Privacy Policy

1. Data we collect

When you sign up:

• Email address, used for verification, password reset, and sign-in.
• Username / display handle, shown to opponents in chat and on the leaderboard.
• A salted, hashed copy of your password (argon2id). We never store the plaintext.
• An avatar: either a preset glyph or an image you upload.

When you play:

• Game results, move logs, Elo, wins / losses (your match history).
• An identifier linking each match to your account.
• In-game chat: the message text, the handle of the sender, and a timestamp. We store and retain chat for safety and moderation review, including for anonymous (signed-out) players. Messages our filter blocks are also retained as evidence for moderation.

Automatically:

• IP address, used briefly for rate-limiting and abuse signals.
• Cookies for keeping you signed in (see section 2).
• Usage data through Google Analytics when analytics is enabled (pages viewed, approximate location, device and browser, and the site that referred you), set only with your consent where it is required.

2. Cookies and similar technologies

• Session cookie (HttpOnly, Secure, SameSite=Lax). Keeps you signed in. Mandatory for using an account.
• Per-tab session storage. Stores your in-progress room handle so a refresh doesn't kick you out of a game. Cleared on tab close.
• Consent cookie(CookieConsent, first-party). Records the consent choice you make in the cookie banner so we don't ask again on every visit. Set by our consent provider, Cookiebot, and kept for about 12 months. You can change your choice at any time with the "Cookie settings" link in the footer.
• Advertising cookies (Venatus and Google AdSense). Set only when ads are enabled. Our advertising partner, Venatus Media Limited, runs the ad auctions on the site, and third-party vendors taking part in those auctions, including Google, use cookies to serve ads based on your prior visits to this and other websites, to frequency-cap, and to measure ad performance. In regions where it is required (including the EEA, the UK, and Switzerland) we show a consent prompt before any advertising cookies are set, and you can change your choice at any time. You can review how Google uses cookies in advertising at policies.google.com/technologies/partner-sites, and manage ad personalisation at adssettings.google.com.
• Analytics cookies (Google Analytics). Set only when analytics is enabled, to measure how many people visit and how they find and use the site. In regions where consent is required (including the EEA, the UK, and Switzerland) they are set only after you agree through the same consent prompt described above, and we use Google Consent Mode so nothing with identifiers is stored until you choose.

3. How we use your data

To provide the game, authenticate you, calculate Elo, show match history, prevent abuse, send transactional email (verification, password reset), and, where the admin has enabled it, serve ads. We do not sell your data.

4. Third parties

• Resend sends our transactional email. Data shared: your email, the message body.
• Venatus (Venatus Media Limited, when ads are enabled) manages the advertising on the site: it runs the ad auctions, and it and the vendors bidding in them set the advertising cookies described in section 2, subject to the consent choice you make in the cookie banner.
• Google AdSense (when ads are enabled) serves advertisements and sets the cookies described in section 2.
• Google Analytics (when analytics is enabled) measures site traffic and usage, and sets the analytics cookies described in section 2.
• Cookiebot (Usercentrics) runs our cookie consent banner and records your choice in the consent cookie described in section 2. Where consent is required, Google Consent Mode keeps analytics and advertising cookies from being set until you agree.
• Neon, managed PostgreSQL. Stores accounts and match data.
• Heroku hosts the web app and websocket server. Receives request logs.

Each provider has its own privacy policy. You are free to review them.

5. Account deletion and your rights

You can delete your account from the Profile page → Danger Zone. Deletion removes your account, your sessions, and your personal data. Your past matches and any chat messages you sent are unlinked from your account, so they no longer point back to you. To keep your former opponents' own game history intact, each match keeps a point-in-time snapshot of the handle and avatar you were using, and chat keeps the message text; once you delete, neither is tied to any account.

How long we keep data: your account data exists while your account does. Match and chat records are retained while your account is active and, after deletion, kept only in the unlinked, account-free form described above so your former opponents keep their own history. Server request logs are short-lived. You can ask us to remove your data sooner by emailing contact@wallz.gg.

If GDPR or UK GDPR applies to you, you also have the right to access, correct, port, and object to processing of your personal data. Email contact@wallz.gg.

6. Children

Wallz is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has signed up, contact us and we will delete the account.

7. Changes

We may update this policy. The "Effective" date above will move when we do. Material changes will be highlighted on the home-screen banner.

8. Contact

Questions or requests: contact@wallz.gg.