Privacy

This is a small site for playing burraco with friends. It keeps what it needs to run the games and nothing else.

What is stored about you

• Your account: the first name and the profile picture Google hands over when you sign in, your e-mail address, when the account was made and when you last signed in. There is no password here: Google does the signing in, and we never see it.
• Your games: which games you sat at, the deck as it was dealt, and every move you made, with the cards involved and when. The table you see is rebuilt from those moves.
• Your choices: how you like the cards shown (melds fanned or in columns, the cloth of the table, cards in full or in half) and the language of the last page you read. They are kept with your account rather than with one browser, so that they follow you from one device to the next, and only what differs from the defaults is kept at all.

Your name and picture are visible to the other players at your table. Your name also appears in the list of games on the front page, which anyone can read without signing in. Your e-mail address is shown to nobody but you: it is only used to recognise you when you sign in again. Your record of hands against people is on the leaderboard, which only signed-in players see, and a month you finish in the top three stays in the hall of fame.

If you switch on turn notifications, your browser gives us an address to send them to and two keys to encrypt them with. We store those three values against your account, one set per device, along with when the set was made and when we last sent one. They are the browser's, not ours: they only let us send that browser a message it can read, and they cannot be used to identify you anywhere else or to read anything back. Switch the notifications off, or clear the site's data, and the record goes.

Google user data

Signing in with Google asks for the openid, email and profile scopes, and nothing more. From them we get your e-mail address, your first name and your profile picture. We have no access to your mail, contacts, calendar, files or anything else in your Google account, and we do not keep Google's access or refresh tokens.

Those three things are used only to sign you in and to show who you are at the table, as described above. They are not used for advertising, not sold, not used to build profiles, and not used to train any AI or machine learning model.

Apps that play here, such as the XR table, sign you in with Google the same way and get the same three things. In exchange they receive a token tied to one device, so you stay signed in there; we store only a hash of it, the device name the app sends, when it was made and when it was last used.

This site's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can withdraw this site's access at any time from Third-party apps and services in your Google account. That stops new sign-ins; to have the data already stored removed, see below.

Cookies

• A session cookie lasting a week, so the site knows it is still you between pages. Signing out ends it.
• A live-updates cookie lasting a day, which lets the page you are on hear about moves as they happen. It is only sent to the updates feed.
• A language cookie lasting a year, holding nothing but the language of the last page you read, so that the bare address leads you back to it.

There is no advertising, no analytics and no tracking of any kind.

In your browser

The order you last sorted your hand by, runs or sets, is kept in your browser's own storage. It never leaves it. The site also installs a small worker that shows the turn notifications; it caches nothing, and it goes when you clear the site's data.

E-mail

This site sends no e-mail at all.

Other people

Your data is not sold, shared or passed to anyone else. Three outside services are involved: Google, when you sign in; the push service of your browser's maker, when we tell you it is your turn; and Google Fonts, from which your browser fetches the typefaces the pages are set in. The push service carries the message but cannot read it, as it is encrypted for your browser alone. Fetching a font tells Google your IP address, as any request does, and nothing about who you are on this site. The site runs on its own server; the web server keeps ordinary access logs, which include IP addresses, and error logs are kept to fix faults.

How long it is kept, and how

Your account and games are kept for as long as the site runs, or until you ask for them to be removed. Notification records go when you switch notifications off or when the push service says the browser is gone. Server logs are kept only as long as they are useful for running the site and fixing faults, then deleted. Everything travels over HTTPS, the database is not reachable from outside the server, and app tokens are stored only as hashes.

Removing your account

Finished games have to keep showing who played them, so accounts are not deleted on request from the site itself. If you want your name, picture and address removed outright, ask and we will do it; the games you played will stay, without you named on them.

Getting in touch

For anything on this page, or to have your data removed, contact Massimiliano Arione.