Privacy policy

Hustle Empire is owned and operated by Gigameets Global Limited, which is the data controller for the data described here. Write to the support address below for any request about your data, and say which account it concerns.

• Guest play: a random display name, opening balance, progress and a session credential stored only as a hash in an HttpOnly cookie. No email, password or social login is required to start.
• Account: the email address you register with, a PBKDF2 password hash (never the password), display name and the same game progress.
• Game state: businesses, inventory, jobs, skills, market listings and orders, community contributions, and every ledger entry that explains a balance.
• Security data: a salted hash of the connection IP and a truncated user-agent hash, used for abuse limits and session forensics; one-time password reset tokens, stored only as hashes; rate-limit counters keyed by a hashed identifier.
• Product telemetry: funnel events such as “guest session created” or “first sale”, plus a short, stack-free message when a page crashes in the browser. These are tied to a player id so the funnel can be measured.

We do not use advertising or third-party tracking scripts. The only cookie set by the game is the session cookie.

One cookie, he_guest_session or session_token, carries your session. It is HttpOnly (JavaScript cannot read it), SameSite=Lax (it is not sent from other sites) and Secure over HTTPS. There is no consent banner because there is nothing to consent to: the cookie is required to sign in, and the only other client-side records are a first-party funnel event with no identifier beyond a player id, and the name of the workspace you last had open, kept in this tab's session storage so signing back in can return you to it. Both stay on your device. If advertising or third-party analytics are ever added, they will be off until you opt in.

To run the game and keep your progress: performance of our agreement with you. To keep accounts and the economy safe from abuse and fraud, and to fix crashes: legitimate interests. To send a password reset email you asked for: that request. We do not sell personal data and we do not use it for advertising.

Our hosting and database providers process the data on our behalf. A transactional email provider receives an address only when a reset was requested. No other third party receives personal data. We will disclose data if the law requires it, and will say so on this page if that happens in a way that affects players generally.

Account and game data are kept while the account exists. Guest rows and their expired sessions are cleaned up periodically. Password reset tokens expire in 30 minutes and are single use. Rate-limit counters expire within their window. Funnel events are kept for product analysis and are anonymised when an account is deleted. A record of a real-money purchase (and its payment-provider events) is kept for seven years after the purchase, because accounting and tax rules require it: deleting an account removes the link to you and the email used at checkout, and nothing else about you is kept. That record is what support and refunds use if a payment is disputed after the account is closed.

From the account page you can download a JSON copy of everything stored about you, and delete the account permanently. Deletion removes every table that belongs to the player, except the anonymised purchase record described above. If you cannot sign in, write to [email protected] and we will verify ownership before acting.

Depending on where you live you may also have the right to correct data, restrict processing, object, or complain to a supervisory authority. Contact us first; we will respond within 30 days.

Accounts are for people aged 13 and over. We do not knowingly collect personal data from children below that age. If you believe a child has registered, contact us and we will remove the account.

Passwords are hashed with PBKDF2-SHA256 and per-password salts. Session credentials are random 256-bit values stored only as SHA-256 hashes. Traffic is served over HTTPS in production. No system is perfect; if we become aware of a breach affecting your data we will notify affected players and the relevant authority as required.