Privacy

Last updated 26 August 2026.

This is a small site run by one person. The short version: we collect as little as we can get away with, we do not sell anything to anyone, and there are no third-party advertising or tracking scripts on any page.

Playing without an account

If a friend sends you an invite link, you can play without giving us anything but a display name. We store that name and a random identifier in a cookie on your device so the game knows which player you are between one turn and the next. That identifier is not linked to your real name, your email or your address.

If you later create an account, we attach the games you already played to it, so your history is not lost. That is the only thing the guest identifier is ever used for.

If you create an account

We store:

• Your email address, used to sign in and to contact you about your account.
• Your display name, which other players at your table can see.
• Your password, stored only as a bcrypt hash. We cannot read it, and neither can anyone who steals the database.
• When you signed up, when you last signed in, and whether you asked for occasional emails about new games.

If you ticked the box for occasional emails, you can untick it at any time and we will stop. We do not send marketing to people who did not ask for it.

Email we send

There are two kinds. The first is email you asked for by doing something: confirming your address, resetting your password, a note when your account is created. The second is occasional email about new games, and you only get that if you ticked the box.

That second kind includes a weekly recap of your own play: how many tables you sat at, how they went, and the names of the people you played with. It is built from the same game records described above, it is only sent in a week you actually played something, and it never arrives to tell you that you have been away.

Every message of the second kind carries an unsubscribe link, and your email program's own "unsubscribe" button works too. Either one takes effect immediately, including on anything already waiting to be sent. Unsubscribing never stops the first kind, because you would then have no way to reset your own password.

We keep a record of what we sent you, when, and whether it arrived, for one year. If a message bounces permanently, or you report one as spam, your address is added to a suppression list and we stop sending to it. Mail is delivered through Amazon Simple Email Service, which necessarily sees the address and the message.

If you send us feedback

The feedback form stores what you wrote, the page you were on, and your email address if you chose to give one. It is only used to read and reply to what you sent.

Game records

We record what happens in a game: when a table was created, who joined, which rounds were played, how it ended and how far it got. This is how we find out which games are worth building and which are not working. If you are signed in, those records are linked to your account so you can see your own history.

Visitor statistics

We count visits ourselves rather than using Google Analytics or anything like it. No advertising network, data broker or analytics company receives anything about you from this site.

Visit counting does not use a cookie. Instead we build a short-lived identifier by hashing your IP address together with your browser type and a secret, and that identifier changes every day. It lets us tell a returning visitor from a new one within a single day, and after that the link is gone. We keep the raw records for 90 days and then delete them, keeping only anonymous daily totals.

We also record which page you arrived on, which site sent you, roughly how long you stayed and how far down the page you scrolled. Your country comes from Cloudflare, which sits in front of this site.

Cookies we set

• cpa_guest — a signed random identifier so a guest can keep their seat at a table and later claim their history. Expires after a year.
• cpa_id — your sign-in session. Expires when you close the browser.
• cpa_remember — only if you tick "keep me signed in". Expires after 60 days.

All three exist to make the thing you asked for work. None of them are advertising or tracking cookies, and none of them follow you to other sites. That is why you are not being shown a cookie banner: there is nothing here to consent to beyond the site functioning.

Who else can see this

Cloudflare passes traffic to the site and can see the same requests your browser makes. The server is rented from Linode. Nobody else receives your data, and we do not sell or share it.

What you can ask for

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask us to delete your account and everything attached to it. Deleting an account removes your email, name and the link between you and your games. Anonymous game statistics remain, because they no longer identify anyone.

You do not have to ask us to delete it. There is a delete button in your account settings that does exactly what this page describes, straight away and without going through anyone. If you would rather we did it, that is fine too.

To ask for any of that, or if something here is unclear, get in touch through the site.

Children

This site is not aimed at children under 13, and we do not knowingly create accounts for them. A child can play as a guest by invitation without giving us anything.

Changes

If this policy changes, the date at the top changes with it. If a change materially affects what we collect, we will say so rather than quietly edit the page.