This Privacy Policy explains what information Triple Triad Online (tt.dax.gg) (the "Service") collects, why, and what choices you have about it.
| Category | What we collect | Why |
|---|---|---|
| Account | Username, display name, password (stored only as a one-way bcrypt hash; we never see or store your actual password), email address (and, while you're changing it, the new address waiting to be confirmed) | Account creation, login, email verification, password recovery |
| Gameplay | Match history, match replays (the list of moves played, kept for 30 days), card collection, saved hands, avatar (icon or custom avatar and the avatar pieces you own), guild membership, Auction House listings, level/EXP/currency balances | Core gameplay functionality |
| Social | Friends list, pending friend requests, players you've blocked | Friends and blocking features |
| Communication | Messages sent in global chat, guild chat, match chat, and direct messages | Enabling in-game chat; global chat is reviewed by moderators for Acceptable Use compliance |
| Bug reports & feedback | Anything you write in the Help page's Report a Bug and Send Feedback forms, sent along with your username, display name, level, the date your account was created, your chosen theme, your screen size and your browser type | Fixing bugs, improving the game, and replying to you about your report |
| Optional profile info | Bio, favorite cards, country flag | Shown on your profile page if you choose to set them |
| Technical | IP address: used transiently for rate-limiting on login, registration, and password-reset requests; also retained as your account's last-known IP, refreshed on every login | Preventing spam, brute-force login attempts, and automated account creation; letting us block new account registrations from an IP address tied to a banned account, to prevent ban evasion |
| Account activity | A log of when your account registered, signed in, signed out, or was deleted (date and time only; no IP address) | Account security and investigating suspicious activity |
We do not sell your information to third parties, use it for advertising, or send marketing email you haven't asked for.
Your email address is used exclusively for account verification, password resets, and important account/service notices. Never shown to other players, never used for marketing. Outbound email is sent via a third-party transactional email provider (currently Resend) solely to deliver these messages; they don't have access to your account beyond what's needed to send that one email.
When you send a bug report or feedback from the Help page, it's emailed to the Service's operator with your account's email address set as the reply address, so they can answer you directly. Your address isn't shown to anyone else.
The Service stores a small amount of information in your own browser:
None of this is shared with anyone else. We don't use third-party tracking, analytics, or advertising cookies.
You can delete your own account at any time from Settings → Account. Doing so is permanent and:
Bug reports and feedback you've sent are kept in the operator's email rather than in the game itself, so deleting your account doesn't remove them. You can ask for them to be deleted via the contact details below.
Match replays are deleted automatically 30 days after the match, whether or not the account still exists.
An account whose email address isn't verified within 3 days of signing up is closed automatically: its email address and profile details are removed, and its username is released so someone else can use it.
Some gameplay records, such as match history entries, guild membership records, and prior chat log entries, may be retained in an anonymized form (your username stays reserved and associated with those historical records) so that deleting your account doesn't corrupt other players' match history or guild rosters. These retained records no longer contain your email, IP address, or any other personally identifying information beyond your username and former display name.
If your account is banned, your email address may be retained indefinitely in a separate list specifically to prevent that same address from being used to register a new account, even if the banned account is later deleted. Separately, the Service owner may also block new account registrations from the IP address associated with a banned account, retained the same way and for the same reason. This only affects new registrations, not logins to other, unrelated accounts.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data (for example, under GDPR if you're in the EU/UK, or similar state-level laws in the US). Account deletion via Settings covers the large majority of these requests directly and immediately. For anything else, including a full data export request, reach out via the contact details below.
The Service isn't directed at children under 13, and we don't knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, please contact us so we can remove it.
This policy may be updated from time to time as the Service evolves. Material changes will be reflected by an updated "Last updated" date above. Continuing to use the Service after changes take effect means you accept the revised policy.
Questions about this policy, or a data access/export/deletion request beyond what Settings → Account covers, can be sent via the contact details on dax.gg.