Privacy policy

Last updated 9 September 2026.

1. Introduction

This privacy policy explains how ComePlayAlong.com (“ComePlayAlong”, “we”, “us”) collects, uses, stores and shares personal information when you visit comeplayalong.com, play our games, create an account or contact us.

We collect only what is needed to operate the service, keep it secure and improve the games. We do not sell personal information. We do not use third-party advertising or tracking scripts.

2. Who we are

ComePlayAlong.com is a browser-based games service. For privacy enquiries, use the feedback form.

3. Information we collect

Guest play

You may join a game from an invite link without creating an account. In that case we store the display name you choose and a random identifier in a cookie on your device, so the game can recognise you between turns. That identifier is not linked to your real name, email address or physical address. If you later create an account, we attach the games you have already played to it so your history is not lost. That is the only use of the guest identifier.

Accounts

When you create an account we store:

  • your email address, used to sign in and to contact you about your account;
  • your display name, which other players at your table can see;
  • your last-seen country (a two-letter code from Cloudflare), stored on your account for first-party visit measurement — other players do not see it, and we do not store a city;
  • your password, stored only as a one-way bcrypt hash;
  • the date you registered, the date you last signed in, and whether you asked to receive occasional emails about new games.

Marketing email is sent only if you opt in. You may withdraw that consent at any time in your account settings.

Game activity

We record what happens in a game: when a table was created, who joined, which rounds were played, how the game ended and how far it progressed. If you are signed in, those records are linked to your account so you can view your own history. We also use them to understand which games work well and which do not.

Feedback

If you send a message through the feedback form, we store the message, the page you were on, and your email address if you choose to provide one. This information is used only to read and reply to your message.

Usage information

We measure visits ourselves. We do not use Google Analytics or any comparable third-party analytics service.

Visit measurement does not use a cookie. We create a short-lived identifier by hashing your IP address together with your browser type and a secret. The identifier changes every day and cannot be used to follow you across days. We record the page you arrived on, the referring site if one is present, approximately how long you stayed and how far you scrolled. Your country is provided by Cloudflare, which sits in front of the site.

Abuse prevention

When you create an account or submit feedback, we check your IP address against AbuseIPDB to prevent sign-ups and messages from networks that have been reported for abuse in the previous 365 days. We do not store that result against your account.

4. How we use information

We use personal information to:

  • provide and operate the games, including guest play and signed-in history;
  • record your last-seen country for first-party visit measurement — other players do not see it;
  • create and administer accounts, and authenticate you;
  • send transactional email, such as address confirmation and password resets;
  • send occasional product email, only where you have opted in;
  • read and respond to feedback;
  • understand how the site and games are used, using first-party measurement;
  • protect the service against abuse, spam and unauthorised access;
  • comply with the law and enforce our terms of use of the service.

5. Legal bases

Where the General Data Protection Regulation applies, we process personal information on the following bases:

  • Contract. Creating an account, signing in, playing, and sending transactional email that the account requires.
  • Consent. Optional marketing email, and any optional email address you give on the feedback form.
  • Legitimate interests. First-party usage measurement, service security, abuse prevention, and maintaining email deliverability (including suppression of addresses that bounce or mark mail as spam).

6. Cookies

We set the following first-party cookies:

  • cpa_guest — a signed random identifier so a guest can keep a seat at a table and later claim their history. Expires after one year.
  • cpa_id — your sign-in session. Expires when you close the browser.
  • cpa_remember — set only if you choose “keep me signed in”. Expires after 60 days.
  • cpa_lang — which language to show. Set when we detect your browser language or when you pick one. Expires after one year.

These cookies are strictly necessary for the service to function. We do not use cookies for advertising or for tracking you on other sites.

7. Email

We send two kinds of email. Transactional email is sent because of something you did: confirming your address, resetting your password, or a note when your account is created. Product email about new games is sent only if you opted in.

Every product email includes an unsubscribe link. Your email application’s own unsubscribe control is honoured as well. Either takes effect immediately, including on messages already queued. Unsubscribing does not stop transactional email, because that mail is required to operate the account.

We keep a record of what we sent, when, and whether it was delivered, for one year. If a message hard-bounces, or is reported as spam, the address is added to a suppression list and we stop sending to it.

8. Service providers

We use the following processors to operate the service. They receive only what is required for their role. We do not sell or rent personal information, and we do not share it for advertising.

  • Cloudflare — content delivery and security. Cloudflare sees the requests your browser makes to the site.
  • Linode — hosting of the application and database.
  • Amazon Simple Email Service — delivery of email. Amazon sees the recipient address and the message.
  • AbuseIPDB — IP reputation checks at registration and on the feedback form. AbuseIPDB receives the IP address for that check.

9. How long we keep information

  • Account information is kept until you delete the account.
  • Game records linked to an account remain available in your history until the account is deleted. After deletion they are retained only in anonymous form.
  • Raw visit records are kept for 90 days and then deleted. Anonymous daily totals are retained.
  • Email delivery records are kept for one year.
  • Feedback is kept for as long as it is needed to handle the enquiry.
  • Guest and session cookies expire as described above.

10. International transfers

Some of the providers listed above are located outside the European Economic Area. Where personal information is transferred internationally, we rely on the safeguards those providers make available for such transfers, including Standard Contractual Clauses where applicable.

11. Your rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected, to object to or restrict certain processing, to withdraw consent where processing is based on consent, and to request deletion of your account and the personal information attached to it.

Deleting an account removes your email address, display name and the link between you and your games. Anonymous game statistics remain, because they no longer identify anyone.

You can delete your account yourself from account settings. The deletion takes effect immediately. You may also ask us to do this, or to exercise any of the rights above, through the feedback form.

12. Children

The service is not directed at children under 13, and we do not knowingly create accounts for them. A child may play as a guest by invitation without providing an email address or other contact details.

13. Changes to this policy

We may update this privacy policy from time to time. The “Last updated” date at the top of the page will change when we do. If a change materially affects what we collect or how we use it, we will provide a more prominent notice.

14. Contact

For questions about this policy or about your personal information, use the feedback form.