1. Data Controller
Draughts Game ("we", "us") is the data controller for the personal data collected through this platform. Contact: privacy@draughtsgame.com
2. Data We Collect
2.1 Account Data
- Username - chosen by you, publicly visible
- Email address - encrypted at rest with AES-256-GCM, used for account identification, not publicly visible
- Password - stored as a bcrypt hash (cost factor 12), never in plain text
- Age confirmation - we record that you confirmed being at least 16 years old at registration
- Email verification status - whether you have confirmed your email address, plus short-lived verification and password reset tokens
- Profile customization (optional) - avatar and country, chosen by you, publicly visible
2.2 Game Data
- Game moves, results, and timestamps
- Player ratings and statistics
- Tournament participation and results
- Puzzle attempts, puzzle rating, and solving streaks
2.3 Technical Data
- IP address (for security and anti-cheating purposes)
- Browser user agent string
- Session tokens
2.4 Support Requests
If you contact us through the support form, we collect your email address, an optional name, and the subject and content of your message, so that we can handle and reply to your request.
3. Legal Basis for Processing
We process your personal data based on:
- Contract performance (Art. 6(1)(b) GDPR) - to provide the game service you signed up for, including transactional emails (account verification, password reset) and support replies.
- Legitimate interests (Art. 6(1)(f) GDPR) - for platform security, anti-cheating, anonymous usage statistics, and service improvement.
- Consent (Art. 6(1)(a) GDPR) - for error tracking via Sentry.
4. How We Use Your Data
- Providing and operating the game platform
- Authenticating your account and maintaining sessions
- Calculating and displaying player ratings and leaderboards
- Matchmaking and tournament organization
- Detecting and preventing cheating and abuse
- Sending transactional emails (account verification, password reset)
- Handling and replying to your support requests
- Improving the service through aggregated, anonymous analytics
- Analyzing gameplay data (e.g. variants played, game results) in aggregated, anonymized form to understand usage and improve the platform
5. Cookies and Third-Party Services
We use essential cookies for authentication and your preferences. We rely on the following services:
- Umami (analytics) - self-hosted on our own EU infrastructure. It is cookie-free, collects only anonymous, aggregated usage statistics, and does not track you across sites.
- Sentry (error tracking) - enabled only with your consent.
- Resend (email delivery) - delivers our transactional emails (account verification, password reset) and support notifications.
- DigitalOcean (hosting) - EU data center (Frankfurt).
We do not sell your data or use advertising trackers.
6. Data Retention
- Account data - retained as long as your account is active.
- Guest accounts - automatically deleted after 30 days of inactivity.
- Refresh tokens - expire after 7 days, cleaned up automatically every hour.
- Email verification tokens - expire after 24 hours.
- Password reset tokens - expire after 1 hour.
- Support requests - retained as long as necessary to handle your request.
- Abuse reports - when a player reports someone for chat abuse, that game's chat (up to 100 messages, from both players) is stored for moderation and deleted automatically after 90 days. Chat is never stored otherwise.
- Game data - retained indefinitely as part of the public game record.
- Sentry error data - automatically deleted after 90 days.
- Deleted accounts - personal data is removed immediately upon deletion. Game records are anonymized (player reference removed).
7. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access (Art. 15) - download a copy of your personal data from your profile settings ("Export my data").
- Rectification (Art. 16) - change your password in profile settings. For other corrections, contact us.
- Erasure (Art. 17) - delete your account from profile settings ("Delete account"). This is immediate and irreversible.
- Data portability (Art. 20) - export your data in machine-readable JSON format from profile settings.
- Restriction (Art. 18) - request restriction of processing by contacting us.
- Objection (Art. 21) - opt out of Sentry error tracking via the cookie banner or the toggle in your profile settings.
To exercise any of these rights, use the self-service tools in your profile settings, or contact us at privacy@draughtsgame.com. We will respond within 30 days.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption of sensitive data at rest and in transit, secure password hashing, and rate limiting on authentication endpoints.
9. International Transfers
Your data is primarily stored and processed within the European Economic Area (EEA) at DigitalOcean's Frankfurt data center. Sentry error data may be transferred to the USA under the EU-US Data Privacy Framework adequacy decision (July 2023). You can opt out of Sentry in your profile settings. Transactional emails are delivered through Resend (USA); this transfer is covered by a data processing agreement with Standard Contractual Clauses.
10. Children's Privacy
The Service is not intended for children under 16 years of age (Art. 8 GDPR). We require age confirmation at registration. We do not knowingly collect personal data from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via a notice on the platform. The "Last Updated" date at the top indicates the most recent revision.
12. Supervisory Authority
You have the right to lodge a complaint with the competent data protection supervisory authority if you believe your data protection rights have been violated.
13. Contact
For questions about this Privacy Policy: