Privacy Policy

What we store

Your account

If you create an account, we store your email address and the username you choose. Your email is used to sign you in and confirm your account; it is never shown to other players. Your username is shown to your opponents in online games, in invites, and in the alerts we send them. We also store when you first finished the tutorial, for your achievements.

Other players can't browse a list of usernames. They see your username only when you play an online game with them, or when you place in the rankings. To keep your username hidden from every other player, play as a Guest without signing in. Guests can play vs CargoBot but can't play against other people, keep stats or ratings, earn Achievements, or appear in the rankings.

Players you've played, and anyone who sees you in the rankings, can see your rating, game record, Profile stats, and Achievements count. Turn on Settings → Hide Stats to hide them; your username then shows as <Name Hidden> in the rankings.

You can also sign in with Google, Discord, or Twitch. We then receive your email address and your account ID from that service; we don't use the name or profile picture it shares. You can connect more than one sign-in method to one account, and disconnect them in Settings.

You can play without an account as a guest. Guests' games stay on their device unless noted below.

Online games and invites

For online games we store the game itself on our server: the board, the players' usernames, every move, and the game's result. Invites use a short room code and link that let your opponent join. Your opponent can see the game and your username.

To stop people guessing room codes, we record failed code lookups with your account or, for guests, your IP address. Records older than a day are deleted as new lookups come in.

Notifications

If you turn on notifications, we store your device's push token or web push subscription so we can send you game alerts, along with your notification settings, quiet hours, and time zone. We keep a record of which alerts were sent so you don't get the same one twice. Alerts are delivered through your device's push service (Apple, Google, or your browser maker) and, in the iOS and Android apps, Expo's push service.

Game move logs

We keep a record of every move in a game (board size, game mode and computer difficulty, players' display names, who started, app version, start and finish times, and each move) so the game can be rebuilt move by move. Online games' logs are saved with the game. vs Computer games upload their log once when the game ends; we use these to tune game balance, and later for player stats and achievements. Signed-in players' logs are linked to their account and include their username, so we can look into problems they report. Guests' logs are uploaded with no link to an account.

Diagnostics

The app records technical events (game and session ids, turn numbers, status flags, and error codes, but no names or email addresses) and sends them to our server so we can fix problems without needing your device. Signed-in players' diagnostics are linked to their account; guests' are anonymous. Diagnostics are deleted automatically after 30 days.

Reports and blocks

If you report a player's username, we store the report (you, the player, the username, where you saw it, and when) so we can review it. The player isn't told who reported it. If you block a player, we store the block so they can't invite you, rematch, or join your games. Reports you sent and your blocks are deleted with your account.

Feedback

If you send feedback from the app, we store your message with your account (or without one if you play as a Guest), the app version, and the game you sent it from. We use it only to improve the game, and it is deleted with your account.

Purchases

If you buy Remove Ads on the website, it's sold through Link, Stripe's checkout service, which is the seller for the payment: you enter your card or other payment details, name, and billing address on Stripe's checkout page, Stripe uses them to process the payment, calculate tax, and send your receipt, and we never see or store them. We store only the purchase's Stripe reference, the amount, and the date, linked to your account so ads stay off wherever you sign in, and whether it was refunded or disputed. Your purchase record is deleted with your account; Stripe keeps its own record of the payment. How Stripe uses your information: https://stripe.com/privacy

On your device

The app saves your settings, your saved games, your match history, and a short diagnostics log on your device. Signing out doesn't remove them. Delete Account removes them from this device; otherwise they stay until you uninstall the app or clear this site's data in your browser.

Ads

The free version of Cargo Connect shows a banner ad served by Google: AdMob in the iOS and Android apps, and Google AdSense on the website. We don't choose which ads you see, and we never send Google your email address, username, or games. Buying Remove Ads turns the banner off for your account.

To show and measure ads, Google and its partners collect information from your device. That includes your device's advertising ID (in the apps) or advertising cookies (on the website), your IP address and the rough location it gives, your device and browser type, and how you interact with ads. Google may use this to show ads based on your interests and on your activity in other apps and sites (personalized ads). How Google uses this information: https://policies.google.com/technologies/partner-sites

Your choices: In the EEA, the UK, and Switzerland, the app asks for your consent before showing personalized ads, and you can change your answer anytime with Privacy choices at the top of this policy. On iPhone and iPad, the app asks for permission to track you. If you say no, Google doesn't get your advertising ID and shows ads that aren't personalized. On Android, you can delete or reset your advertising ID in your device's settings. You can also manage Google ad personalization at https://myadcenter.google.com. Ads that aren't personalized still use cookies or device identifiers to limit repeats, prevent fraud, and measure results.

What we don't do

• We don't sell your email, username, or games.
• We don't use third-party analytics. The only third-party tracking comes from the ad services described above.

Who processes your data

Our server and accounts run on Supabase, and the website is hosted by Cloudflare. Account emails (sign-up confirmation and password reset) are sent by Resend, which receives your email address only to deliver them. Push notifications are delivered by the push services named above. These providers handle data only to run the game for us. Supabase and Cloudflare keep standard request logs, including your IP address and browser or device information, to run and secure their services. Ads are served by Google (AdMob and AdSense), as described in Ads. Remove Ads payments are processed by Stripe, as described in Purchases.

How long we keep it

Account data is kept until you delete your account, and is then deleted.

Online games are kept so your opponents keep their games. When you delete your account, your name in them becomes “Deleted player” and they are no longer linked to your account.

Move logs are kept to tune game balance. When you delete your account, they are kept with no link to your account, and your username in them is replaced with “Deleted player”.

Diagnostics are deleted after 30 days. When you delete your account, your diagnostics are deleted right away.

Deleting your data

You can delete your account in the app: open Settings, choose Delete, and type DELETE to confirm. Your account, email address, username, notification settings, push registrations, purchase records, and diagnostics are deleted right away. This device is signed out and the app's data on it is removed. Online games in progress are resigned; your opponents keep their games, with your name shown as “Deleted player”. Move logs are kept with no link to your account, and your username in them is replaced with “Deleted player”, including in logs uploaded by guests.

If you can't use the app, email privacy@cargoconnect.win from the address on your account and ask us to delete your account. We'll delete your account and the information linked to it.

Children

Cargo Connect is not directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has created an account, email us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top and post the new version in the app.