Privacy Policy

What we collect, why we collect it, how to delete it. Effective 6 June 2026 · last updated 11 October 2026.

Who we are

DotDuel is an independent two-player dot-coloring game, available at www.dotduel.com and as an Android app. The controller of your personal data under the GDPR is the developer. Contact: donstn@gmail.com.

What we collect

Only what's needed to make the game work, stay fair, and (with your consent) support the free service with advertising.

Account: email, display name, sign-in provider (Google or password), account creation date. Source: you, via Supabase Authentication at sign-up.
Multiplayer rating: your current Elo, placement-games counter, and last-played timestamp. Computed server-side at the end of every ranked match.
Match history: each ranked match stores both players' user IDs, display names, final scores, rating changes, board shape, time control, duration, and how the game ended (normal / timeout / resign / aborted).
Live game state: while a multiplayer game is in progress we store the board, clock, and whose turn it is. Deleted shortly after the game ends.
Friends & invites: your friend list, pending friend requests, online status, and game invites. If you joined through another player's invite link or QR code, we record which player invited you (their random invite code — so future referral rewards can be honoured).
Daily puzzle results: for each daily puzzle you finish — your display name, best score, number of attempts and finish time. Shown publicly in the daily results calendar.
Device-only data: your single-player progress, vs-AI / hot-seat stats, theme preference, and tutorial-seen flag. Stored in your browser's localStorage and never transmitted to us.
Analytics (only if you accept): Google Analytics auto-collected events — page views, device model, locale, screen size, anonymous session ID. Not tied to your account in our system.
Advertising (only if you accept): Google AdSense serves ads on free single-player and menu screens of the website; the Android app uses Google AdMob the same way. To do so, Google may set cookies / read device identifiers and use them to select and measure ads. We never see ranked multiplayer game screens carry ads, and we do not receive your individual ad-profile from Google.

Why we collect it (lawful bases)

Contract (Art. 6.1.b): account, rating, match history, live game state — all required to operate the multiplayer service you signed up for.
Legitimate interest (Art. 6.1.f): leaderboard and ranked play — to provide a fair, competitive environment for all players.
Consent (Art. 6.1.a): Google Analytics and Google advertising (AdSense on the website, AdMob in the Android app) — both only load after you accept the consent prompt. Decline or no decision means neither starts.

Who it's shared with

We use Supabase (database, authentication, realtime infrastructure and serverless functions, hosted in the EU) as our backend provider, and Google for sign-in (Google OAuth), analytics (Google Analytics), and advertising (AdSense on the website, AdMob in the Android app). Analytics and advertising load only after you accept the consent prompt. Both providers process data under their standard terms / Data Processing Addenda. We do not sell your data, and we do not share it with any other third party.

How long we keep it

Account + leaderboard: until you delete your account.
Match history: up to 24 months after the match ended, then permanently deleted.
Live game state: deleted within ~24 hours of game end.
Daily puzzle results: up to 24 months after the puzzle date, then permanently deleted.
Analytics & advertising: per Google's defaults (currently 14 months for event data); ad cookies per Google's published retention.
Device-only data: stays until you clear your browser data.

Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you — use Download my data in your Profile.
Rectify inaccurate data — use Rename in your Profile.
Erase your account ("right to be forgotten") — use Delete my account in your Profile. Effect is immediate.
Port your data — the download above is a machine-readable JSON file you can take elsewhere.
Object to analytics and advertising — decline the consent prompt, or change your choice at any time from the Privacy panel in the app.
Lodge a complaint with your national data protection authority if you believe we've mishandled your data.

Note on rankings. If you delete your account, your display name and account identifier are scrubbed from all public records. However, the rating changes you caused on other players' Elo are not reversed — past matches are immutable. Opponents keep their rating gains and losses; their match history shows "Deleted player" where your name used to be.

Cookies, consent, and advertising

We do not set tracking cookies ourselves. Our sign-in (Supabase Authentication) uses first-party session storage to keep you signed in. Google Analytics and Google's ad products use cookies / identifiers, but only after you accept.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you are shown a Google-certified consent message before any advertising or analytics cookies are used, in line with the IAB Transparency & Consent Framework. You can grant or refuse consent, and change it at any time.

How to contact us

For any privacy question, data-access request, or complaint: donstn@gmail.com.

Effective date

This policy is effective from 6 June 2026, last updated 12 June 2026 (backend provider corrected from Firebase to Supabase; Android app and AdMob disclosures added). We'll update it here if anything material changes.