Costilla County · Recorder

Privacy Policy

Effective date: October 6, 2026.

1. Who We Are

Land Flipper Tycoon (the "Game") is operated by Acreford ("we", "us") — a brand operated by Victor, an individual based in Jerusalem. Paddle.com is the Merchant of Record for all in-game purchases — see §5 for what this means for your data. This Privacy Policy covers only the Game and its supporting Firebase backend.

2. Data We Collect

Account data

When you register, we collect your email address and an optional display name. Authentication is handled by Firebase Authentication. We do not collect your real-world identity, address, or phone number for the Game. If you upload a profile photo, we store it in Firebase Storage tied to your account; it is re-encoded to a 256×256 JPEG on upload and is visible only in your own game UI. Uploading a photo is optional.

Login audit log

Each time you sign in or create an account, our backend writes a security record of the event — your account ID (uid), sign-in provider, session timestamps, browser user-agent, and language — into a per-day audit log stored under your account (authLog/<day>). Only our server can write this log; the game client cannot. We use it to detect unauthorized access, credential stuffing, and abuse. It never includes your email or payment data, is never used for profiling or marketing, and is deleted automatically after 90 days (see §9).

Date of birth (optional)

If you choose to provide it, we store your date of birth on your account to determine whether real-money purchases require parental consent (we apply a stricter checkout flow for players under 18). The DOB itself is never shared with Paddle or any third party; only a derived "under 18" flag is sent at checkout to trigger the parental-consent screen. The DOB is also used server-side for age verification for leaderboard eligibility (see §8 — only age-verified accounts appear on leaderboards).

Gameplay behavior

We store in-game state tied to your account: your current cash and AC (Action Credits) balance, owned parcels, active negotiations, in-game event log, and the messages you send to AI personas. This data is required to operate the Game and to detect fraud or abuse. Aggregate fields derived from this data — including netWorth, scoreAllTimeFlips, scoreAllTimeAcres, level, and gamertag — may also be displayed publicly as described in §17 (Public Leaderboards and Match Pages) when you opt in.

AI transcripts

The messages you send to AI personas and the AI's replies are stored as part of the negotiation history so you can resume a conversation. They may be inspected by Acreford staff only in aggregated and de-identified form to improve dialogue quality and detect prompt-injection attempts. "De-identified" means we strip or hash identifiers so the data cannot reasonably be linked back to you or your account.

Technical data

We log your IP address, browser type, and timestamps from standard Firebase server logs. This is used for security, rate-limiting, and abuse prevention.

Requests from your browser to our backend are also verified by Firebase App Check, powered by Google reCAPTCHA Enterprise. To confirm requests come from the real Game and not a bot, Google's service evaluates device and behavioral signals from your browser (see §12 for what may be stored on your device). We rely on this to prevent automated abuse of the Game and its API.

We also record the locale (language/region setting) your browser reports, server-side and tied to your account, as an anti-abuse and telemetry-integrity signal (90-day retention, §9).

Payment data

We do not receive or store your payment card details. All payment information is collected and processed directly by Paddle. We receive only a transaction ID, the amount, and a timestamp.

3. How We Use Your Data

We do not use automated profiling or AI to make solely-automated decisions about you with legal or similarly significant effects (GDPR Art. 22).

4. Firebase Authentication & Firestore

The Game is built on Firebase, a Google Cloud service. Your account credentials are managed by Firebase Authentication, and your gameplay state is stored in Cloud Firestore. Your data is stored on Google Cloud infrastructure subject to Google's data processing terms (Google's standard contractual modules and Data Privacy Framework certification, available at cloud.google.com/terms/data-processingterms). We configure Firestore security rules so that each player can read and write only their own data.

5. Paddle — Merchant of Record

Paddle.com is the seller of record for all in-game purchases

When you buy AC or subscribe to Pro Flipper, Paddle receives:

Paddle's use of this data is governed by Paddle's Privacy Policy. Paddle is an independent data controller for payment data; Acreford is the controller for gameplay data.

6. Other Third-Party Sharing

We never share AI transcripts or individual gameplay behavior with advertising networks. We do not sell your personal information as those terms are defined in the California Consumer Privacy Act (Cal. Civ. Code §1798.140(ad), (ah)), and we do not need a "Do Not Sell or Share My Personal Information" link on that basis. Public-display exception: aggregate gameplay fields (gamertag, net worth, flips, acres, level) may be displayed on public, unauthenticated pages when you opt in via the in-game leaderboard opt-in setting — see §17 for the full disclosure. This is publication by Acreford as controller, not third-party sharing. Visible to other players: when you opt in to in-game leaderboards, other players (and readers of the public board pages) can see your gamertag, board rank, and score — see §17 and §17a for the full visibility scope.

7. AI Inference (Google Gemini)

When you send a message to a persona in the Game, the message (along with a brief in-context transcript) is sent to Google's Gemini API to generate the persona's reply. Google processes this data under Google's Generative AI API Additional Terms and the Data Privacy Framework (Google LLC is DPF-certified by the U.S. Department of Commerce for EU/UK/EEA personal data). We strip obvious prompt-injection patterns before the call and sanitize the data sent. We do not include your real-world identity, email, or payment data in the AI request.

7a. What We Send to Google — and What We Keep

What is sent

The text of your negotiation messages, a short window of recent conversation (up to 12 messages), the persona profile being voiced, and a brief parcel summary. Nothing else about your account (email, display name, date of birth, payment data, wallet balances) is included in the AI request.

Prompt-injection defenses

Before your message reaches Gemini, we strip common prompt-injection phrasing ("ignore previous instructions," fake <system> tags, etc.) and wrap your text in explicit boundary tokens so the model treats it as content to transcribe, never commands to obey. The model's reply is also sanitized on return — if it breaks character or echoes AI-tell phrasing ("as an AI…"), we strip that before you see it.

Feedback logs (failure-driven improvement)

When a Gemini call produces a bad output (empty reply, safety block, or off-character response), we record a feedback entry to improve the persona prompts over time. This entry never contains your raw message text. It stores only structural signals: the message count, whether an injection pattern was detected, whether your message contained a dollar-sign offer, the persona type, and the failure mode. A daily summary is written for Acreford staff review. Improvement is manual — a human reads the summary and edits the persona prompts. We do not auto-rewrite prompts from your data.

7b. Opting Out of AI Persona Replies

You can opt out of Gemini-powered persona replies at any time. When you opt out:

To opt out: open any active negotiation; on your first message, you will see a one-time consent prompt. Decline it (or toggle it off later in Settings). You can re-enable Gemini replies at any time from the same prompt or Settings. Your consent choice is stored on your account at consent.geminiNegotiation with a timestamp.

Existing players who sent messages before this disclosure

If you played before July 10, 2026, your earlier messages were sent to Gemini under the prior version of this policy. Going forward, you will see the consent prompt on your next negotiation and can opt out there. To request deletion of prior AI-related data, email service@acreford.com (we will action verified requests within 30 days per §10).

7c. Persona Critic — Weekly Quality Scoring (Effective 2026-07-20)

What this is

We continuously improve the realism of the AI personas that negotiate with you. To do this, a weekly automated job (the "Persona Critic") samples a small subset of completed negotiation transcripts, scores them on a quality rubric, and proposes edits to the persona prompt text. A human operator reviews the proposals before any change goes live.

Sampling

Once per week, up to 48 recent negotiation transcripts (12 per persona type, 4 seller persona types) are selected from gameplay. Only completed negotiations with at least 3 messages are eligible.

Sanitization before scoring

Before any sampled transcript is scored, it passes through a three-layer sanitizer that strips: (a) prompt-injection patterns (e.g., <<SYS>> tokens, fake authority tags), (b) harmful content including slurs, threats, self-harm references, and tier-2 profanity (replaced with [REDACTED-HARMFUL]), and (c) personally identifiable information — email addresses, phone numbers, U.S. street addresses, and your display name are replaced with [CONTACT], [ADDRESS], or [PLAYER]. The sanitizer is idempotent (running it twice produces the same output as running it once).

Who scores

Sanitized transcripts are scored by Google's Gemini API (the same provider used for live persona replies — see §7). The scoring call does not include your real identity, email, or payment data.

Monthly calibration by Anthropic

Once per month, a sample of 10 sanitized transcripts is re-scored by Anthropic's Claude API as an independent quality check on the Gemini scoring. Anthropic receives only the sanitized transcript text — never your identity, email, payment data, or the original (pre-sanitization) text. Anthropic processes this data in the United States under its Commercial Terms and the EU-U.S. Data Privacy Framework.

Leak filter

Any automated persona-prompt edit proposal that quotes or paraphrases 8 or more consecutive characters from a sanitized transcript is automatically rejected and logged for review. This prevents the personas from inadvertently repeating your words back to other players.

Retention

Sanitized scoring records (scores, sanitized excerpts, edit proposals) are retained for 180 days, then automatically deleted. Forensic audit records of rejected leak-filter violations are retained for 30 days. We do not retain the original (pre-sanitization) transcripts beyond what §7 already describes for live gameplay.

Opt-out

The §7b opt-out (declining Gemini-powered persona replies) does NOT automatically exclude your past negotiations from the weekly scoring sample — your messages were already sent to Gemini at runtime when you played. To request that your negotiation transcripts be excluded from future weekly samples, email service@acreford.com from the address on your account. We will tag your account within 7 days so that future sampling jobs skip your transcripts. Sanitized records already scored will be deleted on the regular 180-day schedule.

8. Children's Privacy (COPPA)

The Game is not directed to children under 13. We enforce a 13+ age gate at registration through an explicit checkbox and a programmatic check. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, contact service@acreford.com and we will delete it within 30 days.

Leaderboards and minors

In-game leaderboards are gated behind a server-side age check: a player appears on any board only if their account has a verified date of birth (ageVerified). Accounts that have not passed the age check — including accounts of players who decline to provide a date of birth — never appear on leaderboards, regardless of the global feature flag. A minor's gameplay data is otherwise processed exactly like any other player's; public leaderboard display requires the same explicit opt-in as for every player (§17, §17a).

9. Data Retention

We retain each category of data only as long as it is needed:

Per-player cohort statistics described in §16 are stored under your account and are deleted with it under the same 30-day commitment; only de-identified aggregate cohort numbers may live on in long-term game-balance analyses.

10. Your Rights

You have the right to access, correct, or delete your personal data. You can delete your account and associated gameplay data by emailing service@acreford.com. We will process verified requests within 30 days. If you are in the EU/UK/California, you have additional rights under GDPR / UK GDPR / CCPA, including:

To exercise any right, email service@acreford.com from the address on your account. For payment-data rights (including erasure of payment records), contact Paddle directly — we do not control payment data once it reaches Paddle.

Deletion limitation for publicly-rendered data

If you opted in to public leaderboards or match pages (§17), your displayed aggregate data may have been viewed, screenshotted, or archived by third parties while it was public. When you request deletion we will remove the data from our live Firestore docs and stop rendering it on any Acreford-controlled page within 30 days — but we cannot recall or delete third-party copies. This is the standard limitation that applies to any data published on the public web.

11. Security

We use Firestore security rules, Firebase Authentication, and HTTPS in transit. No method of transmission or storage is 100% secure. We do not store payment card details on our infrastructure — Paddle does.

12. Cookies & Local Storage

The Game is a single-page web application. We do not use advertising cookies, and we do not use third-party trackers for advertising. What runs and stores on your device:

Most browsers let you refuse or delete cookies/local storage; if you disable session storage, you will need to sign in again on every page load. If you block Google's reCAPTCHA, App Check verification becomes unavailable — the game is built to keep working without it, but features that require verified requests may be limited as verification is rolled out on our backend.

13. International Transfers

Your data is processed on Google Cloud, Google Gemini, and Paddle infrastructure in the United States. Transfer mechanisms: Google LLC's certification under the EU-U.S. Data Privacy Framework and the UK Extension to the DPF (verify current status at dataprivacyframework.gov), Paddle's Standard Contractual Clauses (available on request), and, where applicable, Paddle's certification under the EU-U.S. Data Privacy Framework (verify current status at dataprivacyframework.gov), and Anthropic PBC's certification under the EU-U.S. Data Privacy Framework (for the monthly calibration described in §7c).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the effective date above. Material changes will be communicated via email or in-game notice at least 30 days before they take effect.

15. Contact

Privacy questions? Email support@acreford.com for general questions, or service@acreford.com for rights requests (access, deletion, export, AI-data deletion).

16. In-Game Analytics and Experimentation

Effective date: July 21, 2026

We collect analytics events tied to your account (for example: when a session starts, when your character levels up, when a purchase or sale closes in-game, when a negotiation starts, when a negotiation round happens, when a negotiation ends without a close, when a virtual assistant is purchased, and when an experiment variant is assigned to your account). Additional events we collect include: when you open the cash-or-terms chooser modal, when you pick cash or terms, when you complete a Bossman 7-Session onboarding session, and (server-side, tied to your account) when an owner-financed note is created or when a seasoned note is sold to an investor. We also assign a deterministic "experiment seed" derived from your account ID to decide which cosmetic and game-mechanics variants (such as seller portraits, persona negotiation parameters like patience or concession rate within narrow bands, and archetype-level tuning) you see, and to keep that variant stable across sessions.

We use this information to balance the game, improve UX, and run A/B tests on cosmetic and game-mechanics features. This data is stored in Firebase under your account ID and is visible only to you and to Acreford admins for support. We do not sell it.

Lawful basis (GDPR Art. 6)

Our lawful basis for in-game analytics and experimentation is legitimate interests under Art. 6(1)(f) — our interest in operating, improving, and balancing the Game. A documented legitimate-interest assessment is available on request — email service@acreford.com with "LIA Request" in the subject line.

Experiment scope

Experiments tune negotiation parameters (concession rate, opening-ask multiplier, patience, lowball tolerance) within published bands, and tune cosmetic variants (portraits, archetype-level flavor). The framework explicitly does not optimize for monetization, revenue, time-on-device, or deals-closed-per-session — those are firewall-protected per the design established in our July 14, 2026 monetization-firewall review. Humor density, AI persona prompts, and wacko-persona encounter rates are locked from experimentation and cannot be modified by the A/B framework.

What "persona variant assigned" means

When you start a negotiation, the game assigns you a variant for any experiment currently running (e.g. param_concession_v1). The assignment is deterministic — same account always sees the same variant for the same experiment, across sessions, until the experiment ends. There is no per-player opt-out that changes which variant you see (see Terms §4g ¶5 for the methodological reasoning); you may contact service@acreford.com with questions about our experimentation practices or to request a summary of experiments you were exposed to (subject to the access rights in §10).

Optional persona-recall microsurvey

After you close three or more negotiations in a session, the game may show a single-prompt survey asking you to name one seller you met. This is default-on with a one-tap "Never" button that permanently hides it on this browser. Your free-text answer is matched against the known persona-name registry; only the matched name (not your raw input) is stored. If we cannot match your input to a known persona, we record only that recallNamed: false and discard the text — this prevents accidental collection of personal information you might type. This is a new data collection surface introduced July 16, 2026; you can opt out via the "Never" button or by emailing service@acreford.com.

Paid-product analytics (effective July 21, 2026)

When you purchase or are refunded a County File, regional Charter Bundle (Pacific Northwest Homestead Pack, Idaho Backcountry Pack), or the Western Expansion All-Access Pass, we record per-SKU analytics events server-side tied to your account: county_file_purchased (payload: productId, fips array, priceUsd, charter boolean), bundle_purchased (payload: productId, fips array, bundleSize, priceUsd, charter boolean), mega_bundle_purchased (payload: productId, fips array, priceUsd, charter boolean), and refund counterparts with the same payload shape. We also store a nextPackDiscount field on your player document when you purchase a Charter Bundle, recording { percent, expires, used, grantedAt, grantedByProductId } — this drives the one-time 30% discount on your next Western Expansion County File purchase (see Terms §4f-2). Also effective July 21, 2026 (Wave 1 Bossman 7-Session Onboarding): we record ac_purchased (payload: productId, ac integer, priceUsd, productType) on every Action Credit grant (AC pack purchase or tier bundle), note_created, note_sold, quest_completed, terms_chooser_opened, terms_picked, and cash_picked. These drive the onboarding quest progression, owner-financing simulation, and Itay-CFO rollback guard rails (aggregate purchase-rate + retention cohorts; no new personal data shared externally). Lawful basis: GDPR Art. 6(1)(f) legitimate interest (operating and improving a paid product catalog) — same basis as the rest of §16. No new consent is required. Retention: 7 years for transactional records (same schedule as §9 for tax/chargeback purposes); the analytics events themselves are retained on the same schedule.

Wave 2+3 onboarding extension (effective July 22, 2026)

When you interact with the Buyer's List, Contracts, Partnerships, or Dollar-Skittle subsystems, we record additional server-side events: buyers_list_entry_added (payload: personaCode, negotiationOutcome), buyers_list_blasted (payload: listSizeAtBlast, acCost), buyers_list_sale_converted, contract_created, contract_assigned, contract_expired, partnership_opened, partnership_closed, uncle_scott_declined, dollar_skittle_bought, dollar_skittle_missed, quest_session_skipped, s6_seed_refresh_used, quest_session_intro_viewed, quest_session_intro_dismissed. We also record failure-path events when an action is rejected: blast_failed_insufficient_ac, contract_create_failed_unowned, assign_failed_self_assign, uncle_scott_modal_blocked_cooldown, dollar_skittle_blocked_no_lien, and quest_skip_executed — these carry only the failure type and the input that was rejected, never PII. All Wave 2+3 events are aggregate-only for Itay-CFO rollback-signal rollups; no individual player behavior leaves the Firebase project. Lawful basis: GDPR Art. 6(1)(f) legitimate interest (same as Wave 1 §16). Retention: same schedule as §9.

Exit Lane and Cancel-Probability Modeling (effective July 24, 2026). The Game simulates three outbound "exit lanes" for parcels you own: cash sale, owner-financed terms sale, and wholesale-out. For terms sales, the Game models a per-game-month cancel probability — a synthetic chance that the simulated buyer defaults on the installment plan. This probability is computed from in-game signals: the number of due-diligence (DD) rows you skipped on the parcel, the parcel's days-on-market, the number of prior cancels on that parcel (the "cancel stain"), and the buyer persona's flake tendency. The computation runs server-side tied to your account; the resulting cancel percentage is displayed in your parcel panel if you own the "Cancel Surgeon" skill node (Level 6+). On cancel: the parcel returns to your inventory with the deed retained, all payments received to date are kept as in-game revenue, and the parcel's cancel-stain count increments by one. The stain is permanent for the parcel's life in your inventory and resets to zero only on a clean 35/35-payment payoff. Analytics events: we record cash_picked, terms_picked, wholesale_out_picked, inbound_wholesale_accepted, inbound_wholesale_declined, skill_purchased (payload: nodeId, costPaid — game-$ only), and server-side default events. Inbound wholesale (Trader Network, Level 6+): the Game may offer bulk parcels from a synthetic "trader" with DD status marked UNKNOWN — these parcels ship without pre-applied due-diligence data; you must run DD after close or accept the cancel-stain risk on resale. Real-life variance disclaimer: the Game uses a simplified land-contract model. Real land-contract forfeiture rules vary by state and may require notice, cure periods, or foreclosure-equivalent process. This Game teaches the structure Oz teaches in his mentorship, not your local statute. Not investment advice. Lawful basis: GDPR Art. 6(1)(f) legitimate interest (operating and balancing the Game's terms-deal economy). Retention: same schedule as §9.

Flip-Funnel Analytics (effective August 7, 2026)

To measure how many players complete their first parcel flip (purchase → list → sale), we record three server-side events tied to your account: flip_parcel_acquired (fires when you complete a parcel purchase via closePurchase), flip_parcel_listed (fires when you list a parcel for sale via listParcel), and flip_completed (fires when a parcel sale closes via closeSale or exitLane cash lane). These events carry the parcel's APN, price, profit, acres, county, and sale route. They fire after the underlying Firestore transaction commits, guaranteeing exactly-once semantics. Test accounts are stamped isTestAccount: true and excluded from first-flip cohort analysis. The flip-funnel rollup (a scheduled function) aggregates these events nightly into per-player cohort stats: { firstFlipAcquiredAt, firstFlipListedAt, firstFlipCompletedAt, daysToList, daysToClose, firstFlipProfit }. These stats drive A/B-test calibration for portrait variants and are stored under your account, deleted with it (see §9). Lawful basis: GDPR Art. 6(1)(f) legitimate interest (measuring and improving core-game-loop completion). Retention: per-player cohort stats live under your account and are deleted with it (see §9); only de-identified aggregate cohort numbers are kept long-term for game-balance and A/B-test calibration. Raw events follow §9. No per-player-identifiable output leaves the Firebase project.

Locale and Telemetry-Integrity Events (effective October 6, 2026)

The Game records a server-side event when your browser reports a locale (language/region) setting via the in-game language switcher — an anti-abuse and telemetry-integrity signal tied to your account. These events carry the locale, your account ID, IP, and timestamp, and are deleted automatically after 90 days (see §9).

QA-Account Classification (effective October 6, 2026)

Accounts matching internal QA email patterns are flagged isTestAccount: true and excluded from analytics and leaderboards. The flag lives on your account and is deleted with it.

17. Public Leaderboards and Match Pages (effective July 28, 2026)

What this section covers

The Game includes public, unauthenticated web pages that display aggregate gameplay data for human players who opt in, and for Acreford-operated AI agents (see Terms §3a). Currently the only such page is the AI match page at /match/<id> (e.g. /match/2026-07-28-AVB) showing two AI agents competing. A broader leaderboard UI for human players may ship later; the same rules in this §17 will apply.

Fields displayed publicly when you opt in

For human players who turn on the in-game leaderboard opt-in setting, and for Acreford-operated AI agents (always displayed), the following fields may appear on public, unauthenticated pages:

What is never displayed publicly: your email address, real name, IP address, payment data, AI persona transcripts, negotiation history, or any field not listed above. (In-game parcel data is shown to other players — see "County recorder price-history feed" below — but never on public, unauthenticated web pages.)

County recorder price-history feed (effective October 7, 2026)

Inside the Game, every parcel has a county record that mirrors how a real county recorder's office works: when you buy or sell a parcel, an entry with your display name, the transaction price (in-game currency), and the game date is added to that parcel's price history. These entries are visible to all authenticated players who view the parcel's record — they are not published on public, unauthenticated web pages like the leaderboard data above.

This is a core part of how the Game is played: county records are how every player sees what a parcel last traded for, just as real flippers check county recorder offices. By playing, you accept that your in-game transactions are recorded this way (GDPR Art. 6(1)(b) — necessary to provide the game you signed up for; also our legitimate interest in running a working in-game economy). Only your display name and in-game transaction amounts appear — never your email, real name, or any account details.

Minors: entries recorded for age-gated minor accounts (accounts that have not passed the same server-side age check described in §8) show the placeholder name Flipper instead of the player's display name — the same convention leaderboards use.

Deletion: when your account is purged, your name is removed from these county records (rewritten to the same Flipper placeholder — the transaction history itself stays, like a real county record, but no longer points to you). See §10 for how to request account deletion.

Opt-in mechanism for human players

The leaderboardOptIn flag on your player document controls whether your aggregate fields appear on human-facing leaderboard pages. You can toggle it off at any time in settings; we will stop rendering your data on leaderboard pages within 7 days (the cron recomputes the board weekly). Toggling it off does not delete historical renders from third-party archives — see §10 for the deletion limitation.

AI agents are always opted in

Acreford-operated AI agents (per Terms §3a) do not have a separate opt-in choice — they exist specifically to be displayed. They are flagged with isAIPlayer: true on the player document and are filtered out of human-facing leaderboards via the server-side isHumanEligible() filter, so human leaderboards never show AI agents and AI agents never appear as if they were human players.

Lawful basis (GDPR Art. 6)

For AI agents operated by Acreford: Art. 6(1)(b) necessary for performance of a contract (operating the demonstration match feature described in Terms §3a) — no separate human data subject is involved. For human players who opt in to leaderboard display: Art. 6(1)(a) consent — given freely via the in-game opt-in toggle, withdrawable at any time by toggling off, with the same effect as a deletion request for future renders. We chose consent (rather than legitimate interest) because public display of identifiable gameplay activity is harder to defend under an LIA balancing test; explicit consent is the cleaner basis.

CCPA / CPRA notice

Public display of this aggregate data on Acreford-controlled pages is "sharing" under the CCPA's broad definition but is not "selling" — we do not exchange the data for monetary or other valuable consideration. Because we do not sell or share for value, no "Do Not Sell or Share My Personal Information" link is required. Your right to opt out of public display is exercised by toggling off the in-game leaderboardOptIn setting (same mechanism as the GDPR consent withdrawal).

Retention

Public-match-page data is rendered live from your player document. When you delete your account or toggle off the opt-in, the data stops rendering on Acreford-controlled pages within 7 days. Historical Firestore snapshots written by the weekly leaderboard cron are retained on the same schedule as §9.

17a. In-Game Leaderboards — Your Gamertag and Ranking Data (effective August 20, 2026)

Gamertag is personal data

The gamertag you choose for leaderboards (or the server-generated Flipper-NNNN pre-seed) is stored on your player document and is personal data we process about you. It is distinct from your login email and display name, which are never shown on leaderboards.

What is publicly visible, and where

When you opt in, your gamertag, board rank, and score are displayed on the in-game leaderboard screens (10 boards — weekly, monthly, all-time, and career windows) to other players, and in the public board documents those screens read. Scores are aggregate gameplay figures (net worth, net worth gain, flip counts, profit-weighted ROI, lifetime acres). No email, real name, IP, payment data, or negotiation history is ever included. The scoring formulas, reset windows, tie-break rules, and exclusions are published at /help/rankings.

Retention and anonymization

All-time board history is retained on a rolling 24 months, then anonymized to “Former Player” with score preserved — the score, window, and rank remain for historical integrity, but your gamertag and account identifier are removed. Weekly and monthly board snapshots roll over on their reset windows (Monday 05:00 UTC / the 1st of the month 05:00 UTC). Deleting your account removes you from live boards and from future recompute; see §10 for your erasure rights.

Appeals data

If you submit a gamertag appeal or a quarantine appeal, we store the appeal record under your account: your account id, the requested tag (for gamertag appeals), the reason code, your note to the reviewer, review status, timestamps, and admin review notes. Appeals are visible only to you and to Acreford reviewers; they are never public. Appeal records are retained while your account is active and deleted with your account.

play.acreford.com is a simulation game that sells in-game currency and virtual parcels, and is separate from the real land-inventory business at acreford.com.

Acreford — operator of Land Flipper Tycoon.
A simulation game. Paddle.com is the Merchant of Record for all purchases. Not investment advice.

← Back to the Game