Privacy note.

The short version

You only give us data if you make an account or play online. We keep very little of it, we never sell it, and you can delete an account and all its data yourself at any time.

Who runs this

Kuro Labs is run by Jiří Fikejs, Zvole – Černíky, 252 45, Czech Republic. For anything about privacy or your data, email Kuro701@seznam.cz.

You don't need an account

You can play every game as a guest.

• Playing on your own device gives us nothing. Your progress is saved in your own browser on your own device and never sent to us.
• Playing online in a room: you type a nickname, which is shown to the other players in that room. The game server holds the nickname, a random seat number and the game position while the room exists, so the game can carry on if someone's connection drops. The room and everything in it is deleted about 2 hours after the last move, or straight away when the last person leaves, and 30 minutes after it was created if nobody joins. We ask for nothing else. If you are logged in while you play, your account id is attached to your seat on the server, never shown to the other players, so that the result can be saved to your account.

If you make an account

What we store

• Your username, which you choose. It is shown publicly (for example on leaderboards).
• How you log in: your password, stored only as a salted one-way scramble (a hash) that we cannot turn back into the password, plus the way you proved who you are when you signed up: if you use Discord, your Discord user ID (a number; we do not store your Discord name, avatar or email); if you use email, your email address. Discord or email is also how you get back in if you forget your password.
• That you agreed to the rules and confirmed you are 18 or older, which version of the rules, and when.
• Your game data: saved progress and settings, and your results: wins, games played and your fastest win, saved by the game server after online rooms with two or more people. Results are shown with your username on the public leaderboard unless you choose “Hide me from leaderboards” in your account settings, and then only you see them.
• Simple account facts: when you signed up and when you last logged in.

What we do not store: your password in readable form, your date of birth, your ID, or your IP address. To stop abuse we count how often a connection asks for a login code or creates an online room, using a one-way scrambled value that cannot be turned back into an address, and we delete it within two days.

Why we keep it. To run your account and your games: to let you log in, to remember your progress, to run online rooms, to show the leaderboard, and to keep the community safe under the rules. We use it for nothing else. There is no advertising, no tracking of what you do on other sites, and no selling or renting of data.

Why we may use your data

The law (GDPR) asks us to name the reason for each use. Ours are:

• To provide what you asked for: your account, logging in, saving your progress, online rooms and leaderboards. Without this data we cannot run an account.
• To keep the site safe and fair (our legitimate interest): the limits on login tries, reports and the moderation log, and the ban fingerprint. You can object to this at any time by writing to Kuro701@seznam.cz.
• Where the law requires it, for example to answer an authority or to report a data breach.

Giving us data is your choice, and you can play as a guest without giving us any. We make no automated decisions about you and do not profile you.

Who else handles your data

We use a few services to run the site. They handle data only to do their job for us.

• Cloudflare hosts the website, runs the online game rooms, and stores the account database.
• Resend sends the login code to your email address (email login only).
• Discord handles the login if you choose Discord. We only receive your Discord ID from them. What Discord does with your data is covered by Discord's own privacy policy.
• Cloudflare Turnstile checks that a person, not a bot, is asking for a login code (email login only). It is only loaded when you choose email login.

Data leaving the EU. Cloudflare, Resend and Discord are American companies, so your data may be processed in the United States. All three are certified under the EU-U.S. Data Privacy Framework, the agreement under which the EU allows personal data to be sent to certified US companies, and each also uses the EU's Standard Contractual Clauses (standard legal terms that bind them to EU-level protection) as a second safeguard. Cloudflare's and Resend's data-processing terms with us apply automatically when we use their services.

We do not give your data to anyone else, except if the law makes us.

Cookies and browser storage

We use one cookie, which keeps you logged in (once accounts exist), plus short-lived cookies during a login. If you choose email login, Cloudflare's bot check (Turnstile) loads from Cloudflare and may set or read its own security cookie; it exists only to stop bots and is not used for tracking. They are needed for the login to work, so, as Czech data-protection guidance allows for strictly necessary cookies, there is no cookie-consent banner. Games also save things in your browser's own storage, for the same reason: your progress, your sound setting, the name you last typed and, in an online room, your seat so you can rejoin after a dropped connection or a page reload. We use no analytics cookies and no advertising cookies. If that ever changes, we will ask for your consent first.

How long we keep things

• Your account and game data: until you delete your account, or until it has been unused for 24 months. Before an unused account is deleted we email a warning 30 days ahead where we have an email address for it.
• Online game rooms: about 2 hours after the last move, or straight away when the last person leaves.
• Login codes: 10 minutes. Unfinished sign-ups: 15 minutes.
• Login sessions: 30 days of inactivity, or until you log out.
• Reports about a user: until we have dealt with them, then 6 months, or until the account is deleted.
• Moderation log (what an administrator did, and to which username): 12 months.
• Backups: we keep backup copies for up to 30 days, so deleted data can remain in a backup for up to that long before it disappears.
• Ban records (see below): up to 3 years, then removed unless the ban is renewed.

Deleting your account and getting your data

Both are buttons in your account settings.

• Delete my account removes your username, password hash, login details, saves, stats and leaderboard entries. It is a real deletion, not a hidden flag. You need to have logged in recently and type your username to confirm.
• Download my data gives you a file of everything we hold about you.

Bans

If we ban an account for breaking the rules, we keep a one-way scrambled fingerprint (a hash) of the Discord ID or email used, and nothing else. It lets us stop the same person coming straight back. It cannot be turned back into your email or ID. We keep it even if the account is deleted, for up to 3 years. People who leave by choice, without being banned, leave nothing behind.

Who can use accounts

Accounts are for people 18 or older. When you register you confirm this. If we find out an account belongs to someone under 18, we delete it. The kids' game on this site is guest-only and never collects personal data.

Your rights

Under EU data-protection law (GDPR) you have the right to see your data, correct it, delete it, take a copy, and object to how it is used. Most of that you can do yourself in your account settings; for anything else email Kuro701@seznam.cz and we will answer within a month. If you write to us about your data, we may ask you to prove the account is yours (for example by logging in, or by answering from the email address on the account), because we will not hand data to someone who cannot show it is theirs. If you think we have handled your data wrongly, you can complain to the Czech data-protection authority, the Úřad pro ochranu osobních údajů, or to the authority in your own country.

If something goes wrong

If a security problem ever exposes your data in a way that puts you at risk, we will tell you and the data-protection authority as the law requires, and say what happened and what to do. Passwords are never stored in readable form, so a leaked database would not reveal them, but we would still ask people to change theirs.

Changes

If this note changes in a way that matters, we will tell logged-in users when they next visit, and the date and version at the top will change.