Privacy policy

This policy explains how balancesheet.art (“we”, “us”) handles personal data when you use the website and the game at balancesheet.art (the “Service”). Questions: privacy@balancesheet.art.

What we collect

• Without an account: your progress is stored only in your browser’s local storage. It is not sent to us.
• Account data: if you sign in with Google, X or Meta, the provider shares with us a unique account identifier and your display name or username. We store these to recognise you. We do not request your email address, contacts, posts, friends or followers, and we never post on your behalf.
• Learning progress: which chapters you have completed and which puzzles you solved on the first try, so your progress follows you across devices.
• Purchases: payments are processed by Stripe. Stripe collects your payment details and email address under its own privacy policy. We receive and store only a payment reference, the amount, currency, date and refund status. We never see or store card numbers.
• Feedback: if you send us feedback, we store your message, the screen you sent it from, your account identifier if you were signed in, and your email address only if you choose to give one, so we can reply. We delete feedback once we have dealt with it.
• Analytics: we count page views with Cloudflare Web Analytics, which uses no cookies and does not track you across sites.
• Advertising measurement: we use the Reddit pixel to measure whether our ads on Reddit work: it reports page visits and, when you buy the course, the purchase (the amount and an anonymous order reference, never your name or payment details). It sets a first-party cookie (_rdt_uuid). Reddit processes this under its own privacy policy. You can block it with your browser’s tracking protection or an ad blocker without affecting the game.
• Cookies: when you sign in, we set one strictly necessary cookie that keeps you signed in, and a short-lived one during the sign-in process. The Reddit pixel sets the cookie described above. We use no other advertising or analytics cookies.
• Technical data: like any website, our hosting provider processes your IP address and request details (such as browser type and pages requested) to deliver the Service and protect it from abuse. These logs are kept for a short period.

How we use it

To run the Service: to sign you in, save and sync your progress, unlock what you have bought, answer your feedback, prevent fraud and abuse, and meet legal obligations such as tax and accounting rules. We also measure how many people visit and whether our ads lead to purchases. We do not sell your data, show ads on the Service, or build marketing profiles.

Where the GDPR or similar laws apply, our legal bases are performance of our contract with you (account, progress, purchases), our legitimate interest in running a secure service and improving it (technical data, feedback, analytics, advertising measurement), and legal obligation (payment records).

Who processes it for us

• Cloudflare: hosting, database and network security.
• Stripe: payment processing.
• Reddit: measuring our Reddit ads (the pixel described above).
• Google Fonts: serves the fonts the site uses, which means your browser contacts Google’s servers.
• Google, X and Meta: only if you choose to sign in with them, under their own privacy policies.

These providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

How long we keep it

Account data and progress are kept until you delete your account. Feedback is kept until we have dealt with it. Payment records are kept for as long as tax and accounting law requires, even after account deletion. Technical logs are kept briefly.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. To exercise any of these, email privacy@balancesheet.art. To delete your account, follow the steps on the data deletion page. You can also complain to your local data protection authority.

Children

The Service is not directed at children under 13, and children under 13 should not create an account. If you are under the age of digital consent where you live, use the Service with a parent’s or guardian’s permission. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change this policy, we will post the new version here and update the date above. If a change is significant, we will make reasonable efforts to let signed-in players know.