This policy explains what information Quoridor.online (“we”, “us”) handles when you visit the site, play Quoridor, or contact us. We keep it short because we collect very little: there are no accounts, no advertising and no analytics.
In short: games against the computer and on one device stay in your browser; the site sets no cookies; it loads nothing from other companies; and the little that online play needs is kept in memory only, for minutes.
1. Information we collect and why
- Playing against the computer or on one device. These games run entirely in your browser. Your moves are not sent to us or stored.
- Online play. To play online or in a private room you type a display name. Our game server holds that name, a random seat token that identifies your seat, your moves, and the time you were last connected, for as long as the game or room exists. No account, email address or password is involved.
- Network address. Your IP address reaches our server with every request. The game server keeps it in memory for about a minute so it can limit abuse, such as creating rooms too fast.
- Technical data from your visit. Like any website, our web server receives your IP address and basic details of each request. Section 2 explains how this is used.
- Messages you send us. If you write to us, we receive your message, your email address and anything else you include. Section 9 explains how.
We use this information only to run the site and the game, keep it secure and working, prevent abuse, and answer you. We do not sell it, rent it, or use it for advertising or profiling, and we do not make automated decisions about you.
Where the law asks for a legal basis (for example under the GDPR), we rely on our legitimate interest in running and securing a free game site, and on your request when you contact us. This processing is minimal and short-lived.
2. Server logs, analytics and cookies
- Server logs. When your browser requests a page, our web server and hosting provider receive technical information such as your IP address, the date and time, the page or file requested, the response status and usually your browser and device type. Our own server logs record the request and IP address but replace room identifiers and matchmaking tickets with a placeholder, so a log cannot be used to enter a room. We use logs to keep the site secure and reliable and to investigate faults and abuse. They are kept only as long as needed for those purposes.
- Analytics. The site does not use analytics, advertising or tracking tools. If that changes we will update this policy first and, where the law requires it, ask for your consent.
- Cookies. The site does not set cookies, so there is no cookie banner. Section 3 describes the one other kind of browser storage it uses.
3. Local storage in your browser
Local storage is a small area of your browser where a site can keep data on your device. It is not sent to us with page requests.
When you create or join an online room, your browser stores a small entry under the name quoridor.seat. followed by the room's identifier. It contains your seat token, your seat number and the display name you chose. It lets you reload the page or recover from a dropped connection and keep your seat. The entry is removed when you leave the room. If you close the tab without leaving, it stays until you clear it, but it stops working once the room has expired.
Local storage is used only to make the game work as you asked, never for tracking. If you block or clear it, the site still works; you just cannot resume an online seat after a reload.
4. Third-party services and embedded content
- Nothing from other companies is loaded. Pages load scripts, styles, fonts and images only from Quoridor.online itself, and the site's security headers block anything else. There are no embedded videos, social-media buttons, advertising or analytics scripts, and no third-party cookies.
- Hosting. The site and its game server are run by hosting providers who process requests on our behalf, including the technical data in section 2. They act as our service providers and have their own policies for the logs they keep.
- Email. The form on the contact page does not send anything itself. It prepares a message in your own email app, and nothing is sent until you press send there. Your email provider and ours then handle that message under their own policies.
- Links to other sites. If you follow a link to another website, that site's own privacy policy applies.
5. Multiplayer rooms, usernames and shared links
- Usernames are display names, not accounts. They are 2 to 20 characters. Please do not use your real name, your email address or anything else that identifies you. Two players may choose the same name.
- Who sees your name. Your opponent sees your display name. Anyone who opens a private-room invitation before it is full can also see the host's display name.
- Shared links and codes act like keys. A private room is reached through a long random link and a short pairing code. Anyone who has the link or code while a seat is open can take that seat, so share it only with the person you want to play. Room pages ask search engines not to index them and are served so that the page address is not passed on to other sites.
- Matchmaking. If you ask to be matched with a stranger, your display name and a temporary ticket wait in a queue in the server's memory until an opponent is found. The ticket is dropped if your browser stops checking in for about 20 seconds.
- No chat. There is no free-text chat between players, so the only text you share with an opponent is your display name.
- Everything is in memory. Rooms are not written to a database or to disk. If the game server restarts, active rooms are lost.
6. Data retention and deletion
- Rooms and display names: deleted automatically. A room nobody has joined expires after 30 minutes. A finished game stays for up to 10 minutes so that either player can ask for a rematch. A room whose players have both left is deleted after about 5 minutes.
- Matchmaking tickets: dropped after about 20 seconds without a check-in, and in any case after 10 minutes.
- IP addresses used for abuse limiting: held in memory for about a minute.
- Seat token in your browser: removed when you leave the room. You can also delete it at any time through your browser's site-data settings.
- Server logs: kept only as long as needed for security and fault-finding, then deleted.
- Emails to us: kept for as long as needed to answer you and keep a record of the conversation, then deleted. Ask us at any time to delete yours.
- Games against the computer and on one device: nothing is stored, so there is nothing to delete.
Because the site has no accounts, we cannot look up data by name. To have information removed sooner, contact us (section 9) and tell us what you want removed, as precisely as you can.
7. Children's privacy
Quoridor is a family game, and the site needs no account or personal details. We do not knowingly collect personal information from children, and we do not direct advertising or tracking at anyone. Online play asks only for a display name. Children should pick a nickname rather than their real name and ask a parent or guardian before playing online. If you believe a child has given us personal information, contact us and we will delete it.
8. Your rights and applicable law
Depending on where you live (for example in the European Economic Area, the United Kingdom or California), you may have the right to:
- ask whether we hold personal information about you and get a copy;
- have inaccurate information corrected, or have your information deleted;
- restrict or object to how your information is used, and receive it in a portable format where that applies;
- withdraw consent where we relied on it; and
- complain to your local data-protection authority.
We do not sell or share personal information for advertising, and we will not treat you differently for exercising your rights. The data our game server holds about a game (a display name, a seat token and an IP address in memory) is deleted within minutes, so there is usually nothing left to give you, correct or erase by the time a request could be answered. To make a request, contact us as described in section 9. We may need details that let us find the data and confirm that it is yours, and we will reply within the time the law requires.
9. Contact information
For questions about this policy or to make a privacy request, email lahssanyassine1@gmail.com or use the contact page. Please do not include passwords or other sensitive details in your message.
10. Effective date and update history
This policy is effective from . When we change it, we update the date and add an entry below. If a change materially affects how your information is used, we will say so on the site before it takes effect.
- : First full version of this Privacy Policy. It replaces the earlier draft placeholder.