Privacy policy

House Of Decks is a personal project, run with no commercial intent beyond covering its own hosting costs. If you have any questions about this policy or your data, you can write to josesuarezfel04@gmail.com.

You don't need to register to play anything. If you play that way, this is all that is processed:

• Player name: whatever you freely type when creating or joining a room. It isn't verified and doesn't need to be your real name.
• Tab identifier: a random identifier saved in your browser's session storage (sessionStorage) so the server knows which seat at the table is yours. It is deleted when you close the tab. A copy is also kept in localStorage for each room you enter, for the sole purpose of getting your seat back if you close the tab by accident. None of this is used to track you across other websites.
• Games and rooms: live in the server's memory for as long as the game lasts and are completely discarded as soon as it ends or the server restarts. No game history is kept.
• Technical data: like any website, the server and Cloudflare process your IP address and standard browser headers in order to serve the page and protect it from abuse.

An account is optional, and only exists to reserve your player name and keep your seat across devices. If you choose to create one, the following is stored permanently in a database on the server:

• Email address: used as the account identifier and to send you a link if you forget your password. It is not used for marketing or newsletters.
• Player name: the one you choose, reserved so nobody else can use it.
• Password: never stored as such. Only a cryptographic hash (scrypt) is kept, from which the original password cannot be recovered. If you only ever sign in with Google, there is no password to store.
• Session: signing in generates a random identifier that travels in a cookie. The server stores only its fingerprint (SHA-256), never the cookie value itself.
• Google link: if you use “Continue with Google”, the identifier Google assigns to your user is stored so you can be recognised next time.
• Quick Play abandon record: if you walk out of a public game in progress, it is noted in order to apply the corresponding warning or temporary ban. It is a counter and an expiry date, not a record of your games.

• Account data is kept for as long as the account exists — that is, until you ask for it to be deleted.
• Sessions expire after 30 days and are removed from the server automatically.
• Password reset links expire after one hour, can only be used once, and are deleted automatically.
• Abandon warnings stop counting after 24 hours without a repeat, and the record is deleted automatically once it no longer has any effect.
• Games are never stored at any point.

Your data is never sold or handed to anyone. The following providers are involved in making the site work, and only with what is strictly necessary:

• Resend (email delivery): receives your email address and the link when you request a password reset. Sending is configured in their European Union region (Ireland), so the message is processed within the EU.
• Google (only if you use “Continue with Google”): Google tells us your account identifier, your email address, whether it is verified, and your name. Google, for its part, will know that you signed in to House Of Decks. If you never use that button, Google plays no part in your registration.
• Cloudflare (network and protection): processes your IP address and browser headers in order to serve the site and protect it from abuse.

Necessary cookies. If you create an account, a cookie called hod_session is used to keep you signed in (30 days). During a Google sign-in a temporary cookie, hod_oauth_state, is also used; it lasts ten minutes and exists solely to prevent one specific kind of attack. Neither is used for tracking or advertising, and both are essential for the feature to exist at all, so they require no consent. If you play without an account, neither is used.

This site may show ads through Google AdSense. Google and its advertising partners may use cookies or similar technologies to serve ads, including personalized ads based on your browsing, and to measure their performance.

When you visit from the European Union or the United Kingdom, you'll be asked for consent before any non-essential advertising cookies are enabled; you can accept only what's needed for the site to work and decline personalization. You can change your mind at any time from Cookie settings at the foot of any page, which reopens the same consent window so you can review or withdraw your choice. You can also manage how Google personalizes the ads you see at adssettings.google.com. More information on how Google uses this data is available at policies.google.com/technologies/partner-sites.

You can request access to, correction of, or deletion of the data this site holds about you by writing to the contact email above. If you ask for your account to be deleted, it is removed in full: the email address, the name, the password, any open sessions, the Google link and the abandon record.

You can change your player name yourself at any time from your account page, without writing to anyone.

For ads, the fastest way to exercise your rights over how Google personalizes them is directly from Google's ad settings.

This site isn't specifically directed at minors. Playing requires no personal data at all, but creating an account does require an email address, so it isn't intended for children under 14. If you believe a child in your care has created an account, write to the contact email and it will be deleted.

This policy may be updated if what the site does changes (for example, when ads are enabled, or when new ways to sign in are added). The last-updated date always appears at the very top.