Privacy Policy

1 The Short Version

If you are in a hurry, you may stop reading now. The remaining sections exist for completeness, regulatory aesthetics, and the genuine entertainment of anyone who enjoys reading privacy policies about fictional grain commerce platforms.

2 Information We Collect

Below is a complete and exhaustive table of all personal data categories we collect, how we use them, and where they are stored.

Data Category	Collected?	Where Stored	Shared?
Name (first & last)	✅ Locally only	Your browser's localStorage	❌ Never
Username & password	✅ Locally only	Your browser's localStorage	❌ Never
Email address	✅ Locally only	Your browser's localStorage	❌ Never
Order & transaction history	✅ Locally only	Your browser's localStorage	❌ Never
Wheat Credits balance	✅ Locally only	Your browser's localStorage	❌ Never
Payment card details	❌ Not collected	N/A — demo only	❌ Never
IP address	❌ Not collected	N/A — no server	❌ Never
Location / GPS data	❌ Not collected	N/A	❌ Never
Browser fingerprint	❌ Not collected	N/A	❌ Never
Usage analytics / telemetry	❌ Not collected	N/A	❌ Never
Grain preferences (fictional)	✅ Locally only	Cart in localStorage	❌ Never

All data marked "Locally only" resides exclusively in localStorage under the key wheatleys_wheat_db_v1 in your browser. It never leaves your device through any mechanism under our control.

3 localStorage & How It Works

localStorage is a browser API that allows web applications to persist key-value data on your device. It is accessible only by the same origin (domain/file path) that wrote it, is not transmitted with HTTP requests, and persists until explicitly cleared.

3.1 What We Store

We store a single JSON object under the key wheatleys_wheat_db_v1. It contains:

• A users array with account profiles (name, username, hashed-equivalent password, credits balance).
• An orders array with all transaction records.
• A session object tracking the currently logged-in user ID.
• A meta object with app-level metadata (e.g., demo seed timestamps).

We also store an audit log under ww_admin_log and pending checkout context under ww_pending_order.

3.2 How to Inspect It

You can inspect everything we store by opening your browser's developer tools, navigating to Application → Storage → Local Storage, and looking for this application's origin. Every byte is visible and human-readable.

3.3 How to Delete It

To delete all data associated with this application:

• Use the Reset All Local Data button in the Admin Panel, or
• Open your browser's developer tools and manually clear localStorage, or
• Clear your browser's site data through the browser's privacy/settings menu.

4 Payment Data

This platform integrates three simulated payment gateways — Fake Stripe™, Fake PayPal™, and Fake PhonePe™ / UPI. These are purely visual simulations with no backend connectivity whatsoever.

Any card numbers, email addresses, passwords, UPI VPAs, MPINs, or OTPs entered into payment fields are handled entirely client-side and are:

• Never transmitted to any server.
• Never stored in localStorage.
• Discarded as soon as the browser session processes the demo payment flow.

5 Cookies & Tracking

We do not set cookies. We do not use tracking pixels. We do not embed third-party analytics scripts (Google Analytics, Mixpanel, Amplitude, or any other service). We do not use fingerprinting techniques. We do not embed social media widgets that track your browsing.

There are no <script src="https://…"> tags loading external resources. Every asset used by this application — fonts, icons, and code — is inlined or uses system fonts. Your browser makes zero network requests when using this application beyond the initial file load from wherever you are hosting it.

6 Third-Party Services

We do not use any third-party services. The following entities are referenced in our simulated payment UIs but have absolutely no involvement with this application:

• Stripe, Inc. — the real Stripe has not provided, endorsed, or integrated with this application in any way.
• PayPal Holdings, Inc. — likewise completely uninvolved.
• PhonePe Private Limited / NPCI — similarly not involved.

Our use of their visual branding is satirical and educational, clearly labelled as simulation throughout the application. No data flows to or from these companies as a result of using this platform.

7 Children's Privacy

This application does not knowingly collect information from children under the age of 13. Since we do not collect information from anyone at all (see every preceding section), this requirement is naturally satisfied.

Parents concerned about their child's fictional wheat portfolio should be aware that the emotional investment in Wheat Credits, while we understand can be significant, is not backed by any real asset and poses no financial risk to minor or major persons.

8 Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. Here is how each applies to Wheatley's Wheat:

9 Data Security

Since your data never leaves your device, the security of that data is a function of the security of your device and your browser. We recommend:

• Not using this application on a shared or public computer if you have stored a meaningful amount of fictional wheat.
• Keeping your browser updated to receive the latest security patches.
• Not sharing your browser's localStorage export with untrusted parties, particularly those who might impersonate our admin tools.
• Being cautious about browser extensions, which can access localStorage for any origin.

The passwords stored in this application's local database are stored as plain text because this is a demo application and implementing a secure hashing algorithm would have obscured the educational purpose. Please do not reuse passwords from other services here, purely as a matter of personal best practice.

10 International Users

Wheatley's Wheat Emporium is accessible from any country, including but not limited to Vietnam, the United Kingdom, India, Bahrain (whose special edition wheat we sell), and the Fictional Grain Commonwealth. Since we do not transmit data internationally — or at all — no cross-border data transfer provisions apply.

If you are subject to GDPR (European Union), CCPA (California), PDPB (India), PDPA (Thailand), or any other data protection framework, you are still fully protected, specifically because there is no data processing occurring on our end to regulate.

11 Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last Updated" date at the top of this page. The most significant change we anticipate is one in which we accidentally introduce a server, at which point this entire document would require substantial revision.

We consider this unlikely. The application's local-only architecture is a feature, not an oversight.

12 Contact

If you have questions, concerns, or strong opinions about this Privacy Policy or our handling of your browser-local wheat data, please reach out through the following channels: