This policy explains what personal data opolyx ("we", "us") collects when you use opolyx.com, how we use it, and the rights you have. opolyx is a free-to-play online board game. We collect the minimum needed to run the game and keep it fair.

When you use opolyx we may process:

• Account data — your email address (used for sign-in) and, if you use Google sign-in, the basic profile Google returns.
• Profile data — your nickname, avatar, and language preference.
• Gameplay data — games you join, in-game actions, results, XP and level, inventory (field cards), and chat messages.
• Technical data — error and warning logs (with a request identifier), and basic information your browser sends, used for security, debugging, and anti-cheat.

We do NOT collect payment-card information — opolyx does not sell anything in this version.

We use your data to provide and operate the game (accounts, lobby, matchmaking, leaderboards), to keep it fair and secure (anti-cheat, abuse handling), to fix problems (debugging from logs), and to communicate with you (for example, the magic-link email that signs you in).

Where the EU/UK GDPR applies, we rely on: performance of a contract (providing the game you asked for), our legitimate interests (security, anti-cheat, improving the service), and your consent where it is required. You can object to or withdraw consent as described below.

We use trusted providers that process data on our behalf:

• Supabase — database, authentication, realtime, and storage (hosted in the Tokyo region);
• Vercel — hosting for the website;
• Railway — hosting for the authoritative game server;
• Sentry — error and performance monitoring;
• Google — optional sign-in (OAuth);
• an email delivery provider — to send your sign-in (magic-link) emails.

These providers are bound to use the data only to provide their service to us.

opolyx uses only essential cookies needed to sign you in and keep your session, plus a referral cookie if you arrive through a referral link. We do not use third-party advertising or cross-site tracking cookies.

We keep account and profile data while your account is active. Technical logs are automatically deleted after about 30 days. Finished games may be retained or archived for a limited period for integrity and dispute resolution, then removed.

Our infrastructure is hosted primarily in the Tokyo region, and our providers may process data in other countries. By using opolyx, you understand that your data may be transferred and processed internationally, with safeguards appropriate to the provider.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, contact us via the Contact page; we may need to verify your identity first.

opolyx is not directed to children below the minimum age of digital consent in their country. If you believe a child has provided us personal data without appropriate consent, contact us and we will remove it.

We protect data with encryption in transit, access controls, and database row-level security so players can only read what they should. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for significant changes, note them in the game.

For privacy questions or to exercise your rights, reach us through the Contact page.