Privacy notice

• Your email address, for signing in, and to send it its confirmation code and, when you ask for one, a password reset link.
• Your password, hashed with the scrypt algorithm rather than stored as you typed it, so that no one can read it back.
• The date you registered, the time you last signed in, and the date your account was suspended, if the platform administrator suspended it.
• Sign-in sessions: a hashed fingerprint of each session's token, its expiry date and the time it was revoked. No IP address or browser type is kept with them.
• Password reset links and email confirmation codes: a hashed fingerprint of the link or code, the email it was created for, its expiry date and the time it was used.
• Attempt counters, to protect sign-in and registration from guessing and flooding: a fingerprint of the IP address and of the email, hashed with a secret key, with the number of attempts. Each account also has usage counters (conversations, ending the day, uploads and others) that carry the account's identifier, not its email.
• Game data: the name you chose for yourself, how you are addressed, your company's name, your tasks, answers, memos and decisions and their assessments, your messages in conversations with the characters, the weekly reviews and their quizzes, and your progress.
• Totals of your AI usage: for each request, its type, the model, the number of tokens and the estimated cost, to calculate the monthly allowance. They contain no text.

Excel files you upload in tasks are read in the server's memory to fill in the answers, and are not kept.

• No other player sees any of your data.
• In the administration panel, the platform administrator sees your email, the date you registered, your last sign-in, the number of your active sessions, whether the account is suspended, whether it has an outstanding reset link, your company's name and level, your role, the workday you have reached, and your AI usage totals for this month. The administration panel does not show your answers, memos or conversations.
• Whoever runs the server has technical access to the whole database, to operate and maintain the site.
• Your data is not sold, and it is not given to anyone other than the service providers listed in the next section.

• Vercel: hosts the site. Every request passes through it, and it keeps technical logs of them (including the IP address) under its own policy.
• Turso: the database in which all of the data above is kept.
• SNDR: the email provider that sends the confirmation code and the password reset link. It receives only your email address and the text of the message.
• Anthropic: the AI provider (Claude). What is sent to it is set out in the next section.

The servers of these providers may be located outside the Kingdom of Saudi Arabia.

Only while the AI is working, what is needed to write the messages and assess the memos is sent:

• The text of the tasks you receive, and the fictional company figures they need.
• Your memos, answers and decisions, to assess the memo and write the character's reply.
• Your messages in conversations with the characters, with the context of the task you are discussing.
• A summary of your performance, when you request the weekly review or the wording of the experience portfolio.
• The name you chose for yourself, how you are addressed, and your virtual company's name.

Your email address and your password are never sent.

In demo mode, or once the allowance is used up, nothing is sent. The figures and the objective assessment are the same in either case.

• No advertising, no analytics or tracking tools, and no third-party scripts on the pages.
• The font is served from the site's own servers, so your browser does not connect to an external font service.

This is everything the site places in your browser, and no third party places anything in it.

• cfo_session

  Type

  An essential cookie, HttpOnly so that scripts on the page cannot read it, and sent only over HTTPS on the published site

  Purpose

  Keeps you signed in. It carries a random token, its expiry date and a signature, and does not carry your email or your name.

  Duration

  30 days from signing in, or until you sign out.

• cfo_lang

  Type

  An essential cookie, HttpOnly so that scripts on the page cannot read it, and sent only over HTTPS on the published site

  Purpose

  Keeps the language you chose for the site: Arabic or English. It carries no data about you.

  Duration

  One year from the last time you chose a language.

• theme

  Type

  Local storage in the browser (localStorage)

  Purpose

  Saves your choice of appearance: light, dark or the device's setting. It is not sent to the server.

  Duration

  Until you clear it from your browser.

• cookie-notice-dismissed

  Type

  Local storage in the browser (localStorage)

  Purpose

  Remembers that you closed the cookie notice, so that it does not appear again. It is not sent to the server.

  Duration

  Until you clear it from your browser.

The session and language cookies are needed to sign you in and to show the site in the language you chose, and the other two keys save choices you made yourself, so none of them requires consent. The notice at the bottom of the page is for information only.

• Your data is kept for as long as your account exists, until you delete it.
• Expired sessions are deleted, revoked sessions a week after they were revoked, and reset links a week after they expired. This clean-up runs at every sign-in or registration.
• Attempt counters expire within one day at most, and expired counters are deleted at the next attempt on the site to sign in, register or set a password.
• AI usage totals remain after the account is deleted, with no link to you, because they count towards the platform's spending for the month.

• You can see your data on the site itself, and change your name and your company's name in the settings.
• You can delete your account from the settings, by entering your password and typing the confirmation word the page asks for: your company and all of its data, your sessions, links and counters, and your account are deleted in one step, and you are signed out on every device.
• If you cannot sign in, ask the platform administrator to delete your account, or to give you a link to set a new password so that you can then delete it yourself.

The site is run by the platform administrator.

No contact email is published. You can reach them through the person who shared the link to the site with you.

The site is for people aged 18 or older, and you are asked to confirm this when you register.

The site sends only two kinds of message to your email, and only when needed: the confirmation code when you register, and a password reset link when you ask for one. There is no mailing list and no marketing email, so there is nothing to unsubscribe from. The messages in the game's "Inbox" are fictional and appear only on the site.

The date of the last update at the top of the page changes with every revision. The terms that govern the use of the site are set out in the terms of use.