Privacy

This describes what a gammonchain server stores. gammonchain is open source and anyone may run their own instance, so this document describes this instance. If you are reading it somewhere else, it is that operator's policy.

The short version

You can play without giving us anything. No account, no email, no cookies, no analytics, no third-party trackers. If you choose to register, we store your email address so we can send you a sign-in link and, if you ask for it, a daily puzzle.

If you never register

Your identity is a cryptographic key generated in your browser and stored there. We never see the private half. We store the public half alongside your rating and game record. That is a pseudonym, not a person: we have no way to connect it to you.

We set no cookies. Your settings and your key live in this browser's local storage, which is not sent to us.

If you register

We additionally store:

Your email address — to send sign-in links, and daily puzzles if you opt in. Never sold, never shared, never used for anything else.
Your username — shown publicly on the leaderboard and in matches.
Your account key — so a link in your inbox can sign you in on a new device. This is a real trade: it means the operator of this server could technically sign as you. Playing as a guest avoids that, and the account panel says so.
A short-lived sign-in token when you request a link. Single use, and it expires.

Email is only ever sent after a confirmed double opt-in. Every message carries a one-click unsubscribe.

Match records are public and permanent

Finished matches are published as signed, tamper-evident records so that anyone can verify the dice were fair — that is the entire point of this project. A record contains the moves, the dice, the timestamps and the public keys of both players. It does not contain your email address.

These records are immutable by design. They cannot be edited or withdrawn after the fact, because a record that could be changed would prove nothing. Your opponent also relies on them to verify a game you both played.

Deleting your account

The account panel has a delete my account button. It erases your email address, your username, the key stored with your account and your mail subscription. After that the operator holds no way to contact you and no way to sign as you.

Published match records remain, for the reason above. What is left is a bare public key with a win/loss count, no longer linkable to you by anything this server stores.

Who else sees your data

The email provider configured by this instance receives your address in order to deliver mail to it.
The hosting provider processes network traffic, as with any site.
Error reports, if this instance sends them anywhere, are scrubbed of email addresses and tokens before they leave the server.
Analysis workers receive board positions only — never anything identifying.

There are no advertising, analytics or tracking integrations of any kind.

Your rights

If you are in the UK or EU, the GDPR gives you the right to access, correct, export or erase your personal data, and to object to processing.

Erasure is self-service and needs no contact at all — the account panel has a delete my account button, and it takes effect immediately. That is deliberate: it means the request that most obviously involves your personal data is one you never have to send to anybody.

For anything else — a question about this policy, a copy of what is held, or a complaint — write to [email protected]. It reaches a person, not a ticket queue, and it is the right address for anything you would rather not put in public.

Bugs are better described than emailed: the board can save a report of exactly what it offered you when something went wrong, and that file says more than a paragraph can.

Children

Accounts are not intended for children under 13 (16 in some EU countries). Do not register if you are younger than that — you can still play as a guest.

Who runs this

gammonchain is operated as an independent, non-commercial project — not a company. There is no revenue, no advertising and nothing for sale, which is why there is so little to say above about what happens to your data: almost nothing does.

For data-protection purposes the person running this instance is the controller. If you are reading this on someone else's deployment, it is that operator, not the project.