Privacy Policy — Full Deck

1. About This Policy

Full Deck ("we," "us," or "our") operates the website at fulldeck.games and related subdomains (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. By using the Service you agree to the practices described here.

2. Information We Collect

Account information. When you sign in with Google OAuth we receive your Google account email address, display name, and profile photo. We store this information to identify your account and personalize your experience.

Game content. Question sets, questions, and answer choices you create are stored so you can host games. This content remains yours.

Player data. When someone joins a game as a player, we collect the display name they enter. No account is required for players.

Usage data. We collect standard server logs (IP address, browser type, pages visited, timestamps) for security and debugging. These logs are retained for up to 90 days.

Cookies & local storage. We use session cookies required for authentication and browser local storage to remember your player ID across game sessions. We do not use advertising cookies or cross-site trackers.

3. How We Use Your Information

To authenticate your account and maintain your session
To provide, operate, and improve the Service
To store and serve your question sets and game history
To diagnose technical problems and ensure security

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Third-Party Services

We use the following third-party services to operate the platform. Each has its own privacy policy:

Google OAuth — authentication (accounts.google.com)
Supabase — database and authentication infrastructure (supabase.com)
Vercel — hosting and infrastructure (vercel.com)

5. Data Retention

We retain account and game data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. Server logs are deleted after 90 days.

6. Security

All data is transmitted over HTTPS. We use industry-standard practices to protect your information, but no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it promptly.

8. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. If you are in the European Economic Area, you have additional rights under the GDPR including the right to data portability and to lodge a complaint with a supervisory authority.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact

Questions or requests regarding this policy can be sent to: byniclee@gmail.com