PRIVACY
Last updated 27 September 2026
This page says what Deadhead collects, where it is kept and who else can see it. If any of it changes, this page changes first.
The short version
- There are no cookies on this website, no analytics, no advertising and no tracking of any kind.
- If you join the waitlist, the only thing stored is your email address. It is used to tell you when the game opens, and for nothing else.
- Playing the game needs no account, no email and no password.
- Nothing is sold, rented or shared for marketing. There is no second revenue line to tempt anyone into it.
- Ask and your data is deleted. There is no retention policy dressed up as a requirement.
What this page covers
This website, deadheadgame.online, and the game server it talks to at api.deadheadgame.online. The mobile app is still in development. This page will be updated before it is released, so that what you read describes the app you are installing.
If you join the waitlist
You give an email address. It is sent to the game server over HTTPS and appended to a file on that machine. That is the whole system — there is no mailing-list provider, no CRM and no third party involved.
Your address is lowercased and trimmed so the same person cannot occupy two rows, and submitting twice stores nothing the second time. It is used for one purpose: to tell you when there is something to play. It will not be used for anything else without asking you first.
If you just visit
The web server keeps an ordinary access log: your IP address, the page requested, the time, your browser's user-agent string and the page that referred you. This is how a server is operated and debugged. The log rotates by size and old files are discarded — it is not searched, profiled or joined to anything else.
The page loads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser contacts Google directly to fetch them, so Google receives your IP address and can see that a browser asked for these fonts. No other third party is contacted by this page. Nothing else is embedded — no scripts, no pixels, no frames — and the site's Content-Security-Policy enforces that rather than merely promising it.
The link to Discord is a link. Nothing is sent to Discord unless you click it, and what happens then is Discord's policy, not this one.
If you play
Starting a company asks for nothing but a name for it. No email, no password, no sign-in. The server hands back a token that identifies your company, and that token is what your client presents afterwards. It is stored alongside the world on the same machine.
If the game is later played from a device that can receive notifications, and you turn them on, the server stores the push token the platform issues, and which platform it came from, so it can tell you a truck arrived. Turning notifications off removes it.
Accounts are optional and are being built now. They exist so a lost phone is not a lost company. When they ship, signing in will use Firebase Authentication, which is Google's service: Google verifies who you are and this server stores only the anonymous user id Firebase returns, mapped to your company. Your password is never seen by this server, and email addresses used for sign-in are held by Firebase rather than here.
Everything the world itself records — your company, its trucks, its drivers, its money, where it has hauled — is game state, not personal data. It is kept for as long as the world runs, which is the point of a persistent world.
Who else can see any of this
| Who | What they see | Why |
|---|---|---|
| Google Fonts | Your IP address when the page loads | The page's typefaces are hosted there |
| OVH | Nothing directly; they host the server the data sits on | The machine has to run somewhere |
| Let's Encrypt | Nothing about you | Issues the certificate that encrypts your connection |
| Firebase (Google) | Your sign-in identity, if you choose to create an account | Not yet in use — accounts are unreleased |
| Apple, Google | Push tokens; subscription status if you subscribe | Not yet in use — the app is unreleased |
No analytics provider, no advertising network, no data broker and no social platform receives anything. There is no pixel, no tag manager and no session recorder.
What is never done
- Your data is not sold, rented, or shared for anyone else's marketing.
- You are not profiled, scored, or targeted.
- No purchase inside the game affects anything about your data, just as no purchase affects anything about the game.
- You are not emailed things you did not ask for. The waitlist exists to send one kind of message.
How long things are kept
- Waitlist addresses — until the game opens and you have been told, or until you ask for yours to be removed, whichever comes first.
- Web server logs — rotated by size, with only the most recent kept. Typically days to weeks depending on traffic, never deliberately archived.
- Your company and its token — for as long as the world runs. The world is designed never to reset.
- Push tokens — until notifications are turned off or the platform retires them.
Your rights
Wherever you live, and regardless of which law applies to you: you can ask what is held about you, ask for a copy, ask for it to be corrected, and ask for it to be deleted. Ask and it is done — there is no form, no identity-verification theatre and no thirty-day clock being run down. If you are in the UK or the EU, the lawful basis for the waitlist is your consent, which you can withdraw at any time by asking; for server logs it is the legitimate interest of keeping a server running safely.
Deleting a waitlist address is immediate. Deleting a company is different and it will be explained plainly when accounts ship, because a shared persistent world cannot simply erase a carrier other players have hauled against without leaving holes in the world.
Children
Deadhead is not directed at children under 13, and nothing here is knowingly collected from them. If you believe a child has given an email address to the waitlist, say so and it will be removed.
Security, honestly stated
Everything travels over HTTPS and the server is kept patched. The access token that identifies your company is held by your client; anyone who obtains it can act as your company, which is why tokens are treated as secrets and are stripped from server logs deliberately. No system is beyond having a problem found in it, and this page will not claim otherwise — if you find one, reporting it will be acted on rather than argued with.
Changes
If what is collected changes, this page changes first and the date at the top moves. Material changes will be said plainly on the site rather than slipped in.
Contact
Questions, corrections, or a request to be deleted: privacy@deadheadgame.online.