Privacy Policy

• Operator: MDM Koncept
• Country: Sweden (EU)
• Contact: hello@carttycoon.com
• Website: carttycoon.com

If you play without signing in, your game state is stored only in your browser's localStorage — on your device, not on our servers. This includes: Cart Cash balance, haul/inventory, cart, wishlist, orders and CartRunner tracking state, streaks, missions, savings goals, waitlists, onboarding state, Plus Pass state, Lucky Wheel state and Shopping Rush results. None of this game data reaches our backend unless and until you sign in. Even as a guest, though, the general server logs and privacy-focused analytics described in Sections 6 and 9 still apply — those cover all visitors, whether signed in or not.

Guest progress lives only in your browser. If you clear your browser data, switch devices, or use a different browser, guest progress that was never linked to an account will be lost. See the Cookie & Storage Notice for exactly what's stored and how to clear it.

Signing in is optional. If you choose to sign in with an email link or code, we process:

• your email address, to authenticate you and send sign-in links/codes,
• an account identifier issued by our authentication provider (Supabase),
• your cloud-saved game state — the same data described in Section 2, stored server-side so it can follow you across devices,
• your public username ("public name"), if you set one, and when it was last changed,
• account timestamps (created/updated) used for basic account housekeeping.

We do not collect a real name, physical address, or payment details — nothing in CartTycoon charges real money.

CartTycoon uses Supabase for authentication. Based on the current implementation, the sign-in session (access and refresh tokens) is kept in your browser's localStorage, not in a cookie set by CartTycoon. Signing out clears this locally stored session. If you clear your browser's local storage while signed in, you will be signed out on that browser/device — your cloud-saved data itself is not deleted by this, since it lives on our servers and you can get back to it by signing in again.

If you're signed in and have at least one item in your haul, a limited set of stats may appear on the public leaderboard, visible to anyone who visits CartTycoon:

• your public username, or an auto-generated "Player####" label if you haven't set one (or it looks like an email address),
• your total Haul Value,
• your item count,
• your rare-item count.

Your email address, account identifier, and full cloud-save data are never shown on the public leaderboard or anywhere else publicly. Your Cart Cash balance, XP and level are also not part of the public leaderboard data. Badge icons shown next to leaderboard entries are computed from the same public stats above, not stored or exposed as a separate field. Only the top 10 players by Haul Value are shown.

Like almost every website, serving CartTycoon may process your IP address, browser type, device type and request logs for security and operational purposes (for example rate limiting, abuse prevention and error diagnosis). Our hosting and infrastructure providers may process this data as data processors where applicable.

If you send feedback or questions to hello@carttycoon.com, we process your email address and message content to reply and improve the game. Please do not send sensitive personal information by email.

We use a small number of service providers to run CartTycoon:

• Supabase — authentication, database and cloud save. Processes your email, account identifier, cloud-save game state, and public username when you sign in.
• Vercel — hosting and delivery, and (see Section 9) usage/performance monitoring.
• One.com — domain registration/DNS, and email hosting for our own operator email addresses.
• Google Search Console — a site-owner tool we use to monitor how CartTycoon appears in Google Search results (via our sitemap and robots.txt). This is not a script embedded in the pages you browse, and CartTycoon does not use Google Analytics, Google Tag Manager, or any similar browser-side tracking script.

These providers may process data as part of providing their service to us. We only list a provider here if it is actually involved in running CartTycoon or processing data described in this policy.

CartTycoon uses Vercel Analytics and Vercel Speed Insights to understand overall usage (like which pages are visited) and page performance. Based on Vercel's own documentation for these products, they are designed to avoid using cookies and to report aggregated, privacy-focused data rather than tracking individual visitors across sites. We have not independently audited this beyond reviewing our own implementation and Vercel's public documentation, and whether this data collection needs prior consent for EU/Swedish visitors under current guidance is a question we are still confirming.

Depending on the specific processing, we rely on:

• performance of the service you asked for — for example authenticating you and keeping your cloud save when you sign in,
• our legitimate interest in operating, securing and improving CartTycoon, preventing abuse, and communicating with people who contact us,
• consent, where required by law for optional, non-essential technologies (see Section 9 on the open analytics/consent question).

Guest game state remains in your browser until you clear it, overwrite it, or it's otherwise reset or lost. If you have an account, we keep your account and cloud-save data while your account remains active, or as otherwise needed to provide the service. If you request deletion (Section 12), we'll delete the corresponding data, though deletion from provider backups may not be instantaneous if backups exist. Hosting logs are retained for the short periods our providers use for security and operations. Email correspondence is kept as long as needed to handle the conversation and any follow-up. Analytics retention depends on Vercel's own configuration and settings, which we have not independently verified in detail.

Where GDPR or a similar law applies to you, you may have the right to:

• access the personal data we hold about you,
• correct inaccurate data,
• request erasure,
• request restriction of processing,
• object to processing based on legitimate interest,
• data portability, where applicable,
• withdraw consent at any time, where processing is based on consent, without affecting processing before that withdrawal,
• lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact hello@carttycoon.com. We'll do our best to respond promptly, but we can't promise an automatic or instant turnaround for every request — some may need manual verification first. You can also delete all locally stored guest data yourself at any time (see the Cookie & Storage Notice); there is currently no in-app button to delete a signed-in account, so please email us to request that.

CartTycoon is operated from Sweden (EU). Our service providers may process data in locations covered by their own service configuration and contractual safeguards, which can include locations outside Sweden or the EU/EEA. We have not exhaustively verified the exact processing locations or transfer mechanisms for every provider — this is flagged for qualified legal review rather than stated as settled.

CartTycoon is not specifically directed at young children. If you are a minor in your jurisdiction, please use CartTycoon with the involvement or permission of a parent or guardian. As with the Terms of Use, this wording has not been reviewed against every jurisdiction's specific rules and should be treated as guidance pending legal review.

We do not sell personal data to advertisers or data brokers.

If we add or change features that affect data handling — for example new account features, new analytics, or (if this ever changes from the current no-real-money model) payments — this policy will be updated and the "last updated" date above will change.

MDM Koncept · Sweden (EU) · hello@carttycoon.com · carttycoon.com