Privacy policy

Playing as a guest

You can play without an account. The name you type is shown to the others at your table. Your device keeps your saved solo game, your seat at a table and your settings in its own storage, and a cookie remembers the language you picked. None of this is sent to us as an account.

If you sign in

• Your email address, to send your sign-in code and, if you qualify for the Masters, to invite you to its final weekend. Nobody else sees it.
• Your account name, and if you add them: your picture, your country, your gender (used only so a game's story agrees with you in grammar) and your settings.
• Your game history: results, points, levels, coins, gold bars, coffees, league places and the chairs and kisses thrown at you.
• How quickly you make each move, how often your moves are the game's own bots' moves and how you do against the bots, to catch play by a program or with outside help. If that flags your account, your next quick-play games are recorded and their replays shared with us on Slack. An account caught at it can have its prizes left out of the league or be suspended; that is decided by a person, never automatically. We also note whether you sit down on a computer or on a phone or tablet: only play on a computer is flagged.
• A cookie that keeps you signed in for up to 60 days. In the app, a token kept in your phone's secure storage does the same. With it we record your IP address and browser type, for security.

What other people can see

• Your name, picture, country, level, medals and game record, at tables, on profile cards and on the leaderboards.
• The story of every friendly game with a signed-in player, on the public Stories wall, with the names as they were at the table. Each day's results in the quick-play rooms go there too, with account names.
• A short daily summary of those stories and of the day in the quick-play rooms (levels reached, prizes won, league places), with account names, posted on our Facebook page, Whist Românesc, and on the Stories wall.
• An analysis of your game, but only if you press Share: the link is then public and permanent.

Lobby chat is gone once the cards are dealt. The coach and the game analysis are worked out on your own device.

Technical data

Your IP address is used for a moment to stop abuse and to work out your approximate location (your city), so the room's window shows your weather and your time of day and a guest sees the right language. It is not stored. If you turn on Local weather in your profile, your device's approximate location is used instead, rounded to about 10 km on the device itself; it is not stored either, and you can turn it off at any time. We count page views with Cloudflare's cookieless analytics, which do not follow you between visits. Our server's log keeps each round of a friendly game (names, bids, cards played) to settle disputes. If you tick “Log my games this week” on your profile, we also keep that week's Quick and Classic games whole (every hand, bid and card), to look into a game you tell us about; it switches itself off when the week ends, on Sunday night, and you can untick it at any time. Those games include the other players' cards and bids, but not their names. You can share a kept game's replay as a link from its results; anyone with the link can watch it. If you arrive through a link that says where it came from (an ad, or a friend's invite link), your device keeps that label for 30 days; we count visits per label, and if you sign up we note it against your account, and for an invite, who invited you, so that friend can be rewarded. If you ask for a sign-in code there, we keep that label for a day against a scrambled (hashed) form of your email address, so the sign-up still counts if you finish it from the email in another browser.

Who else handles it

• Fly.io hosts the site and its database, in Amsterdam. A copy of the database and of the games in progress is kept up to date with Tigris, Fly.io's storage service, so a server in Frankfurt can take over if ours fails; older copies are deleted within two days, a deleted account's included.
• Resend sends the sign-in emails and the Masters invitations.
• Cloudflare runs our domain's DNS and the page view counts.
• Open-Meteo gets your approximate coordinates (never your IP address) to tell us the weather.
• Anthropic's Claude writes the daily Facebook post from the public stories and the day's quick-play results and translates it for the Stories wall, and Meta publishes it. Every Monday it also writes a poem about the week's leaderboard and league tops, with account names, posted on the page and on the Stories wall.
• You can also sign in with Google (on the website and in the Android app), Facebook (on the website) or Apple (on the website on an iPhone, iPad or Mac, and in the iPhone app) instead of a code: they confirm your email address to us, and with Apple's Hide My Email we get a relay address instead of yours. A new account made with Google or Facebook also takes its profile picture once, as your picture here; you can change or remove it on your profile. We get nothing else from them, and they learn only that you signed in to Whist Românesc.

We do not sell your data, show ads or use tracking cookies.

Why we may, and for how long

We use account data to give you the game you signed up for, and IP addresses and logs to keep it safe; the public stories and the Facebook post are our legitimate interest in showing what happens at our tables, and you can ask to be left out of them. We keep account data while your account exists, and stories and shared links until you ask us to remove them. Sign-in codes expire after 10 minutes.

Your rights

You can ask for a copy of your data, ask us to correct it, to delete your account or to stop using it in the stories. Write to privacy@onlinewhist.com from your account's email address; we answer within a month. Deleting your account removes your email, name, picture and game history. You can also delete it yourself, at once, with the Delete account button on your profile: everything kept about it goes immediately, and your name in stories already told becomes “Anonymous”. You can also complain to your data protection authority (in Romania, ANSPDCP).

Children

Accounts are meant for people aged 16 or over. Younger players can play as guests.

Changes

If this policy changes, we update this page and the date at the top.