WarPaths Privacy Policy

Effective date: November 5, 2026

Last updated: November 5, 2026

This policy is written for people who read privacy policies critically. It names the companies that process your data, says what each one does, and describes what we keep and for how long, including the cases where our answer is less flattering than a marketing page would prefer. Where we have a limitation, it is disclosed rather than omitted.

Contact for anything in this policy: admin@warpaths.com

1. Who is responsible for your data

Strategy Connections, LLC, a Florida limited liability company, operating the WarPaths platform and the SAGE product at sage.warpaths.com, is the controller of the personal data described here.

Mailing address: 130 Corridor Rd Unit #512, Ponte Vedra, FL 32004, USA
Email: admin@warpaths.com

Our representative in the European Union under Article 27 GDPR is Data Protection Representative Limited (trading as "DataRep"), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Our representative in the United Kingdom under the UK GDPR is DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. You can contact DataRep about WarPaths in either role by email at datarequest@datarep.com quoting "WarPaths, SAGE" in the subject line, through the webform at www.datarep.com/data-request, or by post to the addresses above. Postal inquiries must be marked for "DataRep", not for WarPaths or Strategy Connections, or they may not reach us.

Our legal representative in the European Union under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065) is DataRep at the Dublin address above. For DSA matters, contact digitalrequest@datarep.com quoting "WarPaths, SAGE" in the subject line, use the same webform, or phone +353 (1) 919 8899.

2. What we collect

Account data. Your email address and a hash of your password. We never store your password in readable form and cannot recover it, only reset it. Also: your display name and any profile details you choose to add, your subscription tier and status, and account timestamps.

Gameplay content. The decisions and written responses you submit during a game; the state of the game as it develops; the advisor exchanges; and the evaluation generated at the end. This is the substance of the service, and it is the data we hold the most of.

Scoring and leaderboard data. Your scores, which scenarios you have played, whether a run was your first (and therefore scored), and the timestamps that drive recency weighting and the 8-week eligibility window. Your display name and leaderboard standing are visible to other users on the leaderboard. You may use a pseudonymous display name.

Survey answers. After a game you may be asked a few short questions about it, such as how useful the feedback was or what you would change. During the beta, you need to submit the survey for a game before starting your next one; individual questions may be optional. We keep your answers with the game they are about.

Organization data (organization accounts only). The organization's name and administrator contacts; scenario drafts and published scenarios; extraction output from uploaded reports (Section 4); and aggregate participation and performance data for the organization's games. Organizations invite participants through anonymous invite links (Section 7); we do not receive invitee names or contact details from organizations. Images and other media attached to a scenario are stored in object storage (Cloudflare R2) and served from media.warpaths.com. Media served this way is retrieved by direct link and is not access-controlled per viewer; do not attach anything to a scenario that must remain confidential.

Access requests. If you request access through our request form, we collect what you enter: your name, email address, employer or organization, role, a LinkedIn profile link or a note on why you want access, and, for an organization, its website and intended use. We use it only to confirm we received your request, to decide on it, and, if we approve it, to email you an invitation. If you also tick the box asking us to email you when new games are released, we use your name and email address for that too, until you unsubscribe. You can also ask us to email you when new games are released without requesting access; we then keep only your email address, and your name if you give it, for that purpose until you unsubscribe.

Messages you send us. If you write to us through the contact form on warpaths.com, we receive your name, email address, your organization if you give it, and your message, and we use them only to reply to you.

Payment data. Handled by Stripe. We do not receive or store your card number. We hold a Stripe customer identifier, your subscription status and history, and the billing country and tax information Stripe returns to us so we can invoice and account correctly.

Operational logs. Server and application logs generated when you use the service: IP address, browser/user-agent string, requested endpoints, timestamps, and error traces. These exist to keep the service running, debug faults, and detect abuse.

Email delivery data. Transactional email (verification, password reset, deletion confirmation, billing notices) is sent through Postmark, which processes your email address and delivery metadata such as whether a message bounced.

Analytics. We plan to use Plausible Analytics, which is cookieless and does not build cross-site profiles or identify individual visitors. It gives us page counts and referrers, not people.

What we do not collect. We do not run advertising or advertising trackers. We do not sell personal data and never have. We do not buy personal data from brokers. We do not ask for, and do not want, any special-category data (health, biometrics, political opinions, and so on).

3. Cookies and similar technologies

We use cookies and local storage only for things the service cannot work without: keeping you logged in, maintaining your session, and basic security. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. Our planned analytics provider (Plausible) is cookieless by design.

4. Uploaded reports (organization accounts)

This is the clause organizations ask about, so here it is in full.

We do not keep your report. The AI provider that processes it, OpenAI, does not train on it and does not retain it beyond a short abuse-monitoring window (Section 5). No other AI provider receives your report. The extraction we keep includes brief verbatim citations (each under 600 characters, with page references) so you can verify our reading against your source.

In more detail:

• The uploaded file is processed in memory. We do not write the file's bytes to storage: not to our database, not to object storage, not to a backup.
• The AI provider receives a copy in order to perform the extraction. We do not retain it, and the provider does not use it to train its models and does not retain it beyond the limited abuse-monitoring window described in Section 5 (currently up to 30 days). We do not keep our own copy of the file after extraction completes.
• We keep a content hash, a fingerprint of the file, so that we can recognize a re-upload of the same document and avoid duplicate processing. A hash cannot be turned back into the document.
• The extraction we keep is a structured summary of what the report contains, and it deliberately includes a bounded set of short verbatim excerpts, each between roughly 10 and 600 characters, each carrying a page reference, capped at approximately 25 for a report. They exist for two reasons: so your authors can check our reading against the original, and so the scenario can quote source material with attribution, the way a paper cites its sources.

We are explicit about this rather than claiming zero retention, because "we keep nothing" would not be true of the excerpts, and you would find that out the first time you opened a draft.

Uploading organizations warrant, under the Terms of Service, that they hold the rights necessary to upload the report and to have it processed this way, and that it contains no classified, controlled, or export-restricted material.

5. Artificial intelligence: what is processed, by whom

The service runs on AI models. Being precise about this matters more than most of this document.

What the AI does. Two AI providers take part. Our primary AI provider generates scenarios, the responses of in-game advisors, world-state updates between turns, extraction from uploaded reports, and the written evaluation you receive at the end of a game. A second provider takes part in that evaluation only: it is a decision model that reads your written answers and returns scores; it writes nothing you see.

What is sent. To run a game, the text you write during play is transmitted to our primary AI provider's API, along with scenario context and game state. To generate your evaluation, your submissions from that game are transmitted to that provider for assessment, together with the scenario material you were shown. For organizations, the uploaded report is transmitted for extraction as described in Section 4.

What is sent to the scoring provider, and what is not. The scoring provider receives the text of your written answers, the action orders you gave, and the questions you were answering. It does not receive your name, email address, display name, account identifier, game identifier, the scenario text or briefing you were shown, or your exchanges with the in-game advisors. Before that text is sent to the scoring provider we remove email addresses, phone numbers and web links from it; this step applies to the scoring provider only. Do not put personal details about yourself or others into your answers; the exercise does not need them.

Who the providers are. We use OpenAI's API as the primary AI provider for the product. For the scoring step described above we use TypeSafe's API. (We use Anthropic's tools internally for engineering work; that has no contact with your gameplay data.)

Automated processing. Your evaluations and scores are generated by AI without human review before you receive them. We have designed the service so that these outputs do not produce legal or similarly significant effects on you: they are assessments of reasoning inside a fictional exercise, they are not credentials or professional assessments, and we do not disclose your individual evaluation to any sponsoring organization (except in a classroom or training game, as Section 7 describes). Decisions that affect your account itself, such as suspensions or score removals under the fair-play rules, are always made with human involvement. If you believe an evaluation is mistaken, or you would like a human to review any automated output about you, email admin@warpaths.com and a person will review it and respond.

Training and retention: OpenAI. OpenAI's published position for API traffic is that data submitted through the API is not used to train or improve their models by default, and that abuse-monitoring logs containing API inputs and outputs are retained for up to 30 days unless longer retention is legally required. We have not opted into any data-sharing arrangement with them. We state this as their policy, verified at the time of writing; it is their commitment, not ours to guarantee, and it can change. If it changes materially we will update this policy.

Training and retention: TypeSafe. TypeSafe's published privacy policy states that it will not train or fine-tune models on customer input, and its customer agreement states that it will not include customer data in a training dataset without the customer's consent; we have not given that consent and will not. TypeSafe's terms state no fixed retention period: data is kept for as long as reasonably necessary for its services or business purposes, and its agreement says it is under no obligation to retain customer data and may delete it at any time. Under its data-processing terms TypeSafe may process what we send only to provide its service to us, which is to return the scores, and for no other purpose. As with OpenAI, we state this as TypeSafe's policy, verified at the time of writing; it is TypeSafe's commitment, not ours to guarantee, and we cannot see or verify what TypeSafe retains.

Optional third-party assistant integrations. We may offer an optional way to reach parts of SAGE from within a general-purpose AI assistant such as ChatGPT (for example, a WarPaths tool or plugin). If you choose to use such an integration, the requests you make and the content you send through it also pass through that third-party assistant under its own privacy policy and terms, in addition to ours. These integrations are optional and are never required to use SAGE. Where we offer one at launch or later, we will name the provider here.

Practical implication. Treat SAGE as an unclassified commercial service. Do not enter classified information, Controlled Unclassified Information, export-controlled technical data, or anything else you would not put into a third-party cloud service. Our Terms prohibit it.

6. Who else processes your data

Everyone in the chain, and what they do:

Each is engaged as a processor acting on our instructions, under its own data-processing terms. We add processors only when they are needed, and we will update this table when we do.

We also disclose personal data where we are legally required to (valid legal process, court order), where necessary to establish or defend legal claims, or to protect the rights and safety of users or the public. If we are compelled to disclose your data and are legally permitted to tell you, we will.

If the business is sold or transferred, personal data may transfer as part of it. You will be notified before your data becomes subject to a different privacy policy.

7. Organization boundaries: who sees what

Where organizations run games for their own invited audiences, the split is:

• Organization scenarios and drafts are visible to that organization's administrators and to WarPaths staff. They are not visible to other organizations.
• A participant's account belongs to the participant. People invited by an organization receive real, persistent SAGE accounts that they own and keep, regardless of what happens to the organization's relationship with us.
• A participant's individual evaluation belongs to the participant. We do not show it to the sponsoring organization.
• Organizations receive aggregate insights, meaning patterns and distributions across the participants in their games, not individual reports on named people.
• Survey answers on an organization's game are shown to that organization only once at least three participants have answered: as totals for rating questions, and as written answers without names. An organization's download lists each participant under a code, never their name, email or account.
• For a classroom or training game run by an instructional organization, we tell you before you join that its administrators will see your name, email, answers, survey responses and evaluation for that game; nothing else of yours is shown to them.

For participant accounts, gameplay content, and evaluations, Strategy Connections, LLC is an independent controller. We do not process that data on the sponsoring organization's behalf, and the organization is not our controller for it.

If an organization invites you. Organizations invite participants by sharing an invite link that the organization generates and distributes through its own channels (for example, its own email, intranet, or messaging tools). We do not receive your name, email address, or any other identifying information about you from the inviting organization, and we hold no such information about you unless and until you choose to register an account. If you follow an invite link before registering, our servers may record ordinary technical information (such as your IP address) in the same way as for any visitor to our site, as described in the Cookies and Security sections of this Policy; this is standard site logging, not information the inviting organization gave us about you. Any message the organization sends you containing an invite link is the organization's own communication, governed by the organization's own privacy practices. Invite links are capped and expire after 30 days; because the organization does not give us your name, email address, or other identifying information when a link is created, shared, or expires, there is no such information for us to retain or delete if you choose not to register. Once you register, this Privacy Policy applies to you in the same way as to any other account holder. The only contact details an organization provides to us are its own administrators' email addresses, which we treat as organization account data.

If you were invited to play by an employer, a program, or an institution, that is what they can and cannot see.

8. Staff access

WarPaths staff, meaning accounts on @warpaths.com addresses only, can access account and gameplay content where it is necessary for support, moderation, quality review, debugging, and evaluating whether the AI is producing good output. This is a small team and access is not logged to a formal audit trail today. We are telling you this rather than implying a level of internal separation that does not exist at our size.

9. Why we process your data, and on what legal basis

For users in the EU, UK, and anywhere else where a lawful basis must be identified:

Where we rely on legitimate interests, we have considered your interests and rights and concluded they are not overridden. You may object; see Section 12.

10. How long we keep things

11. Deleting your account, and what survives it

You can delete your account at any time by emailing admin@warpaths.com from the address on your account, or otherwise letting us verify the request is yours. Here is exactly what happens.

What is removed. Your email address is tombstoned so it cannot be reused to register, your identifying profile fields are scrubbed or anonymized, and login is permanently disabled. You receive a confirmation email. The account cannot be restored, by you or by us.

What is kept: read this before you delete. Your gameplay records are not deleted by default. They are stripped of the identifiers that connect them to you. In addition, before a record enters our retained research corpus, we review its text and remove content that could identify you, such as references to your employer, your career, or other details about yourself that you wrote into your responses. The de-identified records are then retained. We use that de-identified corpus to study how people reason through scenarios, and to improve scenario design, advisor behaviour, and the quality of evaluations.

We disclose this plainly because it is the substantive trade in our deletion design: your identity goes, the reasoning stays, severed from your name. If you are not comfortable with that, do not create an account, because once records are genuinely anonymized, we cannot locate yours to remove them, which is the point of anonymizing them.

Under EU and UK law, data that has been genuinely and irreversibly anonymized is no longer personal data and falls outside the scope of those rules. Our deletion process is built to meet that standard. If you have a question about it, write to admin@warpaths.com and we will answer specifically rather than generically.

If you are in the European Union, the United Kingdom, or another jurisdiction that gives you a right of erasure, you may ask us to delete your gameplay records entirely instead of retaining them in de-identified form. Tell us when you make your deletion request, and we will erase them, subject only to records the law requires us to keep. If you have already deleted your account and your records have entered the retained corpus, we will honour a verified erasure request to the extent the records can still be located.

What erasure reaches. Erasure removes the records we hold. Copies that an AI provider held while processing your text are governed by that provider's own retention, described in Section 5: OpenAI's is a window of up to 30 days; TypeSafe states no fixed period. What we send to TypeSafe carries no account identifier, so nothing we provide lets TypeSafe connect it to you. On a verified erasure request we will also instruct TypeSafe to delete anything it still holds from your games; we cannot see or verify what TypeSafe does with that instruction.

Some records survive deletion because the law requires it, payment and tax records in particular, held for the statutory period.

12. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access: a copy of the personal data we hold about you.
• Correction: fixing data that is inaccurate or incomplete.
• Deletion: removal of your personal data, subject to Section 11 and to legal retention requirements.
• Portability: a copy of data you provided to us, in a machine-readable format (EU/UK and some US states).
• Objection and restriction: to processing based on legitimate interests, and to direct marketing at any time.
• Withdrawal of consent: where we rely on consent, withdrawable at any time without affecting prior processing.
• Non-discrimination: we will not degrade your service for exercising these rights.

How to exercise them. Email admin@warpaths.com. We handle these requests manually. We will verify that the request comes from you, and respond without undue delay and in any event within one month. Where a request is complex, or we are handling many requests, we may extend by up to two further months; if we do, we will tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive.

A note on export. The platform does not offer a general export feature for scenarios, organization content, or platform data. That is a product decision and it does not affect the rights above: a verified request for a copy of your own personal data will be honoured, manually if necessary.

Complaints. If you are in the EU or UK, you may complain to your national data protection authority; in the UK, the Information Commissioner's Office. We would rather you came to us first.

13. International transfers

We are based in the United States, and most of our processors are too. If you are in the EU or UK, your personal data will be transferred to and processed in the United States.

We rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) as included in our processors' data-processing terms, together with those processors' own transfer frameworks, as the legal mechanism for these transfers. You may ask us for details of the safeguards that apply.

14. Security

• All traffic is encrypted in transit (TLS, via Cloudflare and our hosts).
• Passwords are stored as salted hashes, never in readable form.
• Data is stored in a managed Postgres database with access restricted to the application and a small number of staff accounts.
• Access to production systems is limited to @warpaths.com staff accounts.

A limitation we want you to know about. Changing your password does not currently end sessions that are already logged in elsewhere. Our authentication tokens are stateless, and session revocation is on our roadmap but is not built yet. If you believe someone else has access to your account, email admin@warpaths.com and we will help you secure it directly.

No service can promise perfect security, and we do not. If we suffer a breach affecting your personal data, we will notify you and the relevant authorities as required by law, and we will tell you what actually happened.

15. Children

The service is for adults. You must be at least 18 to hold an account. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has created an account, tell us at admin@warpaths.com.

16. Changes to this policy

We will update this policy as the service changes. Material changes will be announced by email or in-product at least 14 days before they take effect, and the "last updated" date above will change. Past versions are available on request.

17. Contact

Strategy Connections, LLC
130 Corridor Rd Unit #512, Ponte Vedra, FL 32004, USA
admin@warpaths.com

Questions about this policy are welcome, and specific ones get specific answers.