This policy explains what personal data opolyx ("we", "us") collects when you use opolyx.com, how we use it, and the rights you have. opolyx is a free-to-play online board game. We collect the minimum needed to run the game and keep it fair.

When you use opolyx we may process:

• Account data — your email address (used for sign-in) and, if you use Google or Apple sign-in, the basic profile that provider returns. If you sign in with Apple and choose "Hide My Email", we only ever see Apple's relay address. Guest accounts have no email address at all.
• Profile data — your nickname, avatar, and language preference.
• Gameplay data — games you join, in-game actions, results, XP and level, inventory (field cards), and chat messages.
• Technical data — error and warning logs (with a request identifier), and basic information your browser sends, used for security, debugging, and anti-cheat. When an error occurs, our monitoring provider may record a short replay of what was on screen at that moment, which can include the game board and chat visible to you.
• Usage data — pages viewed, approximate visit duration, and in-game interactions, collected by the analytics providers listed below. This includes your IP address, from which those providers derive an approximate location (typically country level). We do not ask your browser or device for precise location, and opolyx never requests a location permission.

We do NOT collect payment-card information — opolyx does not sell anything in this version.

We use your data to provide and operate the game (accounts, lobby, matchmaking, leaderboards), to keep it fair and secure (anti-cheat, abuse handling), to fix problems (debugging from logs), and to communicate with you (for example, the magic-link email that signs you in).

Where the EU/UK GDPR applies, we rely on: performance of a contract (providing the game you asked for), our legitimate interests (security, anti-cheat, improving the service), and your consent where it is required. You can object to or withdraw consent as described below.

We use trusted providers that process data on our behalf:

• Supabase — database, authentication, realtime, and storage (hosted in the Singapore region);
• Vercel — hosting for the website;
• Railway — hosting for the authoritative game server;
• Sentry — error and performance monitoring, including the on-error screen replay described above;
• Google — optional sign-in (OAuth), and analytics via Google Tag Manager and Google Analytics;
• Apple — optional sign-in (Sign in with Apple);
• Plausible Analytics, and Vercel Analytics + Speed Insights — website and performance measurement;
• Baidu Analytics — measurement for visitors on our Chinese-language pages, where Google services are unreachable;
• DiceBear — generates your profile avatar image. Your account identifier is included in the image address sent to this provider;
• an email delivery provider — to send your sign-in emails (magic link and one-time code).

These providers are bound to use the data only to provide their service to us. We do not sell your personal data, and we do not share it with advertising networks or data brokers.

opolyx uses essential cookies needed to sign you in and keep your session, plus a referral cookie if you arrive through a referral link. If you play opolyx embedded in another website, the session cookie is set in a way that allows it to work inside that frame.

We also use analytics cookies and similar identifiers set by Google Analytics (via Google Tag Manager) to measure how the site is used. Plausible Analytics is cookie-less. Vercel Analytics and Speed Insights are served from our own domain.

We do not use advertising cookies, we do not run ads, and we do not allow advertising networks or data brokers to track you across other sites through opolyx.

We measure aggregate usage — page views, visit duration, and which features are used — to understand what to improve. Analytics run only on the live site, never in development or test builds.

Which providers run depends on the language you are browsing in: on all pages except our Chinese-language pages we use Google Analytics via Google Tag Manager, and on the Chinese-language pages we may instead use Baidu Analytics, because Google services are not reachable from mainland China. Plausible Analytics and Vercel Analytics run on all pages and are served through our own domain, which means your browser does not connect to those providers directly — but we do pass your IP address and browser identification to Plausible so that visits are counted and attributed to the correct country.

You can block analytics with standard browser privacy settings, an ad or tracker blocker, or by sending a "Do Not Track" signal, and the game will continue to work normally.

We keep account and profile data while your account is active. Technical logs are automatically deleted after about 30 days. Finished games may be retained or archived for a limited period for integrity and dispute resolution, then removed.

Our database, authentication and game server are hosted in the Singapore region, our website is served from a global content network, and our providers may process data in other countries. By using opolyx, you understand that your data may be transferred and processed internationally, with safeguards appropriate to the provider.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, contact us via the Contact page or email support@opolyx.com; we may need to verify your identity first.

We do not sell or share personal data as those terms are used under California law, and we do not use it for cross-context behavioural advertising.

To delete your opolyx account, email support@opolyx.com from the address you signed in with, or use the Contact page. We will confirm the request and then delete your account.

When an account is deleted we remove your sign-in credentials, your email address, your profile (nickname and avatar), your inventory and progress, and your chat messages. Matches you have already played are kept, but your name is replaced with an anonymous placeholder, so the game history of the other players in those matches stays intact. Deletion is permanent and cannot be undone.

opolyx is not directed to children below the minimum age of digital consent in their country. If you believe a child has provided us personal data without appropriate consent, contact us and we will remove it.

We protect data with encryption in transit, access controls, and database row-level security so players can only read what they should. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for significant changes, note them in the game.

For privacy questions or to exercise your rights, reach us through the Contact page.