Drop DuelPrivacy Policy
Draft. This text is a carefully written draft, not legal advice. Items marked like [PLACEHOLDER: ...] are still to be filled in by the owner before the game is released.
This policy explains what Drop Duel (“the game”) and this website store about you, why, where, for how long, and what you can do about it. We wrote it to match what the game actually does, and we update it whenever that changes.
Who is responsible
The controller of your data is [PLACEHOLDER: full name or company name of the data controller], [PLACEHOLDER: postal address]. You can reach us at [PLACEHOLDER: contact email, e.g. a privacy@ or support@ address on koohan.net]. For Turkish users, the notice required by Law No. 6698 (KVKK) is on the KVKK page.
The short version
- No ads, no analytics, no tracking, no advertising identifiers and no third-party SDKs in the game. This website sets no cookies and loads nothing from other companies.
- You can play every offline mode without any account and without sending us anything.
- When you go online you get an anonymous guest account. An email address is only collected if you choose to create a full account.
- You can delete your account inside the game at any time. See Delete your account. See Delete your account.
What we collect and why
| Data | When | Why | Where |
|---|---|---|---|
| Anonymous account ID and session | The first time you go online (guest) | To tell players apart, connect you to matches and keep your records. It is a random ID, not linked to your device or identity. | Supabase (Frankfurt). On your device, the refresh token is stored in an encrypted file. |
| Player name | Created automatically (Player plus six digits); changeable by you | Shown to your opponents, friends and in search. Do not put your real name or personal details in it. | Supabase |
| Email address | Only if you sign up or log in | To send you a 6-digit login code and to let you sign in on another device. There is no password. | Supabase Auth; the code email is sent through Resend |
| Match records | After each online match | Result, winner, reason, lines, duration, the random seed, the version of the rules and the stream of moves (the inputs of both players) so the server can referee the match and results can be checked. Updates your win/loss counters. | Supabase |
| Rating and rank data | After ranked duels | Your rank, points, win/loss record, streak and duel history, to match you with similar players and to show a leaderboard. | Supabase |
| Personal bests | When you set a record while online | Shown on your profile. | Supabase (also kept on your device) |
| Friends and invites | When you add a friend (accounts only) | Friend requests and accepted friendships; VS invites between friends. | Supabase; invites live only in server memory until they expire |
| Online presence | While the app is connected | So friends can see that you are online and invite you. Not stored permanently. | Server memory only |
| Control settings | When you change them while online | So your touch controls follow you to another device. Text of the settings file only. | Supabase |
| Connection data | Whenever you connect to the server or to Supabase | Your IP address is visible to the servers and providers that carry the connection. We use it only to deliver the connection and protect against abuse; we do not build profiles from it. The game server keeps an operational log (player name or ID, room codes, match start and end) that is rotated automatically. The web proxy in front of the server does not keep access logs. | Our server host, Supabase |
| Data on your device | Always | Settings, chosen look, offline records and the encrypted session file stay in the game’s own storage on your phone. Offline play never leaves your device. The device identifier of the operating system is used only locally, to encrypt the session file; it is never sent to us. | Your device |
Public to other players
Other players of the game can see your player name, your personal bests, your duel rank and points, your duel win and loss record, your place on the leaderboard and your latest duels (opponent, score and rank change). Your email address is never shown to other players.
This website
This website is plain static pages: no cookies, no local storage, no analytics and no third-party scripts, fonts or images. Our website host (Vercel) receives your IP address and standard request data when you load a page, as any web host does, and may keep short-lived server logs.
What we do not collect
We do not collect your location, contacts, photos, microphone or camera data, advertising identifiers or payment details, and the game does not ask for those permissions. The only permission the Android build requests is internet access.
Legal bases
Where the EU/UK GDPR applies we rely on: contract (providing the account, matches, friends and records you ask for); legitimate interests (keeping the game fair and secure, referee and anti-cheat checks, abuse prevention, basic operation logs); and legal obligation where the law requires us to keep or hand over data. We do not rely on consent for anything, because we do not do anything that needs it. For KVKK, see the KVKK page.
Who processes data for us
We do not sell your data and we do not share it for advertising. These providers process data on our behalf:
- Supabase (database and sign-in), project region Frankfurt, Germany.
- Resend (sends the login code email from noreply@koohan.net).
- Our server host ([PLACEHOLDER: hosting provider and country of the game server]), which runs the game server.
- Vercel (hosts this website).
- Apple and Google distribute the app. They act independently and have their own privacy policies; we do not receive your payment or store account details.
We may also disclose data if the law or a valid legal process requires it.
International transfers
Your game data is stored in the EU (Frankfurt). Some of our providers are companies in other countries (for example Resend and Vercel in the United States, and Supabase Inc.). Where data leaves the EU/EEA or the UK, we rely on the safeguards those providers offer, such as standard contractual clauses or an adequacy decision. [PLACEHOLDER: confirm the transfer mechanism for each provider before release]
How long we keep data
| Data | Kept |
|---|---|
| Account, profile, bests, friends, ratings, controls | Until you delete the account, then removed straight away from the live database. |
| Match and duel records | When you delete your account the link to you is removed: the record stays without your ID, so your opponent’s history remains correct. It no longer identifies you. |
| Unused guest accounts | [PLACEHOLDER: how long inactive guest accounts are kept before cleanup, e.g. 90 days] |
| Login code emails | The code expires after 10 minutes. The email provider may keep delivery logs for [PLACEHOLDER: Resend retention period]. |
| Game server logs | Rotated automatically (the server keeps a limited number of log files of limited size, so older entries are overwritten within days to weeks). |
| Database backups | [PLACEHOLDER: backup retention period of the Supabase plan in use] |
| Data on your device | Until you delete the app or its data. |
Your rights
Depending on where you live you can ask us to give you access to your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format, and you can complain to your data protection authority. You can change your player name and delete your account inside the game (how). For anything else, or if you cannot open the app, write to [PLACEHOLDER: contact email, e.g. a privacy@ or support@ address on koohan.net]. We answer within one month. Please send the email address of your account (or your player name) so we can find it. We may ask you to prove you own the account before we act, for example by replying from that address.
Deleting your account
Full steps are on the Delete your account page. In short: in the game open Social → My profile → Account → Delete my account and confirm (an internet connection is needed). This is permanent and takes effect immediately in our live database: your account and email address, profile and counters, personal bests, friends, rating and synced settings are removed. Match and duel records stay without any link to you (see retention above). The delete button exists for accounts with an email address; guests have none, so to remove a guest’s data, or if you cannot open the app, email [PLACEHOLDER: contact email, e.g. a privacy@ or support@ address on koohan.net] with your player name (and from the account’s address if you have one). We may ask you to confirm you own the account and reply within [PLACEHOLDER: response time, at most 30 days].
Children
Drop Duel is not directed at children under [PLACEHOLDER: minimum age, e.g. 13, or 16 where the law requires]. We do not knowingly collect data from them. If you think a child has created an account, contact us and we will delete it.
Security
All connections use TLS (wss and https). Database tables are protected by row-level security so players can only read and change what the game allows; the secret keys that can write sensitive data live only on our server, not in the app. The session file on your phone is encrypted. No system is perfectly secure; if a breach affecting you occurs we will tell you and the authorities as the law requires.
Changes
If the game starts collecting something new, or uses data differently, we update this policy and the KVKK notice before the change reaches players, and change the date below the title. Important changes will also be shown in the game.
Contact
[PLACEHOLDER: full name or company name of the data controller], [PLACEHOLDER: postal address]
Email: [PLACEHOLDER: contact email, e.g. a privacy@ or support@ address on koohan.net]