Mario Ruiz Sánchez · Senior Software Engineer in Reykjavík

Privacy

What this site stores, why, and how to ask for a deletion. Responsible: Mario Ruiz Sánchez, [email protected].

Comments

On each Play page, "Leave a comment" sends a private note. It is not published on the site. The server stores the game id, the text, the time in UTC, an optional email, and the country code Cloudflare attaches to the request. It does not store the IP address, the browser, or a cookie with that comment.

The optional email is removed 12 months after the comment, the next time the private comment list is opened. The text of the comment stays until it is deleted.

To limit spam, the server keeps a short counter keyed by a hash of the IP address: 3 comments an hour and 10 a day, plus a site-wide cap of 10 comments an hour. Those counters expire within about two days. They are not stored on the comment.

When a Cloudflare Turnstile widget is configured, it runs invisibly in the background to check you are a person before the comment is accepted. The widget is loaded from Cloudflare. See Cloudflare's Turnstile Privacy Addendum.

Clicks

Public pages include a first-party script that counts clicks and page views (contact, CV, navigation, and similar). It does not set a tracking cookie. For 90 days the server keeps totals, the page path, a short label, the destination, the country code, and a coarse device type (mobile or desktop). A hash of the IP address is used only to count a visitor once that day. It ages out with the same 90-day window.

To opt out of those counts in a browser, set localStorage key mr_stats_off to 1, or the cookie mr_stats_off=1. The private panel has a button that does this.

Cloudflare Web Analytics

Public pages load a Cloudflare Web Analytics beacon. It counts visits and page views. Cloudflare Web Analytics does not use cookies. The token in the page identifies this site to that beacon. It is not an account password.

How long Cloudflare keeps those visit records is set by Cloudflare Web Analytics, not by a retention number in this site's code. The private panel stores a snapshot of the totals and refreshes it when the panel is opened.

Play rooms

If you play with someone, the room keeps the board and the names typed in that room. After 30 minutes with nobody connected, the room and those names are deleted. Voice and camera, when a game uses them, go from browser to browser. They are not recorded here.

To open that connection the page contacts two STUN servers: stun.cloudflare.com and stun.l.google.com (Google). Google receives the network address of the browser as part of that lookup. There is no media server in between.

Private area

The private stats area is not linked from the public pages and asks for a password. A failed sign-in increments a counter keyed by a hash of the IP address. After five failures in 15 minutes, that address receives HTTP 429 for 15 minutes. The counter expires with that window. The address is not stored in the clear, and the password is not written in the log.

This browser only

Some games keep scores or settings in localStorage on the device. That data is not sent to the server, except when you submit a comment or the click counter runs.

Deletion

Email [email protected] and say what should be removed (for example the text of a comment, or the email address on it). Mario Ruiz Sánchez will delete that comment. If the email is still stored, it goes with the comment.