This policy explains what data Spades Online collects, why we collect it, how long we keep it, and how you can have it deleted.
Who we are
Spades Online (spades-online.co) is a free browser-based card game platform. We are the data controller for the personal data described on this page. You can reach us at any time at support@spades-online.co.
What data we collect
We collect the minimum needed to run matches, ranked progression and friend lists.
- Account data: your email address, your password stored only as a bcrypt hash, your display name, and an optional avatar image URL.
- Guest data: if you play without registering, we create a guest account identified by a device id and a browser fingerprint hash - a hash built from coarse browser properties such as language, screen size and time zone. We do not store the raw fingerprint values and we do not store your IP address in that record.
- Gameplay data: match results, XP, level, ranked LP, game history, friendships and game invitations.
- Technical data: your browser user agent string, stored with the guest device record so we can detect automated abuse.
What we store on your device
We use your browser's localStorage, not tracking cookies, to keep you signed in. It holds a JWT access token, a refresh token, a cached copy of your profile, your device id, your cookie consent choice, and local preferences such as theme and sound. None of this is shared with third parties. Clearing your browser storage signs you out and, for guest accounts, disconnects you from your progress.
Analytics and cookies
We load Google Tag Manager and Google Analytics 4 to see which pages and game modes are actually used. Analytics only starts after you accept it in the cookie banner. Until you accept, Google Consent Mode is set to denied and no analytics or advertising identifiers are written.
Strictly necessary storage - your session and your consent choice - is always active, because the game cannot function without it. You can withdraw consent at any time by clearing this site's data in your browser, which also resets the cookie banner.
Legal basis for processing
Account and gameplay data are processed to perform our contract with you, which is providing the game. Guest device identifiers are processed on the basis of our legitimate interest in preventing abuse and letting you keep progress without registering. Analytics data is processed only on the basis of your consent.
Who we share data with
We do not sell personal data and we do not share it for advertising. Data reaches only the providers needed to operate the service: our hosting and database provider, our transactional email provider for verification and password reset messages, and Google for analytics after you consent. Other players can see your display name, avatar, level, title and rank.
How long we keep data
Account data is kept for as long as your account exists. Refresh tokens expire 365 days after they are issued and password reset tokens expire after one hour. When you delete your account, all data listed on the deletion page is erased immediately; aggregated match statistics may remain, but without any identifier that links them to you.
Your rights
Under the GDPR and comparable laws you have the right to:
- Access - ask us for a copy of the personal data we hold about you.
- Rectification - correct inaccurate data. You can edit your name, email and avatar yourself in Settings.
- Erasure - delete your account and its data, which you can do yourself at any time.
- Portability - receive your data in a structured, machine-readable format.
- Objection and restriction - object to processing that is based on our legitimate interest.
- Complaint - lodge a complaint with your national data protection authority.
Deleting your account
You can delete your account yourself at any time from Settings, in the Danger Zone. Deletion is immediate and permanent: your profile, email address, password hash, device fingerprints, friendships, game invitations, notifications, ranked progression and game progress records are erased and cannot be restored. If you cannot sign in, write to support@spades-online.co from the email address on the account and we will complete the deletion within 30 days.
Children
Spades Online is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete the account and its data.
Changes to this policy
If we change how we handle data, we will update this page and the date shown above. Material changes will also be announced inside the game before they take effect.
Contact
For any question about this policy, or to exercise any of the rights listed above, write to us at: