Privacy Policy

Summary

• We use Google Sign-In. If you log in, we use your Google account ID, name, profile picture, and email verification status. Google’s sign-in credential may contain your email address, but our application does not read or retain it.
• We record game activity and count preview opens and successful copies to measure use.
• We use cookies to keep you logged in and to remember basic preferences. A consent banner only appears where required by law.
• We do not sell your data. The only thing we sell is imaginary power in the form of votes.
• You can ask us to delete your account and related data. See Contact & Rights below.

What we collect and why

We collect data to run, protect and improve the game.

• Account data (via Google Sign-In): Google subject ID, name, profile image URL, and whether your email is verified. We use this to identify you, show your avatar, and reduce sockpuppetry. Google’s sign-in credential may contain your email address, but our application does not read or retain it.
• Game data: Your vote balance and transactions, board votes, placeholder option votes, overlay votes, overlay positions you set, and any proposals or comments you create.
• Payment records: Order identifiers, account references, package amounts, processor transaction identifiers, confirmation status, refunds, disputes, and vote adjustments. We use these to deliver purchases, prevent duplicate credits, and resolve payment problems. Our server does not receive full card numbers or security codes.
• Moderation data: When you post a comment, the comment text may be analyzed by Google’s Perspective API to help keep things civil. We store the result (scores/flags) so your comment can be shown or hidden appropriately.
• Basic logs: Server logs include request URLs, IP addresses, browser details and timestamps. Game events may reference an account. We use these for reliability, abuse prevention, debugging and aggregate marketing reports.
• Play counts: Opening a phrase preview or successfully copying a joke sends the action and any valid campaign tags to our server, once per action per page load. This sends no joke text, selected politician, referral ID or cookies, and creates no tracking identifier. Ordinary server logs still apply. These requests respect Global Privacy Control and Do Not Track.

Cookies and local storage

• auth (cookie): A session token so you stay logged in. It is httpOnly and set to SameSite=Lax. Required for the site to work.
• Session/local storage: We store UI preferences and checkout identifiers used to resume a purchase safely after a retry. These identifiers do not contain your card details.
• Consent banner: Where legally required, we show a cookie notice. Clicking “yes” means “yes, please let me log in like a normal website.”

Third-party services

• Google Identity Services: Used for sign-in. When you log in, Google tells us who you are (see Account data above).
• Google Perspective API: We send comment text for automated moderation scoring. This helps separate spicy opinions from flamethrowers.
• Stripe: When card checkout is available and you choose it, Stripe collects and processes your payment and billing information. We send the package price and an order reference, and receive payment-status information. See Stripe’s privacy policy.

Cryptocurrency payments are recorded on public blockchain networks. Transaction details may be visible to others and cannot be deleted from the blockchain by us.

Where we store data

Our servers and databases are hosted in the United States. By using the site, you understand that your data may be processed in the U.S. and potentially other regions used by our cloud providers.

How long we keep data

We retain account and gameplay data for as long as your account exists or as long as necessary to operate the service. Logs and moderation artifacts may be kept for a reasonable period to troubleshoot issues and defend the service from abuse.

Payment and vote-transaction records may remain after profile deletion for accounting, refunds, disputes, fraud prevention, and legal obligations. Deleting your site profile does not delete records held independently by a payment processor.

Do we sell your data?

No. We do not sell your personal data. We do sell an entertaining simulation of influence in the form of “votes,” which—tragically—do not work in real life.

Delete your personal data

You can delete the personal data associated with your account at any time. This will:

• Remove your profile details (name and avatar) and replace your display name with “Deleted User”.
• Delete your comments by converting them to empty, non‑public stubs so conversation threads don’t implode.
• Retain votes, submissions, and transaction records needed to preserve the game and account for purchases. Your public profile is anonymized; this does not erase all internal account references.

To delete your personal data, click here

This action is permanent and cannot be undone.

Contact & requests

Questions: hello@worstinworld.com. For payment questions, see purchases, refunds and support.

Changes to this policy

We may update this policy as the site evolves. If we do, we’ll change the “Last updated” date and post the new version here. Probably you won't notice when this policy becomes totally evil.