Privacy policy
What we store when you play
Playing without an account
You can play practice games and join friend rooms without signing in. Practice best scores are saved in your browser, not an account leaderboard. Your browser also stores your room seat token and nickname so you can return to a room.
Optional accounts
If you register, we store your email address, account identifier, password hash and account timestamps. We do not store your password in plain text. Email verification and password-reset codes are stored as hashes and expire after ten minutes. Login sessions expire after seven days. Logging out ends the current session; resetting your password revokes existing sessions.
If Google sign-in is enabled and you choose it, we receive your Google account identifier, email and display name to sign you in. Google handles its own sign-in page under its privacy policy. Google sign-in is not available unless configured.
Friend rooms
Room participants can see your nickname, readiness, moves and round scores. Room links allow others to join; share them only with intended players. Rooms expire after 24 hours. Expiration blocks access; physical deletion can occur later during database cleanup.
Service providers and security
The hosting and network providers process request information such as IP addresses and browser headers to deliver and protect the service. Authentication uses IP/email-based limits to reduce abuse. If verification email is configured, the configured email provider processes your email address and message delivery. We use first-party website statistics hosted on Cloudflare to understand page visits, approximate visitors, sessions, referral channels, language, device, browser and broad country/region. Random browser identifiers are hashed before storage; raw IP addresses and URL query strings are not stored in the statistics database. Do Not Track, Global Privacy Control and our statistics opt-out are respected.
Account activity and daily reports
Registration-code requests, completed registrations, sign-ins, password-reset requests and completions, and sign-outs are recorded with the time, result and email address supplied with the request. Passwords, verification codes, session tokens and Google authorization codes are never included. These records support security and service operations, and are summarized in daily reports. Operational account notifications and daily reports are delivered privately to the operator through Telegram. Page statistics and delivered account events are retained for 90 days; undelivered operational notifications may be retained until delivery.
Storage and retention
Browser records remain until you remove them or leave a room. Account records remain in the account database; this version does not yet provide self-service account deletion. Expired authentication records are removed during relevant authentication cleanup operations, not necessarily immediately at expiry. Infrastructure logs follow the deployed provider’s settings. No fixed provider-log retention period is promised here.
Your controls
You can play as a guest, log out, and clear this site’s browser data. Clearing browser data removes local scores and room access on that device but does not delete a server account. Do not submit sensitive information as a nickname.
Privacy questions and deletion requests
Contact The Little Dice Club at [email protected] for privacy questions or to request account deletion. Write from the email associated with your account; we may ask you to verify ownership before processing a request. Never send your password or verification code.