Privacy Policy

We deliberately keep this list short.

• Account: name and email address returned by Google when you choose “Continue with Google”.
• Investigation state: the anonymous session id, the case id, what evidence you have opened, what contradictions you have found, notes you write inside the game and the verdict of a completed investigation.
• Feedback: your answers to the optional post-case questionnaire, and up to 500 characters of optional free-text feedback if you choose to leave any.
• Purchase: a Stripe checkout reference, the fact of a completed / failed / refunded transaction, and the entitlement granted. We do not store card numbers, CVCs, or bank data — those are held by Stripe.
• Technical: an internal, aggregate view of latency and error rates. IP addresses are not stored in application logs.

• The words you type when interrogating a suspect, or the AI’s reply, are not stored in our analytics.
• No third-party advertising identifiers.
• No behavioural profile is built for advertising.
• No location data, no microphone / camera, no device fingerprint.

• To run the game (performance of a contract).
• To honour a purchase and provide access on the paying account across devices (performance of a contract).
• To comply with tax and accounting law (legal obligation).
• To keep the service secure, prevent fraud, and diagnose incidents (legitimate interests).

• Stripe — payment processing and tax handling.
• Google — identity provider for sign-in.
• Anthropic — the LLM producing suspect dialogue inside a case. The prompt sent to Anthropic contains a suspect persona and, on confrontation, the contradiction description; it does not contain your identity, your email, or your purchases.

We do not sell or trade personal information.

Investigation and feedback data are retained while your account is active. On deletion request we delete personal identifiers and disassociate historical investigations. Financial records are kept for as long as Belgian tax law requires (typically seven years).

Under the EU General Data Protection Regulation you have rights to access, correct, delete, restrict or object to processing of your personal data, and to receive it in a portable form. To exercise a right, contact privacy@playcasezero.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be).

Some processors (Stripe, Google, Anthropic) may transfer data outside the EEA. We rely on the processors’ published safeguards (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework).

We use a single first-party cookie to keep you signed in. CaseZero does not itself deploy advertising or marketing cookies and does not currently use application-level analytics services such as Google Analytics, Meta Pixel or PostHog.

Our hosting platform, Emergent, sets infrastructure-level cookies on the CaseZero service for anonymous traffic measurement. These currently include __emg_vid, an anonymous visitor identifier used for unique-visitor measurement with an approximate retention period of 12 months, and __emg_sid, an anonymous session identifier used for session counting with an approximately 30-minute rolling duration.

According to Emergent, these cookies do not capture text, form inputs or page content and are not used by CaseZero for advertising or profiling. These cookies are set at Emergent’s network edge and cannot currently be disabled or controlled by CaseZero. We have requested further information from Emergent regarding their classification, legal basis and associated data-processing arrangements.