Privacy

A quick game or a public room needs no account. Your browser is given a random identifier in a cookie so the table knows which seat is yours, and a second cookie holds the name you chose, if you chose one. Neither says who you are. Tables and the hands played at them are kept for a few hours after the last move and then deleted.

An account is only needed for clubs. When you make one, the site keeps:

• your email address, which is how you sign in and is never shown to other players;
• if you sign in with Google, the name and profile picture Google shares — used only to set up the account, never shown at a table;
• if you sign in with a password, the password itself, stored only as a one-way hash that cannot be turned back into it;
• the nickname, picture or lacquer, and player ID other players see;
• your sign-in sessions — when each started, and the browser and network address it came from — so you can stay signed in and so a stolen session can be spotted.

A sign-in cookie keeps you signed in for up to thirty days on each device. Signing out ends that session.

Nobody buys it: there are no adverts and no data is sold or shared for marketing. The site runs on services that store it on its behalf — Vercel, which hosts the site; Neon, which holds the database; and the Redis service that holds live tables. Signing in with Google involves Google, under Google’s own privacy policy. Other players see your nickname, the picture or lacquer you chose, and your player ID, and the hands you play at their table.

You can ask for your account and everything attached to it to be deleted at any time by writing to dinal.bandara@gmail.com. Deletion removes your email address, sign-in details, sessions and profile.