Privacy Policy

Effective 20 September 2026. The short version: no ads, no trackers, no analytics scripts, no email addresses. Without an account the site keeps nothing about you beyond the game you're playing; with one, it keeps the few things listed below, and you can delete them at any time.

1. Without an account

• A session cookie (rt_sid) ties your browser to the game the server is holding for you. It is random, holds no personal data, and expires after two hours of inactivity.
• Your browser's own storage keeps the deck you're building, your bot-opponent choice and the tutorial's progress, on your device only. Clearing site data removes it.
• Server logs record requests with the IP address, as any web server does. The IP is also used, in memory, to rate-limit traffic and cap how many games one address can open. Logs are kept by the hosting provider for a limited time and are not used for anything else.
• Anonymous counters (how many games were started or finished, how many tutorials completed) hold numbers only, never who.

2. With an account

Signing in is optional. If you sign in with Google or Discord, that provider tells the site who you are, and the site stores:

• which provider you used and the id it assigns you (never your email address or password);
• the username you choose on the site (your Google or Discord display name is looked at only to sign you in and is not stored);
• the address of your avatar image, as the provider gave it;
• your progress: whether you finished the tutorial and how many games you've played;
• the decks you save;
• your match history: which deck, who or what you played (a bot deck's name, or the other player's display name), the result, the score, the turn count and the date;
• when your account was created and last used.

A login cookie (rt_auth) keeps you signed in for 30 days; a short-lived cookie (rt_oauth) protects the sign-in handshake. Both are httpOnly and never readable by scripts.

3. What other players see

In a Normal game the person across the table sees the username you chose (or "Guest" if you're not signed in, or "Player" until you choose one) and your plays. They never see your hand, your deck list, your avatar, your Google or Discord identity or anything else about you.

Table talk. A Normal game has a small chat between the two seats. What you type is shown to the other player and kept in the server's memory only as long as the game itself (about fifteen minutes past its end); it is never written to disk, logged, read by anyone else or used for anything. Keep it civil: there is no filter, and a game can be left at any time.

4. Problem reports

If you press "Report a problem" in the game menu, the note you type is stored together with the exact state of your game and, if you're signed in, your account id and username, so the bug can be replayed and fixed. Reports are kept only for that purpose.

5. Who else is involved

• Google and Discord handle the sign-in itself under their own privacy policies; the site receives only the profile fields listed above. Avatar images are loaded from their servers.
• Google Cloud hosts the server and keeps its logs; Cloudflare provides the domain's DNS.

Nothing is sold, shared with advertisers, or used to build a profile of you. No third-party analytics or tracking scripts run on this site.

6. Deleting your data

Signing out clears the login cookie. Delete my account on the legal notice page removes your account and everything in section 2 immediately. Problem reports you sent may remain, with the account id no longer resolving to anyone. Server logs expire on the hosting provider's schedule.

7. Children

The site is not aimed at children under 13, and accounts require a Google or Discord login, which set their own age limits. If you believe a child has created an account, email the address below and it will be removed.

8. Changes and contact

This policy may be updated as the site grows; the effective date above changes when it is. Questions or requests: ariftpull@gmail.com.