Privacy Policy

You sign in with your Google account. We keep three things from it: your Google account ID, your email address, and whether Google has verified that address. Google also sends your name and profile photo with every sign-in. We do not read them and do not store them.

Your email address is never shown to other players, and we send nothing to it.

Signing in starts a session. We store only a fingerprint (a SHA-256 hash) of its token, never the token itself. A session ends at the latest 30 days after you last used durak, and signing out ends it at once.

Before you play online you choose a display name. It is what the other players see, and you can change it once every 30 days. We keep the time of your last change, to know when you may change it again.

For each table we store who opened it, its settings, and who sat in which seat. For each game we store how the deck was shuffled, every move with its time and whether you, a bot or the timer made it, and who was left the durak. That record is the game: the server replays it to know where the game stands, and it lets a dispute be settled and a fault found.

Every signed-in player sees the open tables in the lobby, with the names of the players sitting at them. At a table, the other players see your name, every card you play, whether you are connected, and how each game ended. Nobody but you sees the cards in your hand.

If you leave a game, or stay away from it too long, a bot plays your seat to the end of the game, and the record says which moves it made.

A practice game is dealt and played in your browser and is never sent to us. For the strongest bot, your browser downloads its network from our server, and that request carries nothing about you.

The website keeps these in your browser, and nothing else:

durak_session

Keeps you signed in. Scripts on the page cannot read it, and it expires at the latest 30 days after you last used durak.

durak_oauth_state, durak_oauth_verifier

Exist only while you sign in with Google, to protect that step against forgery. They expire after ten minutes.

i18next

Remembers your language for a year.

theme, palette

Remembers your theme and your colours, if you choose them. Both are kept in local storage rather than in a cookie.

durak.practice

Remembers the settings of your last practice game, from the deck to the bots' level, in local storage.

Each of these is strictly necessary for something you asked for, which is why the site does not ask for consent. There are no tracking or advertising cookies.

durak runs on a server we rent from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, which processes data on our behalf. The database is on that server.

Every time your browser contacts the server, it records your IP address, the time, the address requested, the response's status and size, the referring page and your browser's identification. We use that to keep durak running and secure, including limiting how many requests one address can send. These logs are deleted after 14 days. durak itself does not record IP addresses.

When you choose to continue with Google, you sign in on Google's own page, and Google tells us your account ID and your email address. Google processes that sign-in under its own privacy policy.

Google LLC is based in the United States and is certified under the EU–US Data Privacy Framework, on which the transfer rests (Art. 45 GDPR). To check that a sign-in is genuine, our server also fetches Google's public signing keys; that request carries nothing about you.

Nobody beyond what this page describes: other players see what the sections above say they see, netcup hosts the server, and Google handles sign-in. We do not sell your data or use it for advertising. The pages load no third-party scripts, fonts or trackers; everything, the card art and the bot's network included, comes from our own server. We disclose data to an authority only when the law obliges us to.

• Your account, your name, and your tables and games are processed to provide the game you signed up for (Art. 6(1)(b) GDPR).
• The server logs, the record of each game and the limits on requests serve our legitimate interest in running durak securely and fairly (Art. 6(1)(f) GDPR).
• The cookies and local storage above are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

• Your account and your name: until you delete your account.
• Tables and games: they stay after a table closes, and after you delete your account they stay without your name.
• A session: at the latest 30 days after you last used durak, or until you sign out.
• Server logs: 14 days.

You can delete your account yourself, in Settings. If you are in the middle of a game, a bot takes your seat and plays it to the end.

If you can no longer sign in, write to us from the email address of your account and we will delete it within one month. Either way, that removes your email address, your link to Google, your sessions and your name.

The games you played stay, because they are also the other players' games, but your name is taken off them. Deleted data can remain in our database backups until those are replaced.

You must be at least 16 to create an account. If we learn that an account belongs to someone younger, we delete it. A parent or guardian can ask us to by email.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to receive it in a machine-readable format (Art. 20). You can change your display name yourself in Settings, and delete your account there.

You can object at any time to processing that rests on our legitimate interests (Art. 21 GDPR).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

Before durak stores anything new, or offers another way to sign in, we will update this page and the date at the top.

For any question about this policy or your data, write to us at the address above or by email.

Card art: Vector Playing Cards by Chris Aguilar, copyright 2011, 2017.

The faces are licensed under the GNU Lesser General Public License, version 3, and the back under Creative Commons Attribution-ShareAlike 4.0. We optimised the files, which removed their editor metadata and nothing that is drawn, and share the back under the same licence.