Privacy Policy
Last updated: June 5, 2026
This Privacy Policy explains what information Syberland, operated by Sarahtonin Secure & Technologix ("we", "us", "our"), collects, how we use it, and your choices. It applies to the Syberland website, hub, and game (the "Service").
1. Information we collect
- Account details: your first and last name and email address, provided when you sign up.
- Gameplay data: your progress, scores, and related activity, so we can save and sync your experience.
- Subscription status: whether your trial or subscription is active, and related billing metadata. Your full payment card details are collected and stored by Stripe, not by us.
- Technical data: basic information your browser sends (such as IP address and device or browser type) used to operate and secure the Service.
2. How we use information and our legal bases
We use your information to provide and improve the Service, save and sync your progress, create and manage your account, process subscriptions, send sign-in links and essential service messages, provide support, and keep the Service secure. For users in the EU, UK, and similar jurisdictions, our legal bases under the GDPR are: performance of a contract (to create your account, run the game, and manage your subscription), legitimate interests (to secure, maintain, and improve the Service), consent (where we ask for it), and legal obligation (to keep required billing and tax records).
3. Service providers and sub-processors
We share information only as needed with providers who process data on our behalf under appropriate agreements:
- Supabase (authentication and database for your account and saved progress).
- Stripe (payment processing and subscription management; Stripe collects and stores your payment card details directly).
- Vercel (website and application hosting).
- Anthropic (powers the weekly Signal Chamber). The Chamber is generated from public cybersecurity news, and we do not send your personal information to this service.
4. International data transfers
We operate from the United States, and your information is processed and stored in the United States. If you access the Service from outside the United States, you understand your information will be transferred there. Where required, transfers from the EU, UK, or similar regions rely on appropriate safeguards such as the Standard Contractual Clauses.
5. Cookies and local storage
We use your browser's local storage for strictly functional purposes: to save your progress and keep you signed in. We do not use third-party advertising or cross-site tracking cookies, so no cookie-consent banner is required for these functional purposes.
6. Email
All email we send is transactional: one-click sign-in links and essential account, billing, or service messages. We do not send marketing email and we do not sell your email address.
7. Data retention
We keep your account information while your account is active. When you close your account, your saved data is deleted from our systems. Some records may be retained where required by law, for example billing and tax records held by our payment provider.
8. Your privacy rights
You can access, correct, export, or delete your information. The fastest way is in the app: edit your details, or use "Close account" to permanently delete your account and saved progress. You can also email us at support@sarahtoninsecure.com.
EU/UK (GDPR): you have the rights to access, rectification, erasure, restriction, data portability, and to object to certain processing, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.
California (CCPA/CPRA): you have the rights to know, access, correct, and delete your personal information, and to non-discrimination for exercising them. The categories we collect are identifiers (name, email), internet or other activity (gameplay and technical data), and commercial information (subscription status). We do not sell or share your personal information for cross-context behavioral advertising, so no "Do Not Sell or Share" action is needed. You may submit a request in the app or by email, and we will verify it against your account.
9. Children
The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@sarahtoninsecure.com and we will delete it.
10. Security
We use reasonable safeguards, including encryption in transit and per-user access controls, to protect your data. No method of transmission or storage is completely secure.
11. Controller and contact
The data controller is Sarahtonin Secure & Technologix. For any privacy question or request, contact support@sarahtoninsecure.com. We may update this Policy and will note the "last updated" date above.