1. Who we are
StormRush is operated from Chicago, Illinois. For anything in this policy, contact robert.marquardt@r-marq.com. The operating legal entity will be identified here in the final policy.
2. What we collect today (pre-launch)
Right now this site is a preview. The only personal data we handle is:
- Waitlist email — if you join the launch lobby, we store the email you give us, your chosen role (player / business / both), and an optional neighborhood. We use it to send storm warnings and occasional build updates, nothing else, and every message includes an unsubscribe link.
- Analytics — see Section 8.
Everything below describes how the game will work when it launches.
3. Guest-first identity
You don't need an email or a real name to play. A StormRush account starts as a guest identity: a random identifier stored in a cookie on your device, plus the username you pick. That's the whole account. If you later choose to sign in, your guest history is linked to the sign-in so nothing is lost — but signing in stays optional, and we ask for the minimum the feature needs. We never require your real name, phone number, or address to play.
4. Location data — the rules we hold ourselves to
- Collected only during live challenges. Your GPS position is read from the moment you join a challenge until the storm closes and the survivor window ends, and it's used for gameplay only: your position on the map, storm damage, the movement rules, and arrival verification. The app does not track you in the background, between challenges, or while you're just browsing.
- Deleted after 30 days. Match location traces are deleted 30 days after the challenge. They are kept that long only so in-app support can resolve disputes about a game against the actual record.
- Never sold, never shared for advertising. Your movement data is not a product. Hosts never receive it; advertisers never receive it; data brokers never receive it.
5. Scan records and what hosts see
When your barcode is scanned at a host's counter, we keep the scan record — code, timestamp, verdict, which challenge, and a first-time-visitor flag — beyond the 30-day window, because scan records are how hosts are billed and how prize disputes are settled. A scan record is an event at a counter, not a movement trace.
What the hosting business sees: counts and flags, not identities. Their scan report shows how many arrivals were scanned, when, and which were first-time visitors; the verdict screen shows your username. Hosts never receive your real name, contact details, or location history from us.
6. We do not sell your personal data
We do not sell personal data, and we do not share it with third parties for cross-context behavioral advertising. We share data only with service providers who process it for us (hosting, email delivery) under contract, or when the law genuinely requires it.
7. Cookies
We use a small number of first-party cookies: the guest-identity cookie described in Section 3 (httponly, so scripts can't read it) and, if you sign in, a session cookie. We don't use third-party advertising cookies.
8. Analytics
Our pages load a lightweight, first-party analytics script (/scripts/analytics.js) so we can see which pages are visited and whether the product is growing. It's our own script on our own domain, not an ad network's tracker, and its data is not joined to your game identity for advertising.
9. Data retention, summarized
- Match location traces: 30 days after the challenge, then deleted.
- Scan records: kept for billing and dispute history.
- Waitlist email: until you unsubscribe or ask us to delete it.
- Guest/game account: until you delete it or ask us to.
10. Your rights
Whoever you are and wherever you live, you can email robert.marquardt@r-marq.com to access, correct, or delete the data we hold about you, or to ask what we have. We don't discriminate against anyone for exercising these rights.
California residents (CCPA/CPRA): you have the rights to know, delete, correct, and opt out of sale or sharing. As stated in Section 6, we do not sell or share personal data as those terms are defined in the CCPA, so there is nothing to opt out of — but the request channel above works all the same.
11. Age
StormRush is for adults 18 and older. We do not knowingly collect personal information from anyone under 18; if we learn we have, we delete it and close the account.
12. Changes to this policy
When this draft becomes the real policy, it will be dated, and material changes after that will be announced through the Service before they take effect. We will not weaken the commitments in Section 4 retroactively — data collected under a promise stays under that promise.
13. Contact
Privacy questions and requests: robert.marquardt@r-marq.com.