How we handle your data
Last updated 5 August 2026. Applies to the processing of personal data in Resilience.
Short version
You can play the whole simulation without an account. Then you give us no personal data at all, and everything you do is stored only locally in your browser.
If you create an account we store your email address, a display name if you choose one, and your results. We sell nothing, share nothing and have no analytics tools or ad networks on the site.
Data controller
VER&IT AB is the controller for the processing. Contact us via VER&IT AB if you have questions or want to exercise any of the rights further down.
What we process and why
| Data | Why |
|---|---|
| Email address | Identifies the account at sign-in, and is used to confirm the address, reset the password and notify you when the password changes. |
| Password | Authentication. Never stored in readable form, only as a one-way computation (Argon2id with a unique salt) that cannot be reversed. |
| Display name | Optional. Shown on the leaderboard instead of your email address. Without a display name the address is shown masked. |
| Results and profile | Readiness rank, awards, grades, personal bests and exercise badges, so that they follow you between your devices. |
| Completed runs | Country, world situation, score, grade and time for every completed campaign run. The basis for the leaderboard's weekly and monthly lists. Exercises are not recorded. |
| Team membership | Which team you are in, when you joined, and who leads the team. One team at a time. If you leave the team the row is removed. |
| Invitations you have sent | The team's id and a one-way computation of the recipient's address, so that an invitation can only be redeemed by the address it went to. The address is never stored in readable form, and the row is purged when the invitation expires. |
| IP address and time in the security log | To detect and limit sign-in attempts made for attack purposes, and to be able to investigate an account takeover. |
Legal basis
The processing of account data and results takes place in order to perform the contract with you, article 6(1)(b) of the GDPR. The account is the service, so we need no consent and you therefore meet no consent banner.
The security log is kept on the basis of legitimate interest, article 6(1)(f): protecting your data against unauthorised access. We judge that the interest outweighs the limited intrusion that an IP address in a log represents.
Cookies
We use exactly one cookie, and only when you are signed in. It is called
session, contains a random value with no information about you, and is needed to
keep you signed in. It is strictly necessary for a function you asked for yourself, and
therefore requires no consent under the ePrivacy rules. We have no
cookies for statistics, advertising or tracking.
How long we keep it
| Data | Purged |
|---|---|
| Account data and results | For as long as the account exists. An account that has not been used for twelve months is deleted automatically. You get an email 30 days beforehand, and one sign-in is enough to keep everything. |
| Completed runs | 90 days. The leaderboard's period lists never reach further back than that, and your personal best stays in the profile regardless. |
| Security log | Six months. |
| Sign-in links and reset links | 15 minutes, and they can only be used once. |
| Signed-in sessions | You choose yourself at sign-in. Without a tick in "keep me signed in" the session ends when you close the browser, and after one day at the latest. With the tick it ends after 14 days of inactivity, and after 90 days at the latest regardless of activity. |
Who gets to see the data
Nobody outside VER&IT AB gets access to your data for their own purposes. We engage two processors for operations: the provider of the server the service runs on, and the mail server that sends the confirmation and reset emails. Both process the data solely on our instructions, and all processing takes place within the EU or the EEA.
The only thing shown publicly is your display name, your score and your grade on the leaderboard, and only if you submit a result yourself. If you do not want to appear there you do not need to submit anything.
If you join a team, the team's name and member list become public: anyone can see who is in it, their display names, scores and readiness ranks. If you have no display name your address is shown masked, just as on the leaderboard. If you leave the team you disappear from the list.
Your rights
You have the right to know what data we process about you, to have incorrect data corrected, to have the data erased, to object to processing that rests on legitimate interest, and to receive your data in a machine-readable format.
Erasure is easiest to handle yourself: on your account there is a function that closes the account and removes the email address, display name, saved profile and results on the leaderboard. It cannot be undone.
If you are not satisfied with how we process your data you can complain to the Swedish Authority for Privacy Protection in Sweden, or to the supervisory authority in the EU or EEA country where you live.
Security
Traffic is always encrypted. Passwords are stored with Argon2id and a unique salt, session values and one-time links are stored only as one-way computations, and passwords and links never end up in any log. The requirements we build against are documented and follow OWASP ASVS and NIST SP 800-63B.
Publisher
Resilience is an independent product from VER&IT AB. It is not published by, and was not commissioned by, any government agency.