Privacy Policy

1. Data we collect

When you sign up:

• Email address — used for verification, password reset, and sign-in.
• Username / display handle — shown to opponents in chat and on the leaderboard.
• A salted, hashed copy of your password (argon2id). We never store the plaintext.
• An avatar — either a preset glyph or an image you upload.

When you play:

• Game results, move logs, Elo, wins / losses (your match history).
• An identifier linking each match to your account.

Automatically:

• IP address — used briefly for rate-limiting and abuse signals.
• Cookies for keeping you signed in (see section 2).
• Usage data through Google Analytics when analytics is enabled (pages viewed, approximate location, device and browser, and the site that referred you), set only with your consent where it is required.

2. Cookies and similar technologies

• Session cookie (HttpOnly, Secure, SameSite=Lax). Keeps you signed in. Mandatory for using an account.
• Per-tab session storage. Stores your in-progress room handle so a refresh doesn't kick you out of a game. Cleared on tab close.
• Advertising cookies (Google AdSense). Set only when ads are enabled. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites; AdSense may also frequency-cap and measure ad performance. In regions where it is required (including the EEA, the UK, and Switzerland) we show a consent prompt before any advertising cookies are set, and you can change your choice at any time. You can review how Google uses cookies in advertising at policies.google.com/technologies/partner-sites, and manage ad personalisation at adssettings.google.com.
• Analytics cookies (Google Analytics). Set only when analytics is enabled, to measure how many people visit and how they find and use the site. In regions where consent is required (including the EEA, the UK, and Switzerland) they are set only after you agree through the same consent prompt described above, and we use Google Consent Mode so nothing with identifiers is stored until you choose.

3. How we use your data

To provide the game, authenticate you, calculate Elo, show match history, prevent abuse, send transactional email (verification, password reset), and — where the admin has enabled it — serve ads. We do not sell your data.

4. Third parties

• Resend — sends our transactional email. Data shared: your email, the message body.
• Google AdSense (when ads are enabled) — serves advertisements and sets the cookies described in section 2.
• Google Analytics (when analytics is enabled) measures site traffic and usage, and sets the analytics cookies described in section 2.
• Neon — managed PostgreSQL. Stores accounts and match data.
• Heroku — hosts the web app and websocket server. Receives request logs.

Each provider has its own privacy policy. You are free to review them.

5. Account deletion and your rights

You can delete your account from the Profile page → Danger Zone. Deletion removes your account, your sessions, and your personal data. Your past matches are unlinked from your account, so nothing in them points back to you. To keep your former opponents' own game history intact, each match keeps a snapshot of the handle and avatar you were using when it was played; that snapshot is no longer tied to any account.

If GDPR or UK GDPR applies to you, you also have the right to access, correct, port, and object to processing of your personal data. Email contact@wallz.gg.

6. Children

Wallz is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has signed up, contact us and we will delete the account.

7. Changes

We may update this policy. The "Effective" date above will move when we do. Material changes will be highlighted on the home-screen banner.

8. Contact

Questions or requests: contact@wallz.gg.