Countermove: the business strategy game

Who is responsible

The controller for personal data processed through Countermove (the “data fiduciary” under India's DPDP Act) is J. Nair, an individual based in Switzerland (contact: hello@playcountermove.ai). That address is also our contact for privacy questions, requests and grievances. We answer within one month (sooner where a local law sets a shorter time).

In short: we collect as little as we can, we never sell your personal data or share it for cross-context behavioural advertising, there are no ads, and nothing is used to profile you.

What stays on your device

Your saved games (company name, brand name, the decisions you made, including fine-tuned levers, creative choices and any lift tests you booked, your scores, the Advisor fees charged and the news items used in that game) are kept in your browser's local storage under the keys arena.v1.games and arena.v1.current. They stay in your browser unless you ask the Advisor, join a class, a match or Today's challenge, or post to the Countermove Index, as described below. Clearing your browser's site data, or deleting a game from the Games menu, removes them for good. We cannot recover them for you.

Your streak and personal bests (days you played Today's challenge, years played, best grade, best Index alpha and the ids of years you posted) are kept in your browser only, under arena.v1.progress, and the team, school or company you add, if any, under arena.v1.group. Neither is sent anywhere on its own. Which optimiser answers you have paid for in this session is kept under arena.v1.optimiser in session storage, so you are not charged twice; it is cleared when you close the tab.

The war room (plan against plan, in the game and at /wargame), the optimiser, the risk view and the econometrician all run in your browser. The plans you compare are not sent anywhere; in a game, only the Advisor fee for each run is saved, with the game.

What leaves your device, and why

Data	When	Purpose and legal basis	Kept for
Your question to the Advisor, plus a summary of your game (figures, decisions, company name)	Only when you ask the Advisor and live AI is switched on	To generate the answer, through the AI provider in use (Groq, Vercel AI Gateway or OpenRouter) and the model provider it routes to. Legitimate interest in providing the feature you asked for (Art. 6(1)(f)).	Not stored by us. Providers process it under their own terms and may keep it briefly for abuse monitoring; some providers of free models may also use it to improve their models. Groq does not keep it by default (at most 30 days if it investigates abuse or a fault).
The game state sent to rewrite colleagues' lines	When live AI is on	Same as above. Numbers are checked so the AI cannot change them.	Not stored by us.
Your IP address	Every request	Rate limiting and security (Art. 6(1)(f)). Counted in Upstash Redis. Your IP address is never stored there: each counter is named after a one-way hash of it (SHA-256, keyed with a server secret), plus the limit and, for some limits, the class or match code. IPv6 addresses are counted per network (/64).	Counters last 15 minutes to a day, depending on the limit, and expire within 48 hours at most. Cloudflare, our host, keeps error logs for up to 7 days; it keeps no log of each page you open, and query strings are removed from any address it logs.
Class results and live progress (only if you join a class): display name, brand, seat, how far you are in the year, when you were last active, your result and, if you take the learning quiz, your quiz scores	When you join, as you play each quarter, and when you finish the year	To rank the class and show the teacher who is where. Legitimate interest of the school running the class, and yours in taking part (Art. 6(1)(f)).	Up to 120 days.
Today's challenge results (only if you post one): display name, brand, seat, result (score, grade, share, net income, price), the time you posted and a random id for your browser	When you press Post	To rank the day's board (Art. 6(1)(f)).	8 days, then deleted.
Your group: a team, school or company name (only if you add one)	After you post to Today's challenge or the Countermove Index, sent with that result	To show group boards: the average and best result of each group with at least three players. A group is never shown next to a display name, and groups with fewer than three players are not shown at all (Art. 6(1)(f)). Names pass the same filter as class names.	As long as the result it is attached to: 8 days (daily) or 400 days (Index).
Your email address (only if the digest is switched on and you sign up)	When you sign up on the daily challenge page	To send a confirmation email and, once you confirm, a weekly digest. Your consent (Art. 6(1)(a)); see “The email digest” below.	Unconfirmed: 7 days. Confirmed: until you unsubscribe, which deletes it.
Team match data (only if your team joins a match): team name, brand name and each quarter's decisions and results	When the team joins and as it locks each quarter	To run the match and show results to the host and the teams (Art. 6(1)(f)).	30 days, then deleted.
Feedback notes (only if you send one): your answers, the page you sent it from (as a path, without codes or ids) and, if you type one, your email address	When you press “Send feedback”	To improve Countermove, and to reply if you gave an email address. Legitimate interest (Art. 6(1)(f)); the email is optional and used for nothing else. No IP address, account or game id is kept with the note.	400 days, then deleted. Ask us at any time to delete a note sooner.
Countermove Index listings (only if you post a year)	When you press “Post my year” on the year-end screen. Nothing is posted unless you do.	To show your year on the public board, or on your edition's private board. Your consent, given by posting (Art. 6(1)(a)); see “The Countermove Index” below.	400 days, then deleted. A board keeps only its top 1,000 years.
Anonymous usage counts	Page views and a few game events (a game or daily challenge started, Q1 and later quarters locked, a year finished, a class or match created or joined, a daily result or Index year posted, a share button pressed, a digest sign-up, a lesson completed, the certificate passed)	To see which screens work and where players stop (Art. 6(1)(f)). PostHog (EU cloud, cookieless mode): no cookies, nothing stored on your device, no names, groups, email addresses or text you type, no profiles and no session recordings; visitors are counted with a hash that changes daily. Page addresses are counted without their query string, and without class, match, Index or edition codes (a class page counts as /class/:code). Events carry only the mode, category, seat, grade, quarter, lesson or share channel (such as “copy” or “download”), never names.	Aggregated reports per PostHog's retention.
Your account (only if you sign in): email address, how you sign in, when you signed up and last signed in, the name you give your account, and whatever you choose to keep in it (saved years, a short result line for each, and classes you created)	When you sign in, and when you switch on “Keep my games in my account” or keep a class	To sign you in and keep your games and classes across devices. Performance of the contract you enter by creating an account (Art. 6(1)(b)). Held by Supabase in Frankfurt; see “Accounts” below.	Until you delete your account, which deletes it straight away, or until it has gone unused for 24 months; nightly backups keep a copy for up to 7 days.
Your email address and the time you signed up, on the launch waitlist (only if you sign up on the holding page)	When you press “Notify me”	To send you one email when the public beta opens. Your consent (Art. 6(1)(a)); see “The launch waitlist” below.	30 days after the launch email, or 12 months after you sign up if that comes first. Unsubscribing deletes it straight away.
Review password (preview links only)	With each request, sent by your browser	Proves you entered the review password (HTTP Basic authentication). Strictly necessary. No cookie is set.	Not stored by us.

The news desk fetches public headlines from the GDELT Project on our server. No data about you is sent to GDELT.

Please don't type personal information about yourself or anyone else into the Advisor or into company names. Company names are filtered, but the filter is there to block offensive or real brand names, not to detect personal data.

Processors and transfers

Cloudflare, Inc. (hosting, error logs kept for up to 7 days, and the holding page with its launch waitlist and Cloudflare Web Analytics), United States.
Vercel Inc. (AI Gateway, when live AI runs through it), United States.
Groq, Inc. (AI inference, when live AI runs on Groq), United States. It runs the openly published models (OpenAI gpt-oss and Qwen) itself and keeps no inference data by default.
OpenRouter Inc. (AI routing, when live AI runs through OpenRouter), United States.
The model provider the request is routed to, such as Anthropic, Google or NVIDIA (when live AI is on), mostly United States.
Upstash Inc. (rate-limit counters, class and daily-challenge results, groups, team matches, Countermove Index listings and, if the digest is on, digest sign-ups), region as configured.
PostHog Inc. (anonymous usage counts, when switched on), data held in its EU cloud (Frankfurt).
Resend, Inc. (the launch waitlist emails, digest emails when the digest is switched on, and sign-in emails when accounts are on), a United States company; emails from playcountermove.ai are sent from its EU region (Ireland).
Supabase Inc. (accounts: sign-in and the account database, only when accounts are on), data held in the EU (Frankfurt, Germany, on Amazon Web Services).
Google LLC (only if you choose “Continue with Google”: Google confirms who you are and tells us your email address), United States.
Cloudflare Inc. (Turnstile, a privacy-preserving check that you are a person, on the sign-in form, only when switched on), United States.

Transfers outside the EEA, the UK and Switzerland rely, where applicable, on the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US Data Privacy Framework) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK Addendum and as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). Transfers of data about people in India follow the DPDP Act, which allows transfers except to countries the Indian government restricts.

Legal bases, in short

Contract: your account, and keeping the games and classes you choose to keep in it.
Legitimate interest: security and rate limits, error logs, anonymous usage counts, class, match and daily boards, feedback notes, and answering the Advisor when you ask it.
Consent: the launch waitlist, the email digest and posting a year to the Countermove Index. You can withdraw consent at any time (unsubscribe, or ask us to delete a listing); that doesn't affect what happened before.

For US state privacy laws (such as California's CCPA as amended by the CPRA): in the last 12 months we collected identifiers (an email address, if you gave one; a keyed hash of your IP address for rate limits), internet activity (anonymous usage counts) and content you choose to send (names, results, feedback). We collect them for the purposes in the table above, never sell or share them for cross-context behavioural advertising, and use no sensitive personal information to infer anything about you.

Your rights

Wherever you live, you can ask us to tell you what personal data we hold about you and give you a copy, correct it, delete it, or move it in a portable format. Under the GDPR and the revFADP you can also ask us to restrict processing and object to processing based on legitimate interest. Under US state laws you have the right to know, delete and correct, and to opt out of sale or sharing (we do neither). Under India's DPDP Act you can also withdraw consent, have a grievance addressed and nominate someone to act for you.

How to use them:

Games in your browser: you can see and delete them yourself at any time, from the Games menu or by clearing the site's data. We never receive them unless you send them.
Your account: on your account page, “Download my data” gives you everything it holds as one file, and “Delete my account” deletes it straight away.
Anything else (a class entry, an Index listing, a feedback note, a waitlist or digest address): write to hello@playcountermove.ai. We may ask you to confirm a detail so we act for the right person; we never ask for ID documents. An authorised agent may write for you with your signed permission.

Using your rights never changes how Countermove works for you: no price, quality or access difference.

You can complain to a data protection authority: in the EU, the authority where you live or work (for example the CNIL in France or the BfDI and your state authority in Germany); in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in India, the Data Protection Board of India, after first raising it with us. We'd appreciate the chance to sort it out first.

Security

Everything is sent over HTTPS. There are no passwords to leak: sign-in uses one-time links or Google. IP addresses are never stored, only keyed one-way hashes for rate limits. Teacher keys and unsubscribe tokens are stored only as one-way hashes. The account database checks every request against your sign-in, so one account cannot read another's data. If a breach affected your personal data, we would tell you and the authorities as the law requires.

Children

Countermove is not directed at children under 16 and is meant for adults and students aged 16 and over. We do not knowingly collect personal data from children under 16; if you think a child has given us personal data, write to us and we delete it. Schools that use Class mode with younger students are responsible for obtaining any consent their country requires (in India, verifiable consent of a parent for anyone under 18).

Class mode

If you join a class, Countermove stores in Upstash Redis, for up to 120 days: the display name you choose, your brand name and seat, how far you are through the year and when you were last active, your result (score, grade, share, net income and a short summary of your approach, such as how much you relied on deals) and, if you take the learning quiz, your quiz scores. Your decisions are sent so our server can recompute your score, then discarded. Your teacher sees all of this, including quiz scores, and can download it as a spreadsheet. Classmates see only the leaderboard, never quiz scores. Choose a display name that isn't your full name if you prefer. Your teacher can close the class; ask them, or contact us, to have an entry removed. A teacher's key is stored only as a one-way hash, never the key itself, both with the class and in the teacher's account if they keep the class there.

The Countermove Index

Posting a finished year to the Countermove Index is optional. When you post, your browser sends your decisions for the year, the market, seat and mission, your brand name, the news your year ran on (live news only; scripted news is rebuilt on our server), and a display name if you give one. Our server replays the year to work out the result, then stores a listing: the display name (or “Anonymous” and your brand), your brand and company name, the market, seat and mode, the share price path, alpha and mission score, and the date. Your decisions are not stored, apart from a one-line description of the call that moved your result most. The listing is public on the Countermove Index (a corporate edition's listings appear only on that edition's board), and is deleted after 400 days. It also counts on the monthly season board for the month it was posted, and in that season's archive, until it is deleted. Display and brand names pass the same filter as company names; don't use your full name if you'd rather not.

To post each year only once, your saved game keeps a random key for the year in your browser (inside arena.v1.games); our server keeps the same key, with no link to you, for 400 days. No cookie is used. To have a listing removed sooner, contact us with its address.

Accounts

Accounts are optional and off unless we switch them on. Every part of Countermove works without one. An account lets you keep your saved years and your classes with you on any device.

Signing in. There are no passwords. Either we email you a one-time link (sent through Resend; it works once, for one hour), or you continue with Google, which tells us your email address and that Google has confirmed it. We ask Google for nothing else, and we don't copy your Google name or photo.
What we keep. Your email address, how you sign in, when you signed up and last signed in, and a name for your account if you add one (only you see it). If you switch on “Keep my games in my account” in a browser, each game you save there is copied to your account, with a short result line (market, seat, quarters played, grade and score); this is off until you switch it on, and only for that browser. If you keep a class, we store its code and name and a one-way hash of its teacher key, never the key itself. To run the class from another computer, sign in there and we give that computer its own key.
Where. Supabase hosts sign-in and the account database in its Frankfurt region (Germany). Supabase is our processor under its Data Processing Agreement. Your session is held in secure cookies (see Cookies).
Who can see it. Only you. The database checks every request against your sign-in, so one account can never read another's rows. Our staff do not look at account data except to answer a request from you or to keep the service secure.
Security. There are no passwords to leak. An email sign-in link works once, expires after an hour and only signs you in when you press the button on our site; Google sign-in uses the PKCE standard. Your session is a cookie page scripts cannot read, refreshed every hour and ended after 30 days at most. Sign-in attempts are rate limited, and deleting an account needs a sign-in in the last 15 minutes.
How long. Until you delete your account. If you don't sign in for 24 months, we delete your account and everything in it. When we can email you, we warn you 30 days before; signing in once keeps the account. A deleted account can stay in our encrypted nightly database backups for up to 7 days, after which the backup is deleted; we never restore a deleted account from a backup. Supabase keeps a record of sign-in events, including your IP address, for security; we delete it after 7 days.
Your copy and deletion. On your account page, “Download my data” gives you everything your account holds as one file (GDPR Art. 15 and 20; FADP Art. 25 and 28), and “Delete my account” deletes your account and everything in it straight away. Results you posted to a class, Today's challenge or the Index are not linked to your account and expire as described on this page.
Usage counts. Sign-in and account pages are counted without the rest of their address, so no sign-in token or email address ever reaches analytics.

The email digest

The weekly digest is optional and off unless we switch it on. If you sign up, we store your email address and send one confirmation email through Resend. Nothing else is sent until you click its link. Unconfirmed sign-ups are deleted after 7 days. Every email has an unsubscribe link, and a one-click unsubscribe your mail app can show next to the sender (the List-Unsubscribe header); either one deletes your address straight away. To keep one sign-up per address we also store a one-way hash of it, deleted with the address. Each sign-up has a random token that the links in your emails carry; for the weekly send we note which tokens (not addresses) got that week's email, for 10 days, so nobody is emailed twice. We don't use the address for anything else, and it is never shown to other players.

The launch waitlist

Before the public beta, playcountermove.ai shows a holding page with a “Notify me” form. If you sign up, we store your email address and the time you signed up in a Cloudflare D1 database, only to send you one email when the public beta opens. We delete it 30 days after that email, or 12 months after you sign up if that comes first. The email has an unsubscribe link that deletes your address straight away, or write to hello@playcountermove.ai. To stop abuse, the form counts sign-ups per connection with a keyed one-way hash of your IP address, deleted within 24 hours; your IP address itself is not stored. The holding page counts visits with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device.

Groups

You can add a team, school or company on the year-end screen. It is kept in your browser and sent only with a result you post to Today's challenge or the Countermove Index. Group boards show only averages and best results for groups of three or more players; who is in a group is never shown. A result's group can be set once and is deleted with the result.

Changes

We will update the date when this page changes, and will flag material changes in the game. Last updated 25 October 2026.