We do not collect personal information beyond what is strictly required to run a match: a session identifier and gameplay events.
Local preferences (language, theme, sound) are stored in your browser via localStorage and never leave your device.
Anonymous error and performance telemetry may be collected to keep the service reliable. No advertising or third-party trackers are used.
Live online play is hosted on a single server located in France (European Union), operated by OVH. Your data is processed within the EU. Players far from Europe will see higher move-acknowledgement latency by the underlying network distance — that is a physics constraint, not a regression.
Replay revocation
You can revoke a previously-shared replay at any time. The revocation enforces at the request layer, not via cache eviction: every request to a revoked replay URL hits a request-time check on our server that returns 404 immediately. Revocation is fast because it does not depend on cache expiry — the server refuses the revoked URL on every request as soon as the revocation lands. [fr] Vous pouvez révoquer une rediffusion partagée à tout moment. La révocation s'applique au niveau de la requête, et non par éviction du cache : chaque requête vers une URL révoquée passe par une vérification côté serveur qui renvoie 404 immédiatement, sans dépendre de l'expiration du cache. [de] Sie können eine zuvor freigegebene Wiederholung jederzeit widerrufen. Der Widerruf wird auf Anfrageebene durchgesetzt, nicht durch Cache-Eviction: Jede Anfrage an eine widerrufene URL durchläuft eine serverseitige Prüfung, die sofort 404 zurückgibt, ohne von Cache-Ablauf abzuhängen.
Live-vs-backup asymmetry. Live revocation is immediate at the request layer. Backup-retained copies of the canonical match record follow the compliance-retention schedule documented below (7 d / 1 y / 7 y) — those copies are encrypted at rest in our EU object storage, are NOT served to anyone except the operator under restore, and on restore the erasure event re-applies automatically so restored projections never re-introduce the revoked replay.
Erasure and backup-asymmetry
When you delete your account, we anonymise your account record in place: your email address is replaced with a non-deliverable tombstone, your display name is changed to Deleted player, your saved preferences are cleared, your account is marked deleted, and all of your active sessions and API tokens are revoked. Because the leaderboard, your profile, and search read your display name live from that record, the change is reflected across every live surface immediately. Honest scope limit: the display name you used at the time of a match is also stored in the durable match record, and deleting your account does not rewrite that historical game ledger — that name can therefore remain in old game records. Encrypted backups age out on their own retention schedule (below).
Backup-asymmetry disclosure. Deletion takes effect on the live systems immediately. Backups follow a different schedule: encrypted snapshots are retained for 7 days (operational rollback), 1 year (legal-hold), and 7 years (long-term compliance archive — minimal, encrypted). Those snapshots are encrypted at rest and are never served to anyone except the operator performing a restore. If a backup is ever restored, we re-apply your deletion to the restored data, so you will not reappear on any live system. The existence of backups does not undo your account deletion.
Your rights remain exercisable across the backup lifecycle: request a fresh erasure at any time and the live re-application kicks in within 10 s; request a portability export (Article 20) — from Account settings, "Export my data" downloads your account profile, ratings, trophies, and puzzle history as canonical JSON. The backup-retention asymmetry exists because regulators require us to keep the operational rollback path; it does NOT mean your erasure can be undone.