Polityka prywatności

What we collect

Only what running the site needs. We do not buy data about you, and we do not sell or rent the data we have.

• Guests: a random guest ID kept in a cookie, so your likes, favourites and game progress survive a page reload. If you ask for a recovery code, we keep only a one-way digest of it.
• Accounts: email address, username, display name, and a password stored as an Argon2id hash that nobody, including us, can read back. If you sign in with Google, Discord or Twitch, we keep that provider’s account ID and the email it confirmed.
• Date of birth: asked once, at sign-up or on your first visit after, to show games suited to your age and to choose recommendations. We use it to work out an age group; it is never shown to other players or to games. Some things inside games are only for adults, and not offered in every country: for those a game is told a plain yes or no for you, worked out from your age and from the country your connection comes from at that moment — never the date or the country itself, and the country is not stored. Only support can change the date, so that the protections for younger players cannot be clicked away.
• Profile: an avatar, a bio, showcases and privacy choices, if you set them.
• Play: which games you open and for how long, scores, leaderboard places, achievements, statistics and the saves a game writes for you (up to 64 KB per game). In online games, the game’s server may also keep your in-game belongings between visits (coins, gear), filed under a pseudonym that game uses for you, not under your account.
• Multiplayer and replays: the rooms and matches you join, and the input log of a match so it can be replayed. Inside a game you appear under a per-game pseudonym, not your account name or email.
• Match chat: what is written in a match’s chat, including quick phrases, and under which in-game name. It is kept so that a moderator can check a report.
• Voice: if you are 16 or over and switch voice on in a game, what you say while you hold the talk button is passed through our server to your friends in the same game room. It is not recorded, listened to or kept, and it never goes from your device straight to another player’s.
• Moderation: reports you file, reports other players file about you, and a moderator’s decision on them, including any warning, chat mute or block.
• Social: friends, follows, blocks, invitations, replays you share or send, comments you write under replays, and reports you file.
• Items: cases, items, the in-game currency Cedars and the history of every change to them.
• Technical data: a salted, one-way hash of your IP address (for abuse control; the address itself is not stored), your browser’s user agent for each signed-in session, the device type, and which page led you to a game.

Why we use it

• To provide the service you asked for: keeping your account and progress, running matches, leaderboards and your inventory. Legal basis: contract (GDPR Art. 6(1)(b)).
• To keep the site safe: rate limits, stopping cheating and abuse, and moderating reports. Legal basis: legitimate interests (Art. 6(1)(f)).
• To understand which games work and improve the catalog, using statistics that are aggregated before anyone looks at them. Legal basis: legitimate interests.
• To order games for you based on what you played. You can switch this off in settings at any time, and the order then no longer depends on your history. Legal basis: legitimate interests, with your right to object built in.
• To send service email, such as a password reset link you asked for. We do not send marketing email.

Who else sees it

Other players see what your privacy settings allow: your profile, statistics and favourites can each be public, friends-only or private. Replays you share are visible to the audience you chose.

Moderators see a reported match’s chat and recording, the reports about it and the account behind the reported in-game name. The player you report is not told who reported them.

Games run on a separate domain and never receive your email, your account ID or your cookies. They see a pseudonym that is different in every game.

We use processors who handle data only on our instructions: our hosting provider, which stores everything in data centres in the European Union, and an email delivery service for service mail. If you choose to sign in with Google, Discord or Twitch, that provider learns that you signed in to Cedrus Games; its own privacy policy applies to that.

We disclose data to authorities only when the law requires it.

Cookies and local storage

We use only our own cookies. There are no advertising cookies and no third-party trackers; our fonts are served from our own domain.

• Sign-in: a short-lived access token (15 minutes) and a refresh token (30 days), both unreadable to scripts.
• Guest: the random guest ID (1 year).
• Security: a CSRF token, and a short-lived cookie that carries a Google, Discord or Twitch sign-in round trip.
• Statistics: a session ID that ends after 30 minutes of inactivity, used to count visits without identifying you across devices.

Your browser also keeps a few preferences, such as your light or dark theme, in local storage. They never leave your device.

How long we keep it

• Your account: until you delete it. Deleting it in settings takes effect at once: your profile, email, saves, friends, sessions and Cedars are erased. Records that other players or our statistics depend on (play sessions, match results and the items you held) stay, with no link back to you.
• Guest progress: game saves of a guest are removed 90 days after the guest was last seen.
• Game saves: kept while you play. A save of a game you have not launched for 24 months is removed; we warn you on your profile and on the game’s page 60 days before, and by email 30 and 7 days before. Launching the game once is enough to keep it.
• What an online game’s server keeps for you (in-game coins and gear): deleted together with your account, or after 24 months without any change.
• Sessions: sign-in sessions expire after 30 days of non-use; password reset links after 60 minutes.
• Raw play and visit events: at most 14 months. After that only aggregated statistics remain, which no longer describe any one person.
• Match chat: 30 days after the match, then deleted. Only while a report about that match is still being decided is it kept until the decision.
• Reports and sanctions: while your account exists, so that repeated behaviour can be recognised. They are deleted with your account.
• Accounts that have not been used for a long time will be removed. We will warn you on your profile and by email well before that happens, and signing in once is enough to keep the account.
• Records in a leaderboard’s top list may stay after an account is deleted, showing only the display name that was used, so that the board stays trustworthy.

Your rights

You can see and correct most of your data yourself in your profile and settings, and delete your account there. You also have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Write to support@cedrusgames.com; we answer within one month.

If you think we handle your data unlawfully, you can complain to the data protection authority where you live or work.

Children

Anyone can play without an account. To create an account you must be at least 16, or the lower age set for this in your country (never under 13). Younger players need the consent of a parent or guardian. If you believe a child has given us data without that consent, write to support@cedrusgames.com and we will delete it.

Security

Passwords are hashed, sign-in cookies cannot be read by scripts, games are isolated on their own domain, and all traffic is encrypted. No system is perfectly safe; if a breach affects you, we will tell you and the authority as the law requires.

Changes

When this policy changes we update the date at the top. If a change matters to how your data is used, we will tell you on the site before it takes effect.