Privacy

This is a small site for playing a board game. It collects what it needs to run the games and nothing else.

What is stored about you

  • Your account: the name you chose, your e-mail address, your password as a one-way hash, when you registered and when you last signed in. Nobody, including whoever runs the site, can read your password back.
  • Your games: which games you joined, the cities you were dealt, where you built and what you scored.
  • The rankings: your name and results appear in the standings and, if you finish a month in the top three, in the hall of fame.

Your name is visible to other players. Your e-mail address is not: it is used to sign you in, to confirm the address when you register, and to send a reset link if you forget your password.

A new account cannot sign in until you follow the link we mail you. That is how we check the address is yours, so that nobody can sign up under someone else's.

If you switch on turn notifications, your browser gives us an address to send them to and two keys to encrypt them with. We store those three values against your account, one set per device. They are the browser's, not ours: they only let us send that browser a message it can read, and they cannot be used to identify you anywhere else or to read anything back. Switch the notifications off, or clear the site's data, and the record goes.

Cookies

  • A session cookie, so the site knows it is still you between pages.
  • A sign-in cookie lasting 30 days, only if you tick "keep me signed in". Signing out removes it.
  • A short-lived form cookie that guards against other sites submitting forms on your behalf. It is discarded as soon as the form is handled.

There is no advertising, no analytics and no tracking of any kind.

E-mail

The only message this site sends is the password reset link, and only when you ask for one.

Other people

Your data is not sold, shared or passed to anyone else. The site runs on its own server; the web server keeps ordinary access logs, which include IP addresses, and error logs are kept to fix faults.

Removing your account

Accounts are disabled rather than deleted, because finished games have to keep showing who played them. A disabled account can no longer sign in and takes no further part. If you want your name and address removed outright, ask and we will do it; the games you played will stay, without you named on them.

Getting in touch

For anything on this page, or to have your data removed, contact Garak.