ENTR

Privacy policy

TavlArena is a free game site with no ads, and no tracking unless you accept analytics cookies. We keep only what we need to run your games and your account, and you can export or delete it.

Who is responsible

The data controller is TavlArena (the TavlArena team). Contact: hello@tavlarena.com. Turkish residents can also read our KVKK notice.

What we store

If you play as a guest

  • Games against the computer, pass and play, puzzles and trainers stay in your browser's storage on your device. We don't receive them.
  • Online games (quick match or a friend's link) need a guest session: a random guest id in an essential cookie, a playful guest name such as "Lucky Tulip 42", and the game itself (moves, clock, dice proof) on our servers.
  • If you report a puzzle without a session, we store a salted hash of your IP address to limit abuse, never the address itself.
  • Feedback or a feature request you send as a guest is saved with your guest id, with the same details as for accounts below, and is deleted with your guest data after a year without visits.

If you create an account

  • Your email address, or your Google account id and email if you sign in with Google.
  • Your display name, language, ratings and rating history.
  • Your finished games (bot, pass and play and online), which are backed up to your account automatically, and your solved puzzles.
  • Feedback and feature requests you send us: the message, its topic, your optional reason for a request, the page you were on (you can clear it before sending), the site language and the app version. No browser or device details. It is in your data export and deleted with your account.

For everyone

  • Server logs (time, address, request and errors) to keep the service running and secure. Our own database does not store raw IP addresses: puzzle reports keep only a salted hash, and rate limits use a keyed hash. Cloudflare, our hosting provider, may process IP addresses in its security and delivery logs.
  • Counts of events such as "game started" or "puzzle solved", by mode, language and settings, without cookies. These never include names, emails, player ids, IP addresses or table ids. To count daily active players once each, we keep a one-way code that changes every day for three days, then only the total. These counts are kept in Cloudflare Workers Analytics Engine.
  • Crash reports, without asking for consent: if one of our own scripts fails, we record the error type, a cleaned message (links, emails, quoted text, ids and numbers removed, at most 120 characters), the script file and line, the page path and the app version. No cookies, no identifiers and no IP address are stored. They are kept in Cloudflare Workers Analytics Engine for three months.
  • Player reports and moderation. If you report another player, we store the table, both player ids, the reason and your note. If someone reports you, we store the same, and any action we take (such as a name reset or a ban from online play). We use this only to keep play safe. Reports you made are in your data export and are deleted with your account.

Cookies

We use one essential cookie: the session cookie that keeps you signed in or keeps your guest seat at an online table. It is set only when you play online or sign in. We use no advertising cookies. Analytics cookies (PostHog, below) are used only if you accept them in the cookie banner. Game statistics and crash reports use Cloudflare Workers Analytics Engine, and page statistics may come from Cloudflare Web Analytics; neither sets cookies. Your device also stores your settings and local games in browser storage; you can clear it in your browser at any time.

Who processes data for us

  • Cloudflare, Inc. hosts the site and its data (Workers, Durable Objects, D1 and R2), delivers our emails and provides Workers Analytics Engine, Web Analytics and Turnstile. Cloudflare acts as our processor. Its network is worldwide, so data may be processed outside Türkiye and the EEA.
  • Turnstile. When you start an online table, Cloudflare Turnstile checks in the background that you're not a bot. It processes your IP address, TLS fingerprint, user agent and the site key, only to detect and block bots. See Cloudflare's Turnstile Privacy Addendum.
  • PostHog (PostHog Cloud EU, servers in Frankfurt), our processor for product analytics, session recordings and error reports, only if you accept analytics cookies. Without your consent PostHog is not loaded and receives nothing. With it, PostHog stores a random id in your browser and receives the pages you visit, clicks without their text, the same game events as above, error reports and a recording of the page with all text and inputs hidden. We never send your email, display name, player id or feedback. PostHog keeps analytics events for up to 1 year and recordings for up to 30 days. You can withdraw consent at any time with "Cookies" in Settings.
  • Google, only if you choose "Sign in with Google": Google tells us your account id and email; its own privacy policy applies to your Google account.
  • Email. Sign-in links and turn reminders are sent from no-reply@notify.tavlarena.com through Cloudflare's email service. We don't send marketing email.

We don't sell data, and we don't share it with advertisers.

Transfers outside the EEA or Türkiye rely on our providers' standard contractual clauses, and on the EU–US Data Privacy Framework where the provider is certified. For transfers from Türkiye we use the standard contracts under KVKK article 9. Write to hello@tavlarena.comfor details or a copy of these safeguards.

Why we process it (legal bases)

  • To provide the service you ask for (games, accounts, ratings, backups): performance of our agreement with you.
  • To keep it safe and fair (logs, rate limits, Turnstile, fair-play checks on rated games, abuse reports, crash reports): our legitimate interest in a secure, fair and working service.
  • To improve it (aggregate counts with no personal data): our legitimate interest.
  • Analytics with PostHog: your consent, which you can withdraw at any time in Settings.

How long we keep it

  • Server logs: 30 days.
  • Crash reports: three months.
  • Player reports and moderation records: up to one year.
  • Guest sessions and their data: deleted or anonymised after 12 months without use.
  • Accounts: until you delete them. On deletion, your finished games stay in your opponents' history as "Deleted player".
  • Dice proofs of finished online games are kept so anyone can still check them; they hold random ids, not your name or email.
  • Sign-in links expire after 10 minutes.

Export and delete

On the Account page you can download your data as a file and delete it, whether you're a guest or signed in. Deleting asks you to confirm and, for accounts, to have signed in recently. Games stored only in your browser are separate: the Account page shows how to clear them, or clear your browser's site data.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to processing, and you can complain to your data protection authority. Under Türkiye's KVKK (article 11) you have similar rights, listed in our KVKK notice. Write to hello@tavlarena.com; we reply within 30 days.

Children

Anyone can play as a guest; we don't ask your age. To create an account you must be 13 or older, and if you are under 18 you need the permission of a parent or guardian. If you believe a child under 13 has an account, write to us and we will delete it.

Changes

If we change this policy, we update the date below and, for important changes, tell signed-in players on the site.

Updated: