Privacy
CrownDuet uses account and game data to run matches, keep your history, support players and improve the service. This page may change as the service changes.
What CrownDuet stores
- Your account
- Your display name, your email address and whether it was verified through Google or an email code, a link to your profile picture, and your language. Also your account status, the times your account was created, changed, signed in to, and last active, and the roadmap features you voted for. Roadmap votes are linked to your account; only vote totals are public.
- Your Google link
- Your Google account id, and the profile details Google sends at each sign-in: email address, verified flag, name, picture link, and language. No Google password and no Google token is kept once the sign-in has been checked.
- Your email link
- Your normalized email address, linked to your account after verification, and the times that link was created and last used. No password is needed or stored.
- Your play statistics
- Games played, won, lost, drawn, and ended with no contest. Rounds played, time played, your current streak, your best streak, and the dates of your first and last game.
- Your sessions
- One row for each signed-in browser. It holds a one-way hash of the sign-in cookie, never the cookie itself. It also holds when the session was created, when it expires, when it was last seen, and when it was revoked.
- Sign-in attempts
- Google sign-in attempts hold one-way hashes and times, plus whether the attempt was completed or refused. Email sign-in attempts hold your normalized email address, a one-way code digest, a browser-binding hash, a try count, and creation, expiry, and completion times. The code itself is not stored.
- Your matches
- For each game: the time control, whether the pairing was public or by passphrase, the status, the times, and the result with its reason. For each player: the colour they had and the result they got.
- Your private match feedback
- A score from one to five that you choose after a match, linked to your account and that match. It is kept with the match record and used in service reporting.
- Feedback and support reports
- Your feedback text, subject, category, optional match ID and image attachments, linked to your account. Reports and images are private and available to authorized operators for support, investigation and improvement. Images are stored using Cloudflare R2. Operator actions and resolution notes are recorded.
- Operational incidents
- Technical identifiers, times and diagnostic codes help operators investigate failed or inconsistent game records.
- Lobby counts
- Counts of games in progress, games finished this month, games finished in total, and registered players. These are totals, and they name nobody.
How long it is kept
A session is deleted 30 days after it expires.
Google and email sign-in attempts are deleted 24 hours after they expire.
Match records are kept as shared game history. Feedback reports and attachments are kept for support and follow-up; there is no automatic deletion period for them. Ask through Support if you want a report or attachment removed.
Removing your data
Ask through Support to remove your account data. Your display name, email address, picture link and language are removed, and your account is marked deleted. Your Google and email links are deleted, and sessions are revoked. Email sign-in attempts follow the expiry retention above. Match records remain without your name. Mention feedback or screenshots separately so personal details in them can be reviewed for removal.
Cookies
One cookie keeps you signed in. Signing in with Google or email adds a second short-lived cookie that binds that attempt to your browser. It is removed when that sign-in finishes or expires shortly afterwards. These cookies cannot be read by page scripts. There is no analytics cookie and no third-party tracker.
Logs
Technical logs help diagnose failures and protect the service. Application diagnostics avoid sign-in codes, session tokens and feedback contents. Hosting providers may process request information to deliver and secure the service.
Signing in with Google
When you choose Google, that sign-in step happens at Google, and Google's own privacy policy applies to it.
Sending email
Email codes are delivered through Cloudflare Email Sending from mail.crownduet.com. CrownDuet gives Cloudflare your email address and the sign-in message, including the code, so it can deliver the email.