Privacy

Last updated: 4 November 2026. This page describes what this copy of Cambio actually stores. Ads and cookies are on the Cookies and ads page.

On this device

The game keeps settings in the browser's local storage and session storage. That includes the theme, the age acknowledgement, the terms agreement (the terms version), the deck colours, bot speed, rules, a Pass & Play or solo score list, an on-device room, and a random analytics id used only on this device. The app's own script does not set a cookie.

A sign-in that stays on this device only (used when online play is off) does not keep the email in plain text. It keeps a one-way hash and a masked hint. Clearing this site's data in the browser removes it.

Online accounts (Supabase Auth)

Family tables use Supabase Auth. The browser client is created with the session saved in local storage (persistSession: true, autoRefreshToken: true), not in a cookie set by this app. A sign-in session lasts until you sign out. This app does not set a shorter limit. Sign out calls signOut(). The game's own user() read keeps the account id and whether the session is anonymous. It does not read an email into the game.

• Email link. The address is sent to Supabase Auth so it can email a link and a 6-digit code. Cambio's game tables do not store that address. Other players do not see it. Error text in the app does not repeat it.
• Google. Sign-in uses only the scopes openid, email and profile. The button calls signInWithOAuth with provider google and no further scopes in this code. Supabase's Sign in with Google guide names those scopes openid, userinfo.email and userinfo.profile. This app does not copy a Google name or photo into public.profiles.
• Guest. An invite can open an anonymous Supabase session. It has no email. The server refuses guests a hosted room and a score history. If that guest agrees to the current Terms while signed in anonymously, the server stores the anonymous account id, the terms version and the time. It does not store an email, a device id chosen by the page, or a link to a registered account. A checkbox stored only on this device is not copied onto the next account that signs in. Offline play does not create that row. The proposed retention is 365 days (guest_consent_retention_days). This version does not delete those rows.

What the game tables store

• Profile (public.profiles): account id, screen name, created and updated times, the time you agreed to the Terms, Privacy and Cookies, and the terms version (a date such as 2026-11-04). A later name check can mark a name retired. There is no email column.
• Scores (public.score_history), for a registered account only: score, win or not, player count, mode (quick, pass_play, or family), and the time. Guests are refused.
• Family room: room id, code, host, seats, rules, expiry, and a Google Meet link if the host saved one. The Meet link is readable only by a member of that room. The server checks membership on join, kick, and the Meet read. This page does not weaken those checks.

A family room closes when the host closes it, or when its lifetime runs out. That lifetime is an admin setting from 30 to 480 minutes. The built-in default is 240 minutes (4 hours) after the first deal. Deleting the auth user removes the profile, scores, and room rows that point at that user (on delete cascade).

Supabase Auth's own records and logs

The sign-in account itself lives in Supabase Auth (auth.users), separate from the game tables above. Supabase's User Management guide says you view those rows in the dashboard, and that deleting the auth user is what removes the account. An access token already issued stays valid until it expires.

Supabase's Auth audit logs guide says sign-ups, logins, token refresh, and logout are logged, and that a log can include an IP address and a user agent. Logs can be stored in auth.audit_log_entries and in the project's log storage. Supabase's Check usage for monthly active users page says Pro plan users can access logs for 7 days. That page counts monthly active users from Auth server logs, and it gives the other plans as 1 day (Free), 28 days (Team) and 90 days (Enterprise). Manage Logs Query usage says that if a project goes over its logs-query allowance, retention the next month can shrink to 24 hours on a Pro plan. This repository does not set a different retention.

Staff actions in the Cambio admin page are a different log. That log stores account ids and the action, not an email address, and the repo's audit-retention migration deletes entries older than one year. It is not shown to players.

Analytics

Usage events (a round started, a house ad shown) stay in this browser under a random session id. The logger drops free text that is not on its fixed list. It is not sent to a Cambio server by the code in this repository.

Ads

The shipped build does not load Google's ad script (ADS_ENABLED is false). See Cookies and ads. If that flag is turned on, the ad script still waits until you have agreed in the consent step.

Video calls

A Google Meet link, if the host adds one, opens on Google. Cambio does not receive or store the audio or the video. Google's own terms apply to the call.

Adults only

Cambio is for people aged 18 and over. We do not knowingly collect data from anyone under 18.

Contact and deletion

Privacy questions, and a request to delete an online account, go to Support@gambitchess.space or the form on the contact page. This page does not give a legal name or a postal address.

There is no delete button in the game. Removing the auth user (Supabase dashboard or the Auth admin API, as described in Supabase's user-management guide) is what deletes the profile, scores, and memberships that point at that user. This repository does not call that API from the player app.