Privacy

The short version

Waybill is one studio running a railroad game. We keep what the game needs to be your game and nothing else, and there is no third party being paid in your data here, because there is no third party.

What we keep

• Your email address and the name on your account.
• Your password, hashed. We store an Argon2 hash and never the password itself, and we could not tell you what yours is.
• Session tokens, so a browser stays signed in, and seat tokens, which are what let a browser act as one of your railroads.
• The worlds and railroads you play: the game state, and the journals that record what happened in them.
• A record of the railroads you have run in the public worlds: which world, which railroad, how you joined it, and a yearly note of the figures that world’s standings already show everyone — what the road was worth, its cash, its stations. It is kept after the railroad ends, because a history you cannot look back on is not a history. Nothing private is in it: every figure was already on the board.
• Your notification preferences — the two mail switches at the bottom of your shelf.
• Purchase records: Stripe’s identifiers, what was bought, and when. Never card numbers. Card details go to Stripe and never reach Waybill’s servers at all.
• Support and admin audit records — a log of what an operator did to an account or a world, which redacts password hashes and every kind of token before it writes anything down.

What other players see

The public worlds are public. Everything a world’s Standings board already shows everybody — your railroads’ names, where they stand, what they are worth — is visible to the other people playing in that world, and always has been.

The record described above gathers that across worlds, and it is shown the same way: the Records page, which anyone can read without an account, lists the railroads you have run in the ranked public worlds under the display name on your account, with how each one stood and what it was worth over time. Your email address is not on it and neither is anything private — every figure on that page was already on a board that somebody else could read. Deleting your account takes the record with it, and you come off the page.

Where it lives

• AWS, in the United States. The game runs in the us-east-2 region.
• Stripe, for payments and for the subscription portal.
• Amazon SES, in us-east-1, for mail. It is sent from dispatch@waybillgame.com.
• Discord, only if the studio has its dispatch feed switched on. It posts world events to a studio channel; no email address, password or token is ever part of that feed.

What this browser keeps

Waybill uses no cookies. It keeps a little state in this browser’s local storage: your session token and account, the seat token for each game, which game you were last in, a random visitor id explained just below, and a handful of preferences — theme, sound, the surveyor’s tips you have seen, the terrain and alignment toggles, the art style, and which tables you had folded. The preferences never leave the browser at all. The session and seat tokens go to our server, which is what they are for.

The first time this browser visits, the site records that visit once: where the link came from, reduced to the page’s address with anything after it dropped; which page you landed on, without its query; and any campaign tag the link carried, which is how we tell which announcement found you. It is kept against the random visitor id and nothing else — no cookie, no third party, and no record of your address, which is only ever used to count requests and only ever stored scrambled. We keep it for 90 days. If you make an account, that one record is attached to it, so we can tell which announcements found players. Nothing after that first visit is recorded, and the id is never sent again.

There is no third-party analytics, no advertising tracker and no error-reporting service in this client. Nothing on these pages reports you to anybody.

Mail

Two kinds, and only two. Transactional mail — verifying an address, resetting a password, and what the till sends — and the notification mail you asked for.

Every notification mail carries its own unsubscribe link: open it, confirm, and that category is off. The link can only ever turn mail OFF, never back on, so a link that leaks does no harm.

We do not send marketing mail, and we would ask first if that ever changed.

Deleting your account

You can do it yourself, at any time: open your account page and use “Leave Waybill”. It asks for your password — or, for an account that never had one, for you to type the word DELETE — and then it happens at once. You do not have to ask us and you do not have to give a reason.

Deleting your account removes your email, password, sessions, preferences and the record of the railroads you have run. Railroads you hold in shared worlds are handed to the machine under a new name so the worlds and their records stay whole; they are not deleted. An active subscription is cancelled at once, so nothing more is charged — and if that leaves paid-for time you never used, email support@waybillgame.com and we will refund it. Purchase records stay with Stripe, the merchant of record. This cannot be undone.

If you would rather not do it yourself, email us at support@waybillgame.com — or write to the postal address on the Terms page, under “Law, and reaching us” — and we will do it by hand within 30 days.

Two things outlive the account, and both on purpose. The first is the worlds you played in, which are other people’s games as well as yours. They are kept: each railroad of yours runs on under a name out of the machine’s own pool, owned on the register by a machine-named owner, and the records already written — the journals, the news, the books — name railroads and never accounts. What does not change is the world itself. A world you made keeps the name and the settings you chose for it, because they are the world’s now and everyone else is still playing in them. The second is our own record that an account was deleted, which is dated and says how many railroads changed hands, and which never carries your email address.

Children

No accounts for anyone under 13.

How this game was made

The studio publishes a statement about where AI was used in building Waybill. You can read it in full at the bottom of your shelf, under “How this game was made”.

The part of it that belongs on this page: the shipped game contains no AI at runtime. Nothing reads your account, your mail or your worlds to train anything, and the computer-controlled railroads are hand-written rules.