, support requests, and parental requests.
  • To detect, prevent, and fix bugs, abuse, and security incidents.
  • To comply with legal obligations and enforce our Terms of Service.
  • If you opt in to premium features that generate real-world assets (brand names, logos, business plans), to produce those outputs and bill the responsible adult account holder.

4. Legal bases (EU/UK users)

  • Contract: running your account and the games you ask to play.
  • Legitimate interests: security, fraud prevention, debugging — balanced against your rights.
  • Consent: for any processing that requires it, including parental consent for users under 16 (or the lower age set by your member state, down to 13).
  • Legal obligation: tax, accounting, and responding to lawful requests.

5. How we share information

We share personal information only with the following categories of processors, under written contracts that require confidentiality and security:

  • Hosting and database: Supabase (PostgreSQL, auth, storage) and Cloudflare (edge compute, CDN), used to run the Service.
  • AI providers (premium features only): when an account holder requests AI-generated assets, prompts and game state are sent to the AI model provider that powers that feature. We do not send children's free-text inputs to AI providers unless the responsible adult account holder has enabled and consented to it.
  • Payment processors (when paid features are enabled): card details are entered directly into our payment processor and never touch our servers. We receive only a transaction reference, last-4 digits, and billing country.
  • Law enforcement: when legally required, and only what is required.
  • Successors: in a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA. We have not done so in the prior 12 months.

6. Data retention

  • Account and game saves: kept until you (or a parent) delete the account, or after 24 months of inactivity, whichever comes first.
  • Feedback messages: up to 24 months, then deleted or anonymized.
  • Error logs: 90 days.
  • Server request logs: up to 30 days.
  • Parental consent records: kept as long as the child's account exists, then for a reasonable period afterward to demonstrate compliance.
  • Payment records: retained as required by tax law (typically 7 years).

7. Security

We use industry-standard safeguards: TLS in transit, encryption at rest, row-level access controls, scoped service credentials, and audit logging. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

8. Your rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate information.
  • Delete your account and associated data.
  • Restrict or object to certain processing.
  • Receive a portable copy of your data.
  • Withdraw consent at any time, without affecting prior lawful processing.
  • Appeal a denial of a privacy request (where required by your state, e.g., Colorado, Virginia, Connecticut).
  • Lodge a complaint with your data protection authority (EU/UK) or the FTC or your state attorney general (US).

To exercise any right, email tycoon@exponentialenlightenment.com and include the account's username (we'll verify by asking you to sign in and confirm a code shown on your account page; we cannot verify by email because we don't have one on file). You may also delete the account directly from the account page. We respond within 30 days (45 for CCPA, extendable once).

9. Children under 13

See the Children's Privacy Notice for the full COPPA direct notice. In short: a parent must give verifiable consent before we collect personal information from a child beyond what is needed for the internal operation of the games, and the parent may at any time review what we have, ask us to delete it, and refuse further collection.

10. International transfers

We are based in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US and other countries where our processors operate. For EU/UK transfers we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

11. Do Not Track

We do not respond differently to Do Not Track browser signals because there is no industry consensus on how to interpret them. We do honor the Global Privacy Control (GPC) signal as an opt-out of "sale" or "share" under the CCPA, even though we do not currently sell or share personal information.

12. Changes to this Policy

We will post any changes on this page and update the "Effective" date. For material changes affecting children's accounts, we will post an in-app notice on next sign-in and, where a parent's email is on file from a previous approval, send an email there. Where required by law, we will obtain renewed parental approval before applying the change to existing children's accounts.

13. Contact

Exponential Enlightenment LLC
Illinois, United States
Email: tycoon@exponentialenlightenment.com