Privacy policy

Updated November 8, 2026 · version 1.4

Summary. Corner Office has no ads, does not track you across apps and websites and uses no advertising or tracking SDKs. We keep only what the game needs to work: your account, your tower, records used to investigate mismatches, your notification token (if you turn notifications on) and a few usage events linked to your internal account code (no name or email). You can delete your account inside the app under Settings → Delete account.

This first release is free and does not offer purchases. References to transactions below describe support prepared for a future version with sales; purchase transactions are not collected in this release.

1. Who is responsible

The data controller is Caio Moretti (“we”), responsible for the Corner Office iPhone app and the cornerofficegame.dev website.

Privacy and personal data rights contact: privacy@cornerofficegame.dev.

2. Data we collect

Data	When	Why
Account identifier: an internal code generated by our server, plus a random guest identifier the app creates on your device (it is not the IDFA or any other advertising identifier).	The first time you open the app.	To create your guest account, recognise your device without asking you to log in, and associate usage events with your account for aggregate analysis.
Apple identifier (the Sign in with Apple “sub” code) and a refresh token issued by Apple, stored encrypted. We do not ask for or receive your name or email.	Only if you sign in with Apple.	To keep your tower in your Apple account and restore it on another device. The token is used only to revoke the game's access to your Apple account when you delete your account.
Device notification token (APNs) and the app language.	Only if you turn notifications on, which the app offers after your first day close.	To send at most one notification a day with your tower's budget.
Game state: company name, sector, city and lot, the tower (rooms, staff, research, goals, cash), each day's actions, day-close times and each day's verification code (hash). If a day's result does not match the server's, the app also sends the end-of-day state your device calculated.	While you play; the app sends each day when it closes.	To save your tower, check every day on the server (the server replays the day to prevent cheating), and work out offline earnings, the skyline and the ranking.
Divergence diagnostics: the state calculated on your device and per-tick hashes, linked to your account and company.	Automatically, if the app and server disagree when checking a day.	To investigate and fix simulation errors. Kept for up to 30 days in rejected or mismatched day records.
Purchases (future version; inactive in this release): the App Store signed transaction (transaction ID, product, date and environment).	When you buy or restore purchases.	To confirm through Apple's signature that the purchase is valid and unlock the item. We never receive card or payment details: payment is handled by Apple.
Optional Amplitude analytics: app opens, your stable internal account code, whether it is a guest or Apple account and technical browser/system information. We do not send names, email addresses, Apple tokens or your company state.	On by default when you open the app, unless you turn off Usage analytics in Settings. A previous choice to turn it off is preserved across updates.	Measure opens, return visits and usage under the same account profile, instead of creating a new player for every launch. We do not record screens, keystrokes or fields.
Usage events: company founding, day close (revenue, balance, headcount), returning to the app (time away) and session length, with app version, platform and time.	While you use the app.	To understand whether the game is balanced and whether people come back (retention), always as aggregate numbers.
Name reports: when you report another company's name, we keep who reported it, which company, the reason and the date. When moderation changes a name, we keep the old name, the new one and the date.	Only when you report a name, or when moderation changes your company's name.	To hide the reported company from you, replace names that break the Terms and prevent repeated reports.
IP-derived code: a one-way code computed from your IP address with a secret key (never the IP address itself).	When a new guest account is created and when a company is founded.	To limit mass creation of accounts and companies, which would take the city's lots away from other players. Deleted within 3 hours.
Server technical logs: metadata for each request kept by our hosting provider (time, function called, result and network details, which may include your IP address), plus error and day-check messages that may include the internal account or company code.	While you use the app.	Security, investigating failures and cheating, and fixing bugs. They stay with the provider for up to 7 days and are not copied into our database.
Technical session data: your login token (with its expiry date) and per-account usage counters.	While you use the app.	To keep you logged in and limit abuse (for example, too many visits per hour).

Your device's IP address passes through our hosting provider to deliver each request, as with any internet service. We do not store IP addresses in our database (only the one-way code described above, for up to 3 hours); an IP address may appear in the provider's technical logs described above, which are deleted within 7 days.

We do not collect location, contacts, photos, advertising identifiers, health data or financial data.

3. What other players see

Corner Office has a shared city. Other players can see your company name, your tower (floors, rooms and in-game staff), in-game revenue and your ranking position, and can visit your tower to look around. Do not use your real name or personal details as your company name. There is no chat or messaging between players.

4. Legal bases

Performance of a contract (the Terms of use): account, saving your tower, checking each day, purchases, the city and the ranking.
Legitimate interests: aggregate usage events, including app opens linked to the stable internal account code in Amplitude, fraud and cheat prevention, rate limits and security. You can turn off Amplitude analytics in Settings → Usage analytics or object by email.
Consent: notifications (revocable in the iPhone Settings app).

5. Who we share data with

We do not sell or rent data and we do not share data with advertisers or data brokers. We only use these service providers, which process data on our behalf:

Amplitude, Inc.: optional app-open analytics, in the United States project, linked to your stable internal account code. Amplitude privacy.
Cloudflare, Inc.: hosting for the game server and database (Cloudflare Workers and D1) and for this website.
Apple Inc.: Sign in with Apple (including revoking access when you delete your account), notification delivery (APNs) and the App Store (purchases).

These providers' servers may be located outside your country. International transfers rely on the contractual safeguards these providers offer.

We may disclose data if required by law or a court order.

6. Tracking, ads and cookies

The app does not track you (we do not use the advertising identifier and never ask for tracking permission), shows no ads and includes the Amplitude SDK only for the optional analytics described above. The SDK device ID stays in memory, but your stable account user_id is reused after restarting; the account identifies the player. We do not use IP addresses for analytics or geolocation; the address passes through the provider to deliver the connection. Replay, autocapture and advertising are disabled. This website uses no cookies and no analytics tools.

7. How long we keep data

Account, tower, each day's result (revenue and balance) and purchases: for as long as the account exists.
Actions of each confirmed day: 90 days. Records of rejected days or days that did not match the server: 30 days.
Our own account-linked usage events: 13 months. Optional Amplitude events are linked to your stable account code and remain in the project until deleted; this integration does not configure an automatic retention period for active accounts. Turning analytics off stops new sends without deleting existing history.
Dates of the daily notifications sent: 30 days.
Name reports: for as long as both the reporting account and the reported company exist. Name changes made by moderation (old and new name): 90 days.
Login tokens: deleted 7 days after they expire. Usage counters and the IP-derived code: deleted within 3 hours.
A guest company that closes no day within 72 hours: it is closed and the lot returns to the city (see the Terms).
Server technical logs (with request metadata that may include your IP address): up to 7 days, at the hosting provider.
Notification tokens: deleted when you delete your account or when Apple reports the token is no longer valid.
Amplitude deletion requests are retained until provider confirmation; receipts and operational records are deleted 90 days after completion.
After account deletion: see section 8.

8. Deleting your account

Deleting your account also stops optional analytics on this device. The server durably queues deletion of identified Amplitude data, including IDs of guests merged into the account, and submits it from the hourly job with retries after failures. Amplitude schedules the deletion and reports completion; this can take up to 30 days after receiving the request. Older profiles from versions through 1006 had no account code and cannot be linked retroactively to a person.

In the app: Settings (gear icon) → Delete account. It works for guest accounts too. When you confirm:

Immediately, we ask Apple to revoke the game's access to your Apple account (if that fails, we retry for up to 24 hours) and we delete the link to your Apple account, your notification tokens, your purchase records, our own usage events (including those of a guest account that was merged into yours), the reports you made and all sessions; your tower leaves the skyline and the ranking.
Within 7 days, the company state, the day history and the moderation records about your company's name (reports received and name changes) are deleted and your lot becomes free again in the city.
We keep only a minimal record, for security and audit purposes: the internal account code with its creation and deletion dates the record of daily notifications from the last 30 days and provider-deletion receipts for the period in section 7.

If you can no longer open the app, ask for deletion at privacy@cornerofficegame.dev.

9. Your rights

You can ask us to confirm whether we process your data, and to give you access to it, correct it, anonymise, restrict or delete it, port it, tell you who we share it with, review automated decisions, and withdraw consent. Email privacy@cornerofficegame.dev (include the account code shown in Settings). We reply within 15 days. Depending on where you live (for example Brazil's LGPD, the EU/UK GDPR or US state laws) you may also complain to your data protection authority.

10. Children

The applicable age rating is shown on the App Store. The game has no chat, ads or gambling; it includes player-created company names and rankings. We do not knowingly collect more data from children than described here. Because the company name is public in the city, parents and guardians should tell children not to use real names. If you are a parent or guardian and believe a child has sent us personal data, email us and we will delete it.

11. Security

All communication uses HTTPS. Sessions use signed, revocable tokens, purchases are checked against Apple's signature and database access is restricted.

12. Changes to this policy

If we change this policy we will publish the new version on this website with an updated date and, where possible, also let you know in the app (or by notification).

13. Contact

Privacy: privacy@cornerofficegame.dev · Support: support@cornerofficegame.dev

The Portuguese version at cornerofficegame.dev/privacidade is the reference text; this English version is provided for convenience.