We do not collect personal information beyond what is strictly required to run a match: a session identifier and gameplay events.
Local preferences (language, theme, sound) are stored in your browser via localStorage and never leave your device.
Anonymous error and performance telemetry may be collected to keep the service reliable. No advertising or third-party trackers are used.
Live online play is hosted from a single AWS region (us-east-1). Players outside that region's RTT envelope will see higher move-acknowledgement latency by the underlying network distance — that is a physics constraint, not a regression.
Replay revocation
You can revoke a previously-shared replay at any time. The revocation enforces at the request layer, not via cache eviction: every request to a revoked replay URL hits a request-time gate (Lambda@Edge) that returns 404 within a 2 s p95 SLO across global CloudFront points-of-presence. The 2 s figure is enforced by a 3-POP integration test (us-east-1, eu-west-1, ap-southeast-1) and tracked as a binding acceptance gate. Live revocation is fast because we do not depend on CDN cache TTLs to age out the artifact — the gate refuses on every request immediately after the revocation lands. [fr] Vous pouvez révoquer une rediffusion partagée à tout moment. La révocation s'applique au niveau de la requête, et non par éviction du cache : chaque requête vers une URL de rediffusion révoquée passe par une porte au moment de la requête (Lambda@Edge) qui renvoie 404 sous un objectif p95 de 2 s sur tous les points de présence CloudFront mondiaux. [de] Sie können eine zuvor freigegebene Wiederholung jederzeit widerrufen. Der Widerruf wird auf Anfrageebene durchgesetzt, nicht durch Cache-Eviction: Jede Anfrage an eine widerrufene Wiederholungs-URL durchläuft ein Anfrage-Tor (Lambda@Edge), das innerhalb einer p95-SLO von 2 s 404 zurückgibt.
Live-vs-backup asymmetry. Live revocation is 2 s p95. Backup-retained copies of the canonical match record follow the compliance-retention schedule documented below (7 d / 1 y / 7 y) — those copies are encrypted at rest under our KMS key, are NOT served to anyone except the operator under restore, and on restore the erasure event re-applies automatically so restored projections never re-introduce the revoked replay.
Erasure and backup-asymmetry
When you delete your account, we erase your identity from every live system within 10 seconds: leaderboard, match history, rating, share-consent records, and any published replay artifacts. The match-event log is retained, but every reference to your playerId is rewritten to a one-way pseudonym (deleted-<HMAC>) so the audit trail survives without your name in it.
Backup-asymmetry disclosure. Live systems erase within 10 s. Backups follow a different schedule: encrypted snapshots of the canonical match-event log are retained for 7 days (operational rollback), 1 year (legal-hold), and 7 years (long-term compliance archive — minimal, KMS-encrypted). When a backup is restored, the erasure is re-applied automatically via the player_erased event so the restored projections never re-introduce your name. You will not see your data on any restored live system at any point.
Your rights remain exercisable across the backup lifecycle: request a fresh erasure at any time and the live re-application kicks in within 10 s; request a portability export (Article 20) and we ship your match history + rating + settings in canonical JSON. The backup-retention asymmetry exists because regulators require us to keep the operational rollback path; it does NOT mean your erasure can be undone.