verifying...

Privacy Policy

This document explains what personal data '3D3T' collects, why it is collected, how long it is kept, and your rights under the EU General Data Protection Regulation (GDPR). It is intentionally short — the site is a small hobby project and only processes what the game itself needs.

Data controller

Vinzenz Alb. See the Imprint for full contact details. Questions and GDPR requests: vinzenz.alb@gmail.com.

What is collected and why

Guest play (no sign-in): no personal data is stored in our database. Played games are written as anonymous match records (move count, time played, winner) with no link to your identity. The underlying hosting providers (see below) still process technical request data such as IP address for delivery, security, and abuse-prevention purposes.

Signed-in play (Google or GitHub): when you sign in via OAuth we store:

  • The provider account identifier and provider name
  • Your name and email address as provided by the OAuth provider
  • Your profile image URL (if shared by the provider)
  • A generated public username (you can change it on your profile)
  • Authentication session tokens (server-side, used to keep you signed in)
  • A history of your matches: opponent reference, winner, move count, time played, date

This data is used to keep you signed in, show your match history and statistics, power the leaderboard, and enable the friends feature. It is never sold, advertised against, or shared beyond the processors listed below.

Cookies:a session cookie is set by NextAuth when you sign in so you don't have to log in on every page. No marketing or advertising cookies are set. We use Vercel Web Analytics and Speed Insights for aggregate visitor statistics and page-performance metrics — both are cookieless and do not identify you.

Public visibility

Some of the data tied to a signed-in account is shown publicly by design:

  • Your public username and aggregate results (wins, losses, win rate) appear on the global leaderboard, which is a public page and may be indexed by search engines.
  • Each finished game has a replay pageshowing both players' usernames, the moves, the result, and the date. Anyone who has the match link can open it. These replay pages are excluded from search-engine indexing (noindex), but they are not otherwise access-restricted — the link is the only thing needed to view them.

You can change your public username at any time on your profile. Guest (not signed-in) games are recorded without any username and are shown as "Guest".

Processors and third parties

The following third parties process data on our behalf as part of running the site:

  • Vercel Inc. — application hosting (USA, with EU edge regions) and cookieless web analytics + performance monitoring (aggregate, non-identifying visitor / page-view counts and Core Web Vitals). Standard request logs.
  • Neon Inc. — Postgres database hosting (EU region: eu-central-1).
  • Cloudflare Inc. / PartyKit — realtime multiplayer relay (WebSocket).
  • Cloudflare Inc. — DNS for the domain.
  • Google LLC / GitHub (Microsoft Corp.) — OAuth identity providers, only when you choose to sign in via them.

Each processor receives technical request data (IP, user-agent) as needed to deliver the service. Data transferred to processors outside the EU is covered by those providers' standard contractual clauses.

Retention

Account data and match history are retained for as long as your account exists. Anonymous guest match records are kept indefinitely as part of aggregated site-wide statistics (total games, total moves, total time played) since they contain no personal identifiers. Session tokens expire automatically.

Your rights

Under GDPR you have the right to access, correct, export, restrict processing, object to processing, and delete your personal data. To exercise any of these rights, contact vinzenz.alb@gmail.com and your request will be handled within 30 days. Account deletion removes your User row, cascades to your sessions and OAuth accounts, and disassociates your past matches (their aggregate stats remain).

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) if you believe your data has been mishandled.

Changes

This page may be updated to reflect changes in the site's data handling. Material changes will be noted with a revised date below.

Last updated: 2026-08-03