Privacy Policy

Summary

• An Interurban account is optional. The game runs without one. You need one to buy Mac or Windows on this site, and for the features that attach to it (cloud saves, career, a profile, friends, ratings).
• We collect account identifiers, purchase records, a short attribution survey before direct checkout, game-progress data you choose to sync, consent timestamps, and limited first-party site pulse. The game itself sends nothing.
• We do not sell personal data, do not run an advertising network, and do not share account lists for someone else’s marketing.
• Processors: Cloudflare, Google (if you use Google sign-in), Square (if you buy Mac or Windows here), Valve / Steam (if you buy on Steam), and Resend (mail).
• You can access, correct, export, and delete your account. Marketing mail is off unless you opt in.
• The Services are intended for users aged 16 and older.

Contents

1. Who decides how data is used
2. What this policy covers
3. The account, and when you need one
4. Categories of personal data
5. Why we process it, and on what basis
6. Where the data comes from
7. Cookies and similar technologies
8. Who else sees it
9. International transfers
10. How long we keep it
11. Your rights
12. Notice for California residents
13. Children
14. We do not sell personal data
15. Security
16. Changes
17. Contact

1. Who decides how data is used

Interurban is the game and the site at playinterurban.com. About this project records that there is no studio and no publisher. This policy does not invent a legal-entity name or a street address that is not published on the site. The operator of Interurban is the controller of personal data processed through the Services. Write to hello@playinterurban.com.

The same Cloudflare Worker that serves these pages answers /api/…. Accounts, Square order records, cloud saves, careers, friendships, ratings, attribution surveys, mailed-link tokens, weekly-mail send records, rate-limit counters, and first-party pulse live in Cloudflare D1 (SQLite at the edge). The playable game is a Steam, Mac, or Windows application. Pack URLs left over from an older browser experiment answer 410. There is no hosted browser game.

2. What this policy covers

This policy applies when you:

• visit playinterurban.com (including this page, the storefront, city pages, and checkout);
• create, use, or delete an Interurban account;
• buy the full edition through Square on this site or through Steam;
• sign into that account from inside the Steam, Mac, or Windows application, for cloud saves, a profile, or friends;
• sync cloud saves or a career, use friends or public profiles, leave a rating, or opt into weekly mail;
• write to us at the addresses on this page.

Steam, Square, Google, Cloudflare, and Resend have their own terms and privacy notices for the services they provide. Those notices apply to what those companies do as independent controllers of their own platforms. This policy describes what Interurban decides and what those processors do for us.

3. The account, and when you need one

An Interurban account is optional. The Steam, Mac, and Windows applications run without one: the binary is the licence, and the game never asks you to sign in. You need an account to buy Mac or Windows on this site — Square’s receipt and the installer download land on it — and for the features that attach to it: cloud saves, the career ladder, a public profile, friends, and ratings. The applications offer the same sign-in as this website for those features, and only for those. Creating an account requires agreeing to the Terms of Use and this Privacy Policy. A weekly marketing e-mail is a separate control and is off unless you tick it.

Steam has its own Steam account and receipt if you buy there; a Steam purchase needs no Interurban account. A beta code, when given to a private tester, lands on a signed-in Interurban account.

Two ways in, one account: Continue with Google, or an e-mail and a password. A Google sign-in whose verified address already has a password account signs into that account and links it. A password registration under an address that already signs in with Google is refused.

4. Categories of personal data

Depending on how you use the Services, we may process:

Account and identity

• e-mail address (stored lowercased as the unique key);
• username (3–20 characters; letters, digits, and underscores), as typed and as a lowercased unique key;
• how the account was created (Google or password) and, if linked later, Google’s subject identifier;
• whether the e-mail is verified;
• a password hash only (PBKDF2-HMAC-SHA256 with a random salt) — never the password itself, and the hash is never sent back to the browser;
• session epoch (bumped by “sign out everywhere”, a password change, a mailed reset, or linking Google onto an unproven password account);
• timestamps: created, last sign-in, username last changed, terms accepted, privacy accepted, marketing opt-in;
• if you opt into the weekly e-mail, which week’s message was sent to you, so each goes out once.

Edition and purchase

• tier (free or full);
• for a direct Square purchase: Square payment id, order id, and purchase time — not the card number, and not the full PAN;
• while a direct checkout is open, and for sixty days after it: a Square order id matched to your account, so the payment is recognised when Square reports it;
• cities opened as a free weekly assignment, so a save there stays loadable after the week rolls over;
• an attribution survey before direct checkout (where you heard of Interurban; optionally what you play now).

Game progress you sync

• cloud save files (the SaveFile for a slot, at most about 1.9 MB) and a short index line (city, label, day, year, seed, size);
• the merged career (runs, counters, honours, highest rank);
• friendships as pairs of account ids and a status (pending, accepted, or blocked);
• an optional rating after a full-edition grant (stars and a short comment). The public ratings endpoint returns an average and a count; comments are not listed.

Site pulse

• path, event kind (view, scroll-depth bucket, click on an <a href>, leave), dwell time, coarse phone-or-desk mark, referrer hostname, captured utm_source / utm_campaign;
• a tab id in sessionStorage and a visitor id in localStorage. Pulse does not set a cookie and is not keyed to the account row.

Security and operations

• short-lived rate-limit counters keyed by e-mail and by IP (sign-in, registration, reset mail, username checks, checkout). Closed windows expire. An IP is not stored on the account row;
• single-use mailed-link identifiers (jti) for verification, password reset, and e-mail change;
• the contents of messages you send to hello@ or press@.

We do not ask for government ID, date of birth, payment-card PAN, precise GPS, biometric templates, or special-category data as those terms are used in the GDPR. Do not put those in a username, a rating comment, or a support mail unless you intend us to see them.

5. Why we process it, and on what basis

Where a European or UK data-protection law applies, we rely on the following grounds. Elsewhere, the same purposes describe why the product holds the data.

To perform the contract (the Terms of Use)

• create and authenticate the account;
• sign you in, on this site or from inside the Steam, Mac, and Windows applications, when you choose to;
• grant the free or full edition, including a beta-code grant when one is offered;
• take a Square payment and match it to the account;
• store and return cloud saves and career;
• operate friends, public profiles, and ratings;
• send transactional mail (verification, password reset, address change);
• enforce the Terms, including rate limits and session invalidation.

Legitimate interests

• keep the Services secure (rate limits, session epoch, CSRF origin checks, webhook signatures);
• understand, in aggregate, whether the marketing site is used, via first-party pulse that honours Do Not Track and Global Privacy Control;
• diagnose faults and prevent abuse.

You may object to processing based on legitimate interests by writing to the contact address. We will stop unless we have a compelling ground the law recognises, or the processing is needed to establish, exercise, or defend a claim.

Consent

• weekly marketing mail, off unless you opt in, withdrawable in Settings, via the unsubscribe link, or by writing to us;
• Google sign-in, which you start by pressing Continue with Google (Google then acts under its own notice).

Legal obligation

• keep what tax, accounting, fraud, or law-enforcement rules require of a payment already made;
• respond to a binding demand we are required to obey.

6. Where the data comes from

• You — registration, survey, Settings, ratings, support mail, opt-in;
• your device — the session cookie after sign-in; pulse identifiers in web storage; IP on rate-limit rows; the desktop apps’ local saves and the last cached /api/me;
• Google — a verified e-mail and subject identifier if you complete Google sign-in;
• Square — payment and order identifiers, and a buyer e-mail on some payments, if you check out here;
• Steam / Valve — we do not receive your Steam wallet or card. Steam owns that receipt, and a Steam purchase needs no Interurban account.

7. Cookies and similar technologies

When you sign in, the Worker sets an HttpOnly cookie named iu_session: Secure, SameSite=Lax, Path=/, thirty days. JavaScript cannot read it. Same-origin fetches carry it. The cookie holds a signed user id, the sign-in provider, and the session epoch; the account row is read on each request that needs it.

A short-lived HttpOnly cookie on /api/auth holds the Google OAuth state and PKCE verifier for about ten minutes, then is cleared. Signing out clears iu_session. “Sign out everywhere” (and a password change, a mailed reset, or linking Google onto an unproven password account) bumps the epoch so older cookies stop being sessions.

State-changing POSTs must come from this origin. That is the CSRF protection a SameSite=Lax cookie API needs. The Square webhook is authenticated by its signature instead of a cookie.

Pulse does not set a cookie. It may use sessionStorage and localStorage as described above. If the browser sends Do Not Track or Global Privacy Control, pulse.js sends nothing. Automated browsers are ignored. The game canvas is not watched: pulse does not see play, stations, or anything drawn in the simulation.

Transactional mail has no tracking pixels and no third-party hosts besides the lockup image on this origin.

8. Who else sees it

We share personal data with the service providers that operate the product, and only as needed for the purpose listed:

• Cloudflare, Inc. — hosting, the Worker, D1, TLS, and related edge security for playinterurban.com;
• Google LLC — if you choose Google sign-in (OAuth);
• Block, Inc. (Square) — if you buy Mac or Windows on this site;
• Valve Corporation (Steam) — if you buy or run the Steam build; they hold that store account and receipt;
• Resend — if we send you mail.

We may also disclose data if required by law, to protect a person’s vital interests, or to establish, exercise, or defend legal claims. Instagram and TikTok are public accounts we link to. Clicking those links is a visit to those services, under their policies, not ours.

Public profiles expose username, rank, badges, metros played, and the month the account was created. They never include an e-mail address.

9. International transfers

The Worker and D1 run on Cloudflare’s network. Google, Square, Steam, and Resend may process data in the United States and other countries. Where a European transfer rule applies, we rely on the processor’s published transfer tools (for example the European Commission’s standard contractual clauses, or an adequacy decision) as those processors describe them. Ask hello@playinterurban.com if you need a pointer to a processor’s current notice.

10. How long we keep it

• Account row, saves, career, friends, rating, survey — until you delete the account, or we close it under the Terms, then removed in one transaction as Settings delete does;
• session cookie — thirty days, or until you sign out, or until the epoch is bumped;
• OAuth state cookie — about ten minutes;
• mailed-link token rows — until used or expired (verification and e-mail-change: 24 hours; password reset: 30 minutes);
• rate-limit rows — until the window closes (typically ten minutes, or an hour for verification resend);
• Square order index — ignored after sixty days and swept; pending checkout markers after seven days;
• pulse rows — swept after ninety days; not keyed to the account, so account deletion does not hunt them;
• support mail — as long as needed to handle the request and any legal hold.

Square and Steam keep whatever their own records require for a payment you already made. Deleting the Interurban account does not delete Valve’s receipt or Square’s payment record. We may keep a stub that a payment was already granted so the same payment is not applied to a stranger’s new account.

11. Your rights

Depending on where you live (including the GDPR, UK GDPR, and similar laws), you may have the right to access, rectify, erase, restrict, or object to processing; to withdraw consent; to data portability; and to lodge a complaint with a supervisory authority. We will not discriminate against you for exercising a privacy right the law gives you.

How to use them:

• Access / portability — Settings export (GET /api/profile/export while signed in) returns account fields, the save index, career, and friends by username. The password hash is not included. Cloud save files can be downloaded slot by slot while signed in;
• Rectify — change username (subject to the thirty-day rule after the first free choice), e-mail (with a confirmation link), password, and marketing opt-in in Settings; correct the survey until you pay;
• Erase — Settings delete, or mail us as in § 17. Deletion is one transaction: saves, career, pending and remembered Square orders we indexed, mailed-link tokens, friendships, rating, survey, and the user row. The session cookie is cleared;
• Withdraw marketing consent — Settings, the unsubscribe link, or mail;
• Stop pulse — enable Do Not Track or Global Privacy Control, or block the script; clearing site data removes pulse identifiers.

To verify a request sent by mail, write from the address on the account and name the username if you have one.

12. Notice for California residents

If the California Consumer Privacy Act (as amended, including the CPRA) applies, California residents may request to know, delete, and correct personal information, and to opt out of sale or sharing as those terms are defined in that law. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under that law. We will not discriminate against you for exercising these rights. Use the contact address; if we need to verify you, we will say so.

Categories collected, as this policy describes them: identifiers (e-mail, username, cookie, IP on rate-limit rows, Google subject id); commercial information (tier, Square payment and order ids); internet activity (first-party pulse); and inferences only insofar as a career rank or rating is stored because you played or rated. We collect them for the business purposes in § 5. We disclose identifiers and commercial information to the processors in § 8 so those purposes can run.

13. Children

The Services are intended for users aged 16 and older. We do not knowingly create an account for anyone under 16. Do not register if you are under 16. If we learn that we have collected personal data from someone under 16, we will delete the account unless a law requires us to keep a record of the request. Parents or guardians who believe a child registered should write to hello@playinterurban.com.

14. We do not sell personal data

Interurban does not sell personal data, does not rent it, and does not share it with advertisers. There is no advertising network on this site. Pulse is first-party and is not sold. We do not hand account lists to anyone for marketing of theirs.

15. Security

Passwords are stored as salted PBKDF2 hashes. Session and mailed tokens are signed. Cookies are HttpOnly and Secure (except on local unencrypted development). Account POSTs require a same-site Origin. Square webhooks require Square’s signature. Rate limits bound guessing. No method of transmission or storage is perfectly secure. If we become aware of a breach that the law requires us to notify, we will do so.

The Steam, Mac, and Windows apps keep city packs, saves, and settings on disk the way a local game does. Offline, the last successful account answer is cached on the device for a limited window (thirty days on a full account, seven on a free one, never longer than the server said) so cloud features still know who you are. The city packs ship inside the app and never depend on that cache. It is cleared when the server says the session is gone.

16. Changes

If this policy changes in a way that affects how the product treats personal data, the date at the top of this page will move, and the current text will live at playinterurban.com/privacy.html. Material changes may also be noted by e-mail to an account you gave us or by a notice at sign-in. Creating or continuing an account requires agreeing to the text as it stands at that moment. If you decline a material change we are required to ask you to accept, you may not be able to keep using every service.

Last updated: 9 October 2026.

17. Contact

hello@playinterurban.com for the game, the site, this policy, access, correction, and deletion. press@playinterurban.com for the press kit.

Interurban at playinterurban.com. Related: Terms of Use, get the game, about.