Privacy Policy

This policy explains what information TheQuoridor.com collects when you play Quoridor with us, how we use it, and the choices you have. We try to keep things simple: we collect what we need to run the game and protect the community, and nothing more.

1. Information we collect

Account info. The email address, username, and hashed password you provide at signup. Optional profile info such as an avatar and a bio if you choose to add them. Your country: we set it from the country your connection comes from unless you pick one, and you can change it, clear it, or hide it from other players.
Gameplay data. Games you play, moves, time controls, ratings, puzzle attempts, friends, streaks, and bot match history.
Messages. The text of friend messages, chat messages sent during games, and reports you submit about other players.
Purchases and subscriptions. A record of coin purchases and of your subscription plan and its status. Payment card details are handled by Stripe — we receive only a payment token and metadata such as the last four digits and card brand.
Technical info. IP address, browser/device type, language, and basic usage logs. Cookies and similar storage are used to keep you logged in and to remember preferences such as theme. If you play without an account, a cookie ties your guest games to your browser so you can return to them — and keep them if you later sign up.

2. How we use your information

To run the game: matchmaking, ratings, leaderboards, game replay, puzzles, friend lists, and notifications.
To process purchases and manage your subscription.
To send transactional emails such as email verification, password resets, and important account notices.
To detect cheating, abuse, fraud, and rating manipulation.
To investigate reports and enforce our community rules.
To improve gameplay — for example, by tuning bot difficulty or fixing bugs.

3. Messages and moderator review

Friend messages and in-game chat are stored on our servers and are not end-to-end encrypted. When a message or conversation is reported, or when our automated systems flag possible Code of Conduct violations, our moderators may read those messages to decide what action to take. Moderator access is logged in an audit trail. Please don't share sensitive personal information (such as government IDs, payment details, or passwords) over chat.

4. What other players can see

Your username, avatar, bio, country (unless you hide it), ratings and number of games for each time control, the number of puzzles you have solved, your plan, whether you are online, and your friends list are visible to other players, as are your username, country, rating and scores on the leaderboards. If you turn on "Hide stats from non-friends", your profile shows your ratings, puzzle count and level only to you and your friends; the leaderboards still show your rating and scores. Games you play in public modes — matchmaking, the lobby and ranked play — can be watched by anyone with the game's link while they are in progress, and afterwards signed-in players can see how they ended (the move list stays with the players). Games in private rooms and friend challenges are visible only to their players. Your email address, purchase history, and private messages are not shown publicly.

5. Third-party services we use

Stripe — to process coin purchases and subscriptions.
Cloudflare — for hosting protection, bot detection (Turnstile), and traffic routing. Cloudflare may see your IP address and request metadata, and tells us which country a connection comes from.
Hetzner — runs the servers that host the site and the game.
Supabase — hosts our database and, if you upload one, your avatar image.
SMTP2GO — sends our emails: verification emails, password resets, and important notifications.
Sentry — receives error reports from our servers so we can fix bugs. A report can include your IP address, browser details and the request that failed; we strip cookies from every report before it is sent.
Google Analytics — measures how the site is used, loaded only after you accept analytics cookies (see section 6).
OAuth sign-in providers (Google, Apple) — only if you choose to sign in with one of them. We receive the basic profile info needed to create or link your account.

Adsterra — our display-advertising partner, whose ads help fund the free game. Every ad runs inside a sandboxed frame that cannot read this page or your session, and cannot set or read cookies on your device. Adsterra receives your IP address and browser details to choose which ad to show. Ads are shown whether or not you accept marketing cookies.
Google AdSense — an advertising partner we may use once the site is approved for it, under the same rules as above.

Each of these services has its own privacy policy, and we share with them only the data needed for them to do their job.

6. Analytics & advertising

We use Google Analytics (GA4), loaded through Google Tag Manager only after you consent to analytics cookies, to understand site usage. Display ads come from Adsterra (and from Google AdSense if and when the site is approved). They are shown whether or not you accept marketing cookies, and they render in sandboxed frames that cannot read the page you are on or set cookies on your device. Your cookie choice controls analytics and Google's advertising-consent signals, not whether an ad appears. You can change your choice at any time.

Ads are shown only in the countries we have switched them on for, and never to visitors in the European Economic Area, the United Kingdom or Switzerland: we decide this on our server from the country your connection comes from, before any ad code is sent to your browser.

You can change your cookie choices at any time from the cookie banner or the in-app privacy page.

7. Data retention

We keep your account data for as long as your account is active. Game records and chat messages are retained while they are useful for the leaderboard, rematches, and moderation review. Backups and audit logs may be kept for a limited period after deletion to protect the community and comply with the law.

8. Your rights and how to delete your data

You can view and edit your profile info from the Profile Edit page at any time.
You can request deletion of your account from your account settings. Once processed, your personal information will be removed and your gameplay history will be anonymized, except where we're required to keep records (for example, billing records or moderation evidence).
Depending on where you live, you may also have the right to access, correct, export, or restrict use of your data. Reach out through our contact page and we'll respond.

9. Children's privacy

TheQuoridor.com is not directed at children under 13. If you believe a child under 13 has registered an account, please contact us so we can remove it.

10. Changes to this policy

If we make material changes to this Privacy Policy we'll let you know in-app or by email before the changes take effect.

11. Contact

Questions about this policy or your data? Reach us through the contact page — we'd love to hear from you.