Privacy Policy

Cosca collects as little as it can get away with. This page says exactly what that is, in the order that matters.

What we collect

To give you an account

• Your email address — to sign you in and to reach you about your account. It is never shown to other players.
• Your chosen name — public, and visible to everyone.
• Whether you are over 13 — and only that. You enter a date of birth at signup so we can check it; the date itself is never stored. All that is kept is one true/false value. We designed it this way on purpose: an age gate does not require us to hold a database of children's birthdays.

Because you played

• Your character: rank, stats, money, items, family, property, and the rest of the game state.
• A record of every movement of in-game currency. The game's economy is auditable by design — it is how duplication bugs get caught and how support settles disputes about who took what from a family bank.
• What you write in chat and in letters, and reports filed about it.
• Roughly when you were last online, so other players can see who is around.

If you buy something

Payments are handled by Stripe. Your card number never reaches us — we never see it and never store it. We keep a record that a purchase happened, what it was for, and Stripe's reference for it.

What we do not collect

• Your date of birth (only the over-13 answer).
• Your real name, address, or phone number.
• Card or bank details.
• Anything from third-party trackers or advertising networks. There are no ad networks in Cosca and no data is sold or shared for advertising — there is nothing to sell.

Cookies

The only cookies Cosca sets are the ones that keep you signed in. There are no advertising or cross-site tracking cookies, which is why there is no consent banner asking you to accept any.

Who sees it

Other players see your public profile: your name, rank, whether you are in jail or hospital, when you joined, and a broad band for your wealth rather than a figure. They never see your email, your battle stats, or your exact cash.

We share data with exactly three kinds of company, all of them suppliers:

• Supabase — hosts the database and handles sign-in.
• Vercel and Cloudflare — serve the site.
• Stripe — takes payments.

Beyond that, we disclose data only if the law actually requires it. Nobody buys it.

Your rights

Wherever you live, you can ask for a copy of your data, ask for it to be corrected, or delete your account. If you are in the UK, EU, or EEA, the GDPR gives you those rights explicitly, along with the right to object to processing and to complain to your data protection authority.

Deleting your account

Deletion removes your email, your name, your character, and your inventory. It cannot be undone.

One thing survives, and it is worth understanding why: the financial ledger keeps its rows, with your identity stripped out of them. Every currency movement in the game is recorded permanently and cannot be edited — that is what makes it possible to prove the economy has not been cheated. When you delete your account, the link between you and those rows is severed: the amounts stay, and nothing points at you. What is left is arithmetic about a person who no longer exists in our records.

How long we keep things

• Account and character data: until you delete the account.
• Chat and letters: retained while the account exists, and de-identified when it is deleted.
• Moderation records: kept while they are relevant to enforcement, because a suspension history that vanishes is a suspension that can be evaded.
• Purchase records: kept as long as tax and accounting rules require.
• Pictures you uploaded: deleted with the account — the files themselves, not just the records pointing at them.
• Anonymized ledger entries: permanently, as above.

Both rights are self-serve: your settings page has a button that downloads a copy of your data, and one that deletes the account.

Children

Cosca is for players 13 and over. We do not knowingly hold data from anyone younger. If a child under 13 has created an account, write to privacy@coscamafia.com and it will be removed.

Where the data lives

Servers are in the United States. If you are outside the US, using Cosca means your data is processed there.

Contact

privacy@coscamafia.com, or the in-game help desk.