Trust & Security

← Home

This page is maintained by the Market Crash team to answer common security and privacy questions about the game. It is app-owned content and not an independent certification or audit report.

What Market Crash is

Market Crash is a digital board game where 2–10 players trade fictional assets, play action cards, and compete for the highest net worth. It is built for entertainment only and does not provide financial or investment advice.

Authentication & access

No mandatory sign-up

You can play as a guest with just a display name. No email or password is required unless you choose to sign in with Google.

Google sign-in

Optional. We only request basic profile info (name and email) through standard OAuth. We do not access your contacts, calendar, or other Google data.

Session security

Sessions are managed via secure HTTP-only cookies. We do not store passwords in plain text. Password accounts (if enabled) are checked against known breached password databases during sign-up and password changes.

Platform & hosting

Market Crash runs on a managed cloud platform (Lovable Cloud) backed by a Postgres database with Row Level Security (RLS) enabled. The platform provider handles infrastructure patching, TLS termination, and physical security. The Market Crash team is responsible for application logic, access controls, and data handling policies described on this page.

Data we collect

Game state

Room codes, player moves, holdings, and event history are stored so the game can function across multiple browsers and players.

Anonymous stats

A random device ID cookie (optional) tracks games played, wins, and highest net worth on this browser. No name or email is attached. See the Cookies & privacy page for details.

What we do not collect

We do not request real names, phone numbers, addresses, payment info, or government IDs. We do not use advertising cookies or tracking pixels.

Security controls

Row Level Security (RLS)

Database rows are protected by policies so players can only read and write data they are allowed to access. For example, you cannot see another player's hidden cards or manipulate a game room you are not in.

Server-side enforcement

Sensitive game actions (trades, card plays, chat) are validated on the server. Room membership is checked before any action is accepted.

Private game data

Hidden information such as player hands and upcoming events are stored in restricted columns that are only readable by the server and the owning player.

Leaked password protection

When creating a password-based account, the password is checked against public breach databases. Common or previously leaked passwords are rejected.

Your choices

You can review and change your cookie preferences at any time:

Turning off functional cookies stops tracking anonymous stats on this device. Existing game history remains on the server but is no longer linked to your browser.

Vulnerability reporting

If you discover a security issue in Market Crash, please contact the team with enough detail to reproduce it. We treat reports seriously and aim to respond promptly.