Costilla County · Recorder

Privacy Policy

Effective date: July 9, 2026.

1. Who We Are

Land Flipper Tycoon (the "Game") is operated by Acreford ("we", "us") — a brand operated by Victor, an individual based in Jerusalem. Paddle.com is the Merchant of Record for all in-game purchases — see §5 for what this means for your data. This Privacy Policy covers only the Game and its supporting Firebase backend.

2. Data We Collect

Account data. When you register, we collect your email address and an optional display name. Authentication is handled by Firebase Authentication. We do not collect your real-world identity, address, or phone number for the Game.

Date of birth (optional). If you choose to provide it, we store your date of birth on your account to determine whether real-money purchases require parental consent (we apply a stricter checkout flow for players under 18). The DOB is never shared with Paddle or any third party; only a derived "under 18" flag is sent at checkout to trigger the parental-consent screen. The DOB is also used server-side for age verification for leaderboard eligibility (see §8 — only age-verified accounts appear on leaderboards).

Gameplay behavior. We store in-game state tied to your account: your current cash and AC (Action Credits) balance, owned parcels, active negotiations, in-game event log, and the messages you send to AI personas. This data is required to operate the Game and to detect fraud or abuse. Aggregate fields derived from this data — including netWorth, scoreAllTimeFlips, scoreAllTimeAcres, level, and gamertag — may also be displayed publicly as described in §17 (Public Leaderboards and Match Pages) when you opt in.

AI transcripts. The messages you send to AI personas and the AI's replies are stored as part of the negotiation history so you can resume a conversation. They may be inspected by Acreford staff only in aggregated and de-identified form to improve dialogue quality and detect prompt-injection attempts. "De-identified" means we strip or hash identifiers so the data cannot reasonably be linked back to you or your account.

Technical data. We log your IP address, browser type, and timestamps from standard Firebase server logs. This is used for security, rate-limiting, and abuse prevention.

Payment data. We do not receive or store your payment card details. All payment information is collected and processed directly by Paddle. We receive only a transaction ID, the amount, and a timestamp.

3. How We Use Your Data

We do not use automated profiling or AI to make solely-automated decisions about you with legal or similarly significant effects (GDPR Art. 22).

4. Firebase Authentication & Firestore

The Game is built on Firebase, a Google Cloud service. Your account credentials are managed by Firebase Authentication, and your gameplay state is stored in Cloud Firestore. Your data is stored on Google Cloud infrastructure subject to Google's data processing terms (Google's standard contractual modules and Data Privacy Framework certification, available at cloud.google.com/terms/data-processingterms). We configure Firestore security rules so that each player can read and write only their own data.

5. Paddle — Merchant of Record

Paddle.com is the seller of record for all in-game purchases. When you buy AC or subscribe to Pro Flipper, Paddle receives:

Paddle's use of this data is governed by Paddle's Privacy Policy. Paddle is an independent data controller for payment data; Acreford is the controller for gameplay data.

6. Other Third-Party Sharing

We never share AI transcripts or individual gameplay behavior with advertising networks. We do not sell your personal information as those terms are defined in the California Consumer Privacy Act (Cal. Civ. Code §1798.140(ad), (ah)), and we do not need a "Do Not Sell or Share My Personal Information" link on that basis. Public-display exception: aggregate gameplay fields (gamertag, net worth, flips, acres, level) may be displayed on public, unauthenticated pages when you opt in via the in-game leaderboard opt-in setting — see §17 for the full disclosure. This is publication by Acreford as controller, not third-party sharing. Visible to other players: when you opt in to in-game leaderboards, other players (and readers of the public board pages) can see your gamertag, board rank, and score — see §17 and §17a for the full visibility scope.

7. AI Inference (Google Gemini)

When you send a message to a persona in the Game, the message (along with a brief in-context transcript) is sent to Google's Gemini API to generate the persona's reply. Google processes this data under Google's Generative AI API Additional Terms and the Data Privacy Framework (Google LLC is DPF-certified by the U.S. Department of Commerce for EU/UK/EEA personal data). We strip obvious prompt-injection patterns before the call and sanitize the data sent. We do not include your real-world identity, email, or payment data in the AI request.

7a. What We Send to Google — and What We Keep

What is sent. The text of your negotiation messages, a short window of recent conversation (up to 12 messages), the persona profile being voiced, and a brief parcel summary. Nothing else about your account (email, display name, date of birth, payment data, wallet balances) is included in the AI request.

Prompt-injection defenses. Before your message reaches Gemini, we strip common prompt-injection phrasing ("ignore previous instructions," fake <system> tags, etc.) and wrap your text in explicit boundary tokens so the model treats it as content to transcribe, never commands to obey. The model's reply is also sanitized on return — if it breaks character or echoes AI-tell phrasing ("as an AI…"), we strip that before you see it.

Feedback logs (failure-driven improvement). When a Gemini call produces a bad output (empty reply, safety block, or off-character response), we record a feedback entry to improve the persona prompts over time. This entry never contains your raw message text. It stores only structural signals: the message count, whether an injection pattern was detected, whether your message contained a dollar-sign offer, the persona type, and the failure mode. A daily summary is written for Acreford staff review. Improvement is manual — a human reads the summary and edits the persona prompts. We do not auto-rewrite prompts from your data.

7b. Opting Out of AI Persona Replies

You can opt out of Gemini-powered persona replies at any time. When you opt out:

To opt out: open any active negotiation; on your first message, you will see a one-time consent prompt. Decline it (or toggle it off later in Settings). You can re-enable Gemini replies at any time from the same prompt or Settings. Your consent choice is stored on your account at consent.geminiNegotiation with a timestamp.

Existing players who sent messages before this disclosure. If you played before July 10, 2026, your earlier messages were sent to Gemini under the prior version of this policy. Going forward, you will see the consent prompt on your next negotiation and can opt out there. To request deletion of prior AI-related data, email service@acreford.com (we will action verified requests within 30 days per §10).

7c. Persona Critic — Weekly Quality Scoring (Effective 2026-07-20)

What this is. We continuously improve the realism of the AI personas that negotiate with you. To do this, a weekly automated job (the "Persona Critic") samples a small subset of completed negotiation transcripts, scores them on a quality rubric, and proposes edits to the persona prompt text. A human operator reviews the proposals before any change goes live.

Sampling. Once per week, up to 48 recent negotiation transcripts (12 per persona type, 4 seller persona types) are selected from gameplay. Only completed negotiations with at least 3 messages are eligible.

Sanitization before scoring. Before any sampled transcript is scored, it passes through a three-layer sanitizer that strips: (a) prompt-injection patterns (e.g., <<SYS>> tokens, fake authority tags), (b) harmful content including slurs, threats, self-harm references, and tier-2 profanity (replaced with [REDACTED-HARMFUL]), and (c) personally identifiable information — email addresses, phone numbers, U.S. street addresses, and your display name are replaced with [CONTACT], [ADDRESS], or [PLAYER]. The sanitizer is idempotent (running it twice produces the same output as running it once).

Who scores. Sanitized transcripts are scored by Google's Gemini API (the same provider used for live persona replies — see §7). The scoring call does not include your real identity, email, or payment data.

Monthly calibration by Anthropic. Once per month, a sample of 10 sanitized transcripts is re-scored by Anthropic's Claude API as an independent quality check on the Gemini scoring. Anthropic receives only the sanitized transcript text — never your identity, email, payment data, or the original (pre-sanitization) text. Anthropic processes this data in the United States under its Commercial Terms and the EU-U.S. Data Privacy Framework.

Leak filter. Any automated persona-prompt edit proposal that quotes or paraphrases 8 or more consecutive characters from a sanitized transcript is automatically rejected and logged for review. This prevents the personas from inadvertently repeating your words back to other players.

Retention. Sanitized scoring records (scores, sanitized excerpts, edit proposals) are retained for 180 days, then automatically deleted. Forensic audit records of rejected leak-filter violations are retained for 30 days. We do not retain the original (pre-sanitization) transcripts beyond what §7 already describes for live gameplay.

Opt-out. The §7b opt-out (declining Gemini-powered persona replies) does NOT automatically exclude your past negotiations from the weekly scoring sample — your messages were already sent to Gemini at runtime when you played. To request that your negotiation transcripts be excluded from future weekly samples, email service@acreford.com from the address on your account. We will tag your account within 7 days so that future sampling jobs skip your transcripts. Sanitized records already scored will be deleted on the regular 180-day schedule.

8. Children's Privacy (COPPA)

The Game is not directed to children under 13. We enforce a 13+ age gate at registration through an explicit checkbox and a programmatic check. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, contact service@acreford.com and we will delete it within 30 days.

Leaderboards and minors. In-game leaderboards are gated behind a server-side age check: a player appears on any board only if their account has a verified date of birth (ageVerified). Accounts that have not passed the age check — including accounts of players who decline to provide a date of birth — never appear on leaderboards, regardless of the global feature flag. A minor's gameplay data is otherwise processed exactly like any other player's; public leaderboard display requires the same explicit opt-in as for every player (§17, §17a).

9. Data Retention

We retain your account and gameplay data for as long as your account is active. If you delete your account, we will delete your gameplay state and AI transcripts within 30 days. Server log data (IP, browser type) is retained for up to 90 days for security and abuse analysis. Transactional records (ledger entries, transaction IDs) are retained for 7 years to satisfy U.S. tax-record retention (IRS §6001 recordkeeping) and to respond to chargeback or fraud disputes. Payment records are retained by Paddle per their policy.

10. Your Rights

You have the right to access, correct, or delete your personal data. You can delete your account and associated gameplay data by emailing service@acreford.com. We will process verified requests within 30 days. If you are in the EU/UK/California, you have additional rights under GDPR / UK GDPR / CCPA, including:

To exercise any right, email service@acreford.com from the address on your account. For payment-data rights (including erasure of payment records), contact Paddle directly — we do not control payment data once it reaches Paddle.

Deletion limitation for publicly-rendered data. If you opted in to public leaderboards or match pages (§17), your displayed aggregate data may have been viewed, screenshotted, or archived by third parties while it was public. When you request deletion we will remove the data from our live Firestore docs and stop rendering it on any Acreford-controlled page within 30 days — but we cannot recall or delete third-party copies. This is the standard limitation that applies to any data published on the public web.

11. Security

We use Firestore security rules, Firebase Authentication, and HTTPS in transit. No method of transmission or storage is 100% secure. We do not store payment card details on our infrastructure — Paddle does.

12. Cookies & Local Storage

The Game is a single-page web application. We do not use third-party advertising or tracking cookies. We use:

Most browsers let you refuse or delete cookies/local storage; if you disable session storage, you will need to sign in again on every page load.

13. International Transfers

Your data is processed on Google Cloud, Google Gemini, and Paddle infrastructure in the United States. Transfer mechanisms: Google LLC's certification under the EU-U.S. Data Privacy Framework and the UK Extension to the DPF (verify current status at dataprivacyframework.gov), Paddle's Standard Contractual Clauses (available on request), and, where applicable, Paddle's certification under the EU-U.S. Data Privacy Framework (verify current status at dataprivacyframework.gov).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the effective date above. Material changes will be communicated via email or in-game notice at least 30 days before they take effect.

15. Contact

Privacy questions? Email service@acreford.com.

16. In-Game Analytics and Experimentation

Effective date: July 21, 2026. We collect analytics events tied to your account (for example: when a session starts, when your character levels up, when a purchase or sale closes in-game, when a negotiation starts, when a negotiation round happens, when a negotiation ends without a close, when a virtual assistant is purchased, and when an experiment variant is assigned to your account). Additional events we collect include: when you open the cash-or-terms chooser modal, when you pick cash or terms, when you complete a Bossman 7-Session onboarding session, and (server-side, tied to your account) when an owner-financed note is created or when a seasoned note is sold to an investor. We also assign a deterministic "experiment seed" derived from your account ID to decide which cosmetic and game-mechanics variants (such as seller portraits, persona negotiation parameters like patience or concession rate within narrow bands, and archetype-level tuning) you see, and to keep that variant stable across sessions.

We use this information to balance the game, improve UX, and run A/B tests on cosmetic and game-mechanics features. This data is stored in Firebase under your account ID and is visible only to you and to Acreford admins for support. We do not sell it.

Lawful basis (GDPR Art. 6). Our lawful basis for in-game analytics and experimentation is legitimate interests under Art. 6(1)(f) — our interest in operating, improving, and balancing the Game. A documented legitimate-interest assessment is available on request — email service@acreford.com with "LIA Request" in the subject line.

Experiment scope. Experiments tune negotiation parameters (concession rate, opening-ask multiplier, patience, lowball tolerance) within published bands, and tune cosmetic variants (portraits, archetype-level flavor). The framework explicitly does not optimize for monetization, revenue, time-on-device, or deals-closed-per-session — those are firewall-protected per the design established in our July 14, 2026 monetization-firewall review. Humor density, AI persona prompts, and wacko-persona encounter rates are locked from experimentation and cannot be modified by the A/B framework.

What "persona variant assigned" means. When you start a negotiation, the game assigns you a variant for any experiment currently running (e.g. param_concession_v1). The assignment is deterministic — same account always sees the same variant for the same experiment, across sessions, until the experiment ends. There is no per-player opt-out that changes which variant you see (see Terms §4g ¶5 for the methodological reasoning); you may contact service@acreford.com with questions about our experimentation practices or to request a summary of experiments you were exposed to (subject to the access rights in §10).

Optional persona-recall microsurvey. After you close three or more negotiations in a session, the game may show a single-prompt survey asking you to name one seller you met. This is default-on with a one-tap "Never" button that permanently hides it on this browser. Your free-text answer is matched against the known persona-name registry; only the matched name (not your raw input) is stored. If we cannot match your input to a known persona, we record only that recallNamed: false and discard the text — this prevents accidental collection of personal information you might type. This is a new data collection surface introduced July 16, 2026; you can opt out via the "Never" button or by emailing service@acreford.com.

Paid-product analytics (effective July 21, 2026). When you purchase or are refunded a County File, regional Charter Bundle (Pacific Northwest Homestead Pack, Idaho Backcountry Pack), or the Western Expansion All-Access Pass, we record per-SKU analytics events server-side tied to your account: county_file_purchased (payload: productId, fips array, priceUsd, charter boolean), bundle_purchased (payload: productId, fips array, bundleSize, priceUsd, charter boolean), mega_bundle_purchased (payload: productId, fips array, priceUsd, charter boolean), and refund counterparts with the same payload shape. We also store a nextPackDiscount field on your player document when you purchase a Charter Bundle, recording { percent, expires, used, grantedAt, grantedByProductId } — this drives the one-time 30% discount on your next Western Expansion County File purchase (see Terms §4f-2). Also effective July 21, 2026 (Wave 1 Bossman 7-Session Onboarding): we record ac_purchased (payload: productId, ac integer, priceUsd, productType) on every Action Credit grant (AC pack purchase or tier bundle), note_created, note_sold, quest_completed, terms_chooser_opened, terms_picked, and cash_picked. These drive the onboarding quest progression, owner-financing simulation, and Itay-CFO rollback guard rails (aggregate purchase-rate + retention cohorts; no new personal data shared externally). Lawful basis: GDPR Art. 6(1)(f) legitimate interest (operating and improving a paid product catalog) — same basis as the rest of §16. No new consent is required. Retention: 7 years for transactional records (same schedule as §9 for tax/chargeback purposes); the analytics events themselves are retained on the same schedule.

Wave 2+3 onboarding extension (effective July 22, 2026). When you interact with the Buyer's List, Contracts, Partnerships, or Dollar-Skittle subsystems, we record additional server-side events: buyers_list_entry_added (payload: personaCode, negotiationOutcome), buyers_list_blasted (payload: listSizeAtBlast, acCost), buyers_list_sale_converted, contract_created, contract_assigned, contract_expired, partnership_opened, partnership_closed, uncle_scott_declined, dollar_skittle_bought, dollar_skittle_missed, quest_session_skipped, s6_seed_refresh_used, quest_session_intro_viewed, quest_session_intro_dismissed. We also record failure-path events when an action is rejected: blast_failed_insufficient_ac, contract_create_failed_unowned, assign_failed_self_assign, uncle_scott_modal_blocked_cooldown, dollar_skittle_blocked_no_lien, and quest_skip_executed — these carry only the failure type and the input that was rejected, never PII. All Wave 2+3 events are aggregate-only for Itay-CFO rollback-signal rollups; no individual player behavior leaves the Firebase project. Lawful basis: GDPR Art. 6(1)(f) legitimate interest (same as Wave 1 §16). Retention: same schedule as §9.

Exit Lane and Cancel-Probability Modeling (effective July 24, 2026). The Game simulates three outbound "exit lanes" for parcels you own: cash sale, owner-financed terms sale, and wholesale-out. For terms sales, the Game models a per-game-month cancel probability — a synthetic chance that the simulated buyer defaults on the installment plan. This probability is computed from in-game signals: the number of due-diligence (DD) rows you skipped on the parcel, the parcel's days-on-market, the number of prior cancels on that parcel (the "cancel stain"), and the buyer persona's flake tendency. The computation runs server-side tied to your account; the resulting cancel percentage is displayed in your parcel panel if you own the "Cancel Surgeon" skill node (Level 6+). On cancel: the parcel returns to your inventory with the deed retained, all payments received to date are kept as in-game revenue, and the parcel's cancel-stain count increments by one. The stain is permanent for the parcel's life in your inventory and resets to zero only on a clean 35/35-payment payoff. Analytics events: we record cash_picked, terms_picked, wholesale_out_picked, inbound_wholesale_accepted, inbound_wholesale_declined, skill_purchased (payload: nodeId, costPaid — game-$ only), and server-side default events. Inbound wholesale (Trader Network, Level 6+): the Game may offer bulk parcels from a synthetic "trader" with DD status marked UNKNOWN — these parcels ship without pre-applied due-diligence data; you must run DD after close or accept the cancel-stain risk on resale. Real-life variance disclaimer: the Game uses a simplified land-contract model. Real land-contract forfeiture rules vary by state and may require notice, cure periods, or foreclosure-equivalent process. This Game teaches the structure Oz teaches in his mentorship, not your local statute. Not investment advice. Lawful basis: GDPR Art. 6(1)(f) legitimate interest (operating and balancing the Game's terms-deal economy). Retention: same schedule as §9.

Flip-Funnel Analytics (effective August 7, 2026). To measure how many players complete their first parcel flip (purchase → list → sale), we record three server-side events tied to your account: flip_parcel_acquired (fires when you complete a parcel purchase via closePurchase), flip_parcel_listed (fires when you list a parcel for sale via listParcel), and flip_completed (fires when a parcel sale closes via closeSale or exitLane cash lane). These events carry the parcel's APN, price, profit, acres, county, and sale route. They fire after the underlying Firestore transaction commits, guaranteeing exactly-once semantics. Test accounts are stamped isTestAccount: true and excluded from first-flip cohort analysis. The flip-funnel rollup (a scheduled function) aggregates these events nightly into per-player cohort stats: { firstFlipAcquiredAt, firstFlipListedAt, firstFlipCompletedAt, daysToList, daysToClose, firstFlipProfit }. These stats drive A/B-test calibration for portrait variants and are retained indefinitely. Lawful basis: GDPR Art. 6(1)(f) legitimate interest (measuring and improving core-game-loop completion). Retention: indefinite for cohort-aggregate stats; raw events retained on the same schedule as §9. No per-player-identifiable output leaves the Firebase project; all outputs are aggregate cohort statistics used for game-balance and A/B-test calibration.

17. Public Leaderboards and Match Pages (effective July 28, 2026)

What this section covers. The Game includes public, unauthenticated web pages that display aggregate gameplay data for human players who opt in, and for Acreford-operated AI agents (see Terms §3a). Currently the only such page is the AI match page at /match/<id> (e.g. /match/2026-07-28-AVB) showing two AI agents competing. A broader leaderboard UI for human players may ship later; the same rules in this §17 will apply.

Fields displayed publicly when you opt in. For human players who turn on the in-game leaderboard opt-in setting, and for Acreford-operated AI agents (always displayed), the following fields may appear on public, unauthenticated pages:

What is never displayed publicly: your email address, real name, IP address, payment data, AI persona transcripts, negotiation history, parcel-level basis or PII, or any field not listed above.

Opt-in mechanism for human players. The leaderboardOptIn flag on your player document controls whether your aggregate fields appear on human-facing leaderboard pages. You can toggle it off at any time in settings; we will stop rendering your data on leaderboard pages within 7 days (the cron recomputes the board weekly). Toggling it off does not delete historical renders from third-party archives — see §10 for the deletion limitation.

AI agents are always opted in. Acreford-operated AI agents (per Terms §3a) do not have a separate opt-in choice — they exist specifically to be displayed. They are flagged with isAIPlayer: true on the player document and are filtered out of human-facing leaderboards via the server-side isHumanEligible() filter, so human leaderboards never show AI agents and AI agents never appear as if they were human players.

Lawful basis (GDPR Art. 6). For AI agents operated by Acreford: Art. 6(1)(b) necessary for performance of a contract (operating the demonstration match feature described in Terms §3a) — no separate human data subject is involved. For human players who opt in to leaderboard display: Art. 6(1)(a) consent — given freely via the in-game opt-in toggle, withdrawable at any time by toggling off, with the same effect as a deletion request for future renders. We chose consent (rather than legitimate interest) because public display of identifiable gameplay activity is harder to defend under an LIA balancing test; explicit consent is the cleaner basis.

CCPA / CPRA notice. Public display of this aggregate data on Acreford-controlled pages is "sharing" under the CCPA's broad definition but is not "selling" — we do not exchange the data for monetary or other valuable consideration. Because we do not sell or share for value, no "Do Not Sell or Share My Personal Information" link is required. Your right to opt out of public display is exercised by toggling off the in-game leaderboardOptIn setting (same mechanism as the GDPR consent withdrawal).

Retention. Public-match-page data is rendered live from your player document. When you delete your account or toggle off the opt-in, the data stops rendering on Acreford-controlled pages within 7 days. Historical Firestore snapshots written by the weekly leaderboard cron are retained on the same schedule as §9.

17a. In-Game Leaderboards — Your Gamertag and Ranking Data (effective August 20, 2026)

Gamertag is personal data. The gamertag you choose for leaderboards (or the server-generated Flipper-NNNN pre-seed) is stored on your player document and is personal data we process about you. It is distinct from your login email and display name, which are never shown on leaderboards.

What is publicly visible, and where. When you opt in, your gamertag, board rank, and score are displayed on the in-game leaderboard screens (10 boards — weekly, monthly, all-time, and career windows) to other players, and in the public board documents those screens read. Scores are aggregate gameplay figures (net worth, net worth gain, flip counts, profit-weighted ROI, lifetime acres). No email, real name, IP, payment data, or negotiation history is ever included. The scoring formulas, reset windows, tie-break rules, and exclusions are published at /help/rankings.

Retention and anonymization. All-time board history is retained on a rolling 24 months, then anonymized to “Former Player” with score preserved — the score, window, and rank remain for historical integrity, but your gamertag and account identifier are removed. Weekly and monthly board snapshots roll over on their reset windows (Monday 05:00 UTC / the 1st of the month 05:00 UTC). Deleting your account removes you from live boards and from future recompute; see §10 for your erasure rights.

Appeals data. If you submit a gamertag appeal or a quarantine appeal, we store the appeal record under your account: your account id, the requested tag (for gamertag appeals), the reason code, your note to the reviewer, review status, timestamps, and admin review notes. Appeals are visible only to you and to Acreford reviewers; they are never public. Appeal records are retained while your account is active and deleted with your account.

play.acreford.com is a simulation game that sells in-game currency and virtual parcels, and is separate from the real land-inventory business at acreford.com.

Acreford — operator of Land Flipper Tycoon.
A simulation game. Paddle.com is the Merchant of Record for all purchases. Not investment advice.

← Back to the Game