Privacy Policy

The short version

Async Games collects what it needs to run your games and tell you when it's your turn — and nothing else. In particular:

• We do not sell or rent your data, to anyone, ever.
• We do not send marketing emails. The only messages we send are the push notifications you turn on.
• We do not run advertising or third-party analytics, and there are no tracking cookies.
• We don't build profiles of you or make automated decisions about you.

The rest of this page is the detail behind those promises. If anything here is unclear, email privacy@asyncgames.com.

Who this policy covers

This policy applies to Async Games, the turn-based games service at asyncgames.com and its installed app. Async Games is the controller of the personal data described below. You can reach us at privacy@asyncgames.com.

What we collect

Account information

Accounts are created and held through Clerk, our authentication provider. Depending on how you sign up, that means your email address, a username, optionally a first and last name, and either a password or an identifier from the sign-in provider you chose. We never see or store your password ourselves.

Game data

To run a game we store, keyed to your account ID: the games and invitations you are part of, the other players in them, every move you make and the history of moves in the game, the turn timer you chose and when each turn was taken, finished-game results and the statistics derived from them, reactions you leave on other players' turns, and your friend connections and pending friend requests.

To show you to the people you play with without asking our authentication provider every time, we also keep a short-lived copy of the details they see: your display name, your username if you have one, and the link to your profile picture. It is refreshed from your account whenever someone looks you up, replaced at once when you change your name, and erased when you delete your account.

Notification data

If you turn on push notifications, we store a notification token for each device you enable them on, along with a short description of that device worked out from your browser's user-agent string (device type, operating system and browser — for example “iPhone · Safari”), so you can tell your devices apart in Settings, plus when it was registered and last seen. We also store which notification channels you have switched on. Tokens that stop working are deleted automatically by a nightly job, and you can remove any device yourself from Settings.

Technical logs

Our hosting provider records standard server logs for requests to the site — IP address, user agent, the URL requested and a timestamp. These are used to run the service, debug faults and protect against abuse, and are kept for a short period before being deleted.

Why we use it, and our lawful bases

• To provide the service — creating your account, running games, showing your history and stats, connecting you with friends. Lawful basis: performance of our contract with you.
• To notify you that it's your turn or that something happened in a game. Lawful basis: your consent, given when you allow notifications in your browser and enable channels in Settings. You can withdraw it at any time.
• To keep the service working and safe — debugging, preventing abuse and enforcing our terms. Lawful basis: our legitimate interests in operating a secure service.

What other players can see

Async Games is a multiplayer service, so some of your data is shown to the people you play with: your username and display name, your avatar, the moves you make and the history and recap of games you share, results and statistics from those games, reactions you leave, whether you are friends, and roughly when you last took a turn. Your email address is never shown to other players.

Because that data is shared, deleting your account also removes those games, results and reactions from the players you shared them with — see Deleting your account below.

Who else processes your data

We use a small number of service providers to run Async Games. They process data on our instructions and are not permitted to use it for their own purposes:

• Clerk — authentication and account storage. Holds your account details, your notification tokens and your notification preferences.
• MongoDB Atlas — the database holding games, invitations, results, reactions, friendships and the short-lived copy of your display details described above.
• Vercel — hosting, content delivery, the API that serves the app, and the server logs described above.
• Google Firebase Cloud Messaging — delivering push notifications. Firebase receives the notification token for the device being notified and the contents of the notification (for example “It's your turn in Dice Cities”). The push service worker in your browser also loads the Firebase messaging library from Google's CDN (gstatic.com), which means Google sees a request from your browser when the app registers for push.
• Your device's push service — Firebase hands notifications to Apple, Google, Mozilla or Microsoft's push infrastructure depending on the browser and device you use, so the message can reach you.
• A scheduling service calls a fixed endpoint on our API on a timer, so that turn timers expire on time. It sends no personal data and receives none.

We do not use Google Analytics, Firebase Analytics or any other analytics product. The site's font is bundled with the app rather than fetched from a font CDN, so loading a page doesn't tell a third party you visited.

Cookies and local storage

We use only what the service needs to function. Clerk sets essential cookies to keep you signed in. Your browser's local storage remembers small interface preferences, such as a banner you dismissed, and the app's service worker caches files so the installed app can open offline. There are no advertising or tracking cookies, and we do not share cookie data with anyone.

International transfers

Our providers are based in, or store data in, the United States and other countries. Where data is transferred out of the UK or European Economic Area, that transfer relies on the safeguards those providers put in place — typically the UK Addendum and the EU Standard Contractual Clauses.

How long we keep it

• Account data is kept while your account exists, and is deleted when you delete it.
• Games, results and reactions are kept while your account exists, so your history and statistics stay intact. They involve other players too, so while your account is open a finished game remains visible to them.
• The copy of your display name, username and picture link is removed if nobody looks you up for 30 days, as soon as you change your name, and as soon as you delete your account, which leaves nothing but your account ID in it for an hour.
• Notification tokens are removed as soon as they stop working, or when you remove the device.
• Server logs are kept only briefly, for debugging and security.

Deleting your account

You can delete your account yourself, at any time, from Settings → Account → Delete account. We ask you to confirm, and then it happens immediately — there is no waiting period and no way for us to undo it. Deleting removes:

• every game you are part of, finished or in progress, along with the moves and history in it;
• the invitations you have sent and the ones you have received;
• the results and statistics of your games, and the reactions you left or received;
• your friend connections and any pending friend requests;
• the copy of your display name, username and picture link we keep to show you to other players;
• your account with Clerk — your email address, username and sign-in details — together with your notification tokens and notification preferences, which are held there.

Because games are shared, the players you were in a game with lose that game and its result too, and the other players in a pending invitation lose the invitation. Nothing of yours is kept behind under a “deleted player” label. What can outlast the deletion is the short-lived server logs described above, and any backup copies our providers hold, which age out on their own schedules.

If you would rather we did it for you, or you can no longer sign in, email privacy@asyncgames.com and we will deal with it within one month.

Your rights

You can access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent for notifications at any time (Settings, or your browser's notification permission). Deleting your account and the data attached to it is something you can do yourself, from Settings — see Deleting your account above. For anything else, email privacy@asyncgames.com and we will deal with it within one month.

If you are in the UK or the EEA and you think we have handled your data badly, you can complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.

Children

Async Games isn't intended for children under 13, and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll remove it.

Security

Traffic to the site is encrypted in transit, credentials are handled by our authentication provider rather than stored by us, and access to the database is restricted. No service can promise perfect security, but we keep the amount of data we hold small deliberately.

Changes to this policy

If we change this policy we'll update the date at the top of the page, and we'll tell you in the app if the change is significant.