PRIVACY POLICY

From you, when you create an account:

• Your email address (or your Google account email if you sign in with Google)
• A hashed password (we never see your plain-text password)
• The username you choose to display in matches

From your actions while playing:

• Match history for completed matches — mode, winner, win type, turn count, kill count, duration, started/ended timestamps
• Aggregate stats — total matches, wins, longest streak, kills per character (used to evaluate achievements)
• Room participation — which online rooms you created or joined and when

From your browser, automatically:

• IP address (used for spam protection and short-term in server logs)
• Device / browser information (user agent, screen size, time zone) used by our analytics
• Pages you visit on the site and the actions you take inside the game (e.g. starting a match, signing in)

• Run your account and sign you in across devices.
• Save your achievements and match history so they follow you across browsers.
• Run multiplayer rooms — we need to know who's in a room and what their last move was.
• Send transactional emails — sign-up confirmation, password reset. We do not send marketing emails (unless you opt-in to a separate newsletter from the home page).
• Understand how the game is played via anonymous analytics events — for example, how many people finish a match versus quit during deployment. This is only used to improve the game.
• Detect abuse — fraudulent sign-ups, cheating, harassment. This is rare.

The legal basis for processing this data is your consent when you create an account and our legitimate interest in running a functioning service (e.g. preventing abuse).

We don't sell your data. We use these third-party services ("sub-processors") to run the game. Each has their own privacy policy that applies in addition to ours.

• Supabase (database + authentication, hosted in Ireland 🇮🇪) — stores your account, profile, stats, and match history.
• Vercel (hosting, USA) — serves the site itself, and provides cookieless web analytics (page views, top pages, country/device, Core Web Vitals). Vercel Analytics uses a daily-rotated hash of your IP + user agent — no persistent identifier is stored on your device, no consent banner is needed under GDPR. This is the only analytics we run.
• Resend (transactional email, USA) — delivers sign-up confirmation and password-reset emails.
• Google (only if you sign in with Google) — we receive your Google email and basic profile info; Google receives the fact that you signed into King's Line.

We use standard contractual clauses (SCCs) where data leaves the EEA, as provided by these vendors.

We don't use tracking cookies. The only browser storage we touch is essential for the game to work:

• Auth session — Supabase stores a token in cookie/localStorage so you stay signed in across reloads. Required for the service.
• Local gameplay cache — your in-progress stats and a few UI preferences (e.g. whether you dismissed the PWA install prompt). Stays on your device.

Both are exempt from the EU's cookie-consent requirement because they're strictly necessary for the service. That's why there's no "Accept cookies" banner on this site.

For traffic measurement we use Vercel Web Analytics, which is cookieless by design — it identifies visits using a daily-rotated server-side hash, never storing a persistent identifier on your device. No consent banner is required for it under GDPR.

• Account data: until you delete your account.
• Match history & stats: same — tied to your account.
• Server logs (Vercel, Supabase): rolling 7–30 days, depending on the service.
• Analytics (Vercel): aggregated visit counts only — no per-user history exists to retain.
• Transactional email logs (Resend): rolling 30 days.

Under GDPR (EU), Swiss FADP, and similar laws, you can:

• Access the data we hold about you
• Correct it if it's wrong
• Delete it — there's a "Delete account" button in the account menu that wipes your account, stats, and match history in one click
• Export it — email us and we'll send you a JSON dump
• Withdraw consent for analytics at any time
• Lodge a complaint with your local data protection authority (in Switzerland: the FDPIC)

For any of the above, email us at thibaud.delavy@hotmail.ch. Most requests are handled within 7 days.

King's Line is not directed at children under 16. We don't knowingly collect data from anyone under 16. If you believe a child has created an account, please contact us and we'll delete it.

Data is encrypted in transit (TLS) and at rest (AES-256 via our providers). Passwords are stored as bcrypt hashes — we never see your plain-text password. We use row-level security on every table so a player can only ever read or modify their own data.

That said: no system is perfectly secure. If you ever spot something concerning, please email us.

We'll update the "Last updated" date at the top of this page when this policy changes. For material changes (new sub-processors, new categories of data), we'll surface an in-app notice the next time you sign in.

Questions or requests: thibaud.delavy@hotmail.ch