Privacy

• Device cookie. The first time the game talks to our server it sets abacotron_pid, a random id (httpOnly, 2 years). It ties your plays to this browser and identifies nothing else.
• Your plays on our server. For each daily or archive day: the chain you built in each round, your time, the server time each round was dealt, the score and the duel result. We use them to judge rounds against the server clock, to keep your streak and logbook, and for the day’s anonymous statistics (score curve, percentile, most popular chain).
• In your browser only (localStorage keys starting with duel:v1:): finished days and the round in progress, ratings you gave a day, sound on/off, chosen cosmetics, machines you beat on the ladder, the endless-mode counter, which days were imported, a random local id. In sessionStorage: the live match the tab is in, so a reload takes you back to it. This stays on your device unless you import your history after signing in.

• Sign-in is handled by Supabase Auth (Supabase, Inc.) with your Google account. Supabase receives from Google and stores your email address, your Google account id and the basic profile Google shares (name, picture), and sets session cookies (sb-…-auth-token) that keep you signed in.
• Our database stores your account id, your Google account id, your public handle (player-xxxxx until you choose one), your friend code, your Abacotron Pro status and rating holds. We do not copy your email into our database; we only read it from Supabase to check admin access.
• Signing in links this device to the account. “Import history” moves this device’s plays to the account and adds days kept in your browser (each one judged again from its chains).
• With an account we also keep: friends, leagues and their members (and who a league’s owner removed), VS ratings per season, match results, cosmetics you unlocked, anti-cheat flags.

• Your handle and rating on the leaderboards.
• In live matches: your handle and round results. Without an account you appear as guest-xxxx, or guest- plus a name you pick (kept only on your device and sent with each live match), with an id derived from your device id by a one-way hash; the device id itself is never shown.
• Friends see your daily score and duel result, and your chains once they have finished the day themselves. League members see your weekly total.

• Abacotron Pro (paid plan) is sold by Paddle as merchant of record (Paddle.com Inc. for buyers in the US, Paddle.com (Canada) Ltd. in Canada, Paddle.com Market Limited elsewhere): Paddle collects your name, email, payment and billing details, charges you, handles sales tax/VAT and receipts, under its own buyer terms and privacy notice. We never see card numbers.
• We send Paddle your account id (in the checkout’s custom data) so the purchase reaches your account. We receive and keep: your Paddle customer id, the plan, subscription, payment, refund and chargeback ids with their status, amounts and period end; plus a log of Paddle’s notifications (id, type, result).

• We count how the game is used ourselves, on our own server: no third-party analytics, no extra cookies, no session recording, no capture of clicks or typing. Your browser sends page views (the path, without query) and these events with a few properties (such as the round, score or plan): daily_start, round_finish, daily_finish, result_copied, result_shared, infinite_round, paywall_shown, checkout_started, sign_in_start, import_history, friend_add, day_rating. Our server adds signed_in, purchase, refund and subscription_canceled.
• Events are tied to your device id; when you sign in, this device’s events move to your account. Each event also carries a random id of the browser tab session (to group one visit) and the device type (desktop, mobile, tablet or bot, worked out from the browser’s User-Agent, which is not stored). The first page view of a visit also records the site that sent you (its host name only, never the full address) and UTM tags. We do not store your IP address or other browser details with events. Events are kept for 13 months.
• You can switch it off for this browser here or in Account; if your browser sends Global Privacy Control, nothing is recorded at all (the browser doesn’t send events and the server drops any that arrive).

• VS against people runs on Cloudflare Workers and Durable Objects (Cloudflare, Inc.). Your browser connects to the match room, which receives a ticket signed by our server (account id or the anonymous id from section 3, handle, rating) and your moves. Cloudflare processes your IP address to deliver the connection.
• The room sends the result to our server when the match ends. If our server can’t be reached, the room keeps that result in its storage and retries for up to about 8 hours.

• The site and its database run on a virtual server rented from Contabo GmbH (Germany).
• Web server and application logs (IP address, time, address requested, browser) are kept in size-limited rotating files (at most about 50 MB per service; older lines are overwritten), for security and to fix bugs.
• The database is backed up every day; encrypted backups are kept for up to six months, then deleted.

• To run the game you asked for: plays, account, friends, leagues, matches, Abacotron Pro.
• Our legitimate interest in fair play and security: server-side timing, anti-cheat flags (a round solved faster than a person can is flagged and left out of other players’ statistics; repeated flags in live matches pause the rating until a person reviews them), logs and backups.
• Our legitimate interest in improving the game: anonymous day statistics and the analytics above.
• Tax and accounting duties on purchases are Paddle’s as merchant of record.

• Account data stays until you delete the account.
• Plays made without an account stay on the server; we do not delete them on a schedule. Ask us to remove them, or sign in and delete the account (section 10).
• Paddle keeps its own records of purchases for as long as the law requires.

• Download your data: Account → “Download my data” gives you a JSON file with everything we keep about your account.
• Delete your account: Account → “Delete account” deletes your account, plays, ratings, friends, leagues you own and memberships, cosmetics, flags and payment mirror, the plays of devices linked to the account, and your Supabase sign-in record. An active subscription is cancelled at Paddleright away. Matches you played stay in your opponents’ history without your account. Copies in backups disappear within six months.
• You can also ask us by email to access, correct or delete your data, or object to how we use it: hello@abacotron.io. You may complain to your data protection authority.
• Clearing your browser’s site data removes the device cookie and everything kept in the browser.

Abacotron is not directed at children under 13, and we do not knowingly collect data from them. If you think a child has an account, write to us.

When this page changes, the date at the top changes too. See also the terms.