1. Who We Are

PlayVersusAI ("we", "us", "our") is an independently operated website at playversusai.com offering free browser games played against computer opponents or other people. We are the controller of the personal data described in this policy. You can reach us about anything in it at admin@playversusai.com.

This policy explains what we collect, why, who else receives it, how long we keep it, and the choices and rights you have. Our cookie policy lists the individual cookies and browser storage items in more detail.

2. The Short Version

  • You can play every game without an account. Guest games are stored without a name attached.
  • If you register, we store your username, email address and game statistics in our database, which is run by Supabase in the United States.
  • Your username, statistics, leaderboard positions and finished games (including replays) are public.
  • The site is funded by Google AdSense. Google uses cookies to serve and measure ads; visitors in the EEA, UK and Switzerland are asked for consent first, and everyone can change their choices with the Privacy & Cookie Settings link in the footer.
  • We do not currently run any analytics service, and we do not sell your personal data for money.

3. Information We Collect

3.1 Information you give us

  • Account details: when you sign up we collect a username, your email address and a password. Passwords are handled by our authentication provider, Supabase, and are stored only as a secure hash; we never see them in plain text.
  • Messages: if you email us, we receive your email address and whatever you choose to include.

3.2 Information created as you play

  • Game records: when a game finishes we save the game type, the full move list, the result, the difficulty level, the game length, move-timing figures and, where Coach Mode is used, the coach's move ratings. If you are signed in, the record is linked to your account; if not, it is saved with no account attached.
  • Scores and statistics: high scores and fastest times for solo games, and win/loss/draw totals, plus the dates you joined and last logged in.
  • Multiplayer matches: the room code, the players' accounts, every move, the match status and result, any move timer and any optional room password you set. Your username is shown to your opponent.
  • Anonymous position statistics: when a signed-in player wins certain games with Coach Mode on, we record a fingerprint of a few board positions and the winning moves. These records contain no user ID or username.

3.3 Information stored on your device

  • Login session: if you sign in, Supabase stores your session tokens in your browser's local storage so you stay logged in between pages and visits.
  • Game data: personal best scores, the daily Word Guess board and streak, and one leaderboard display preference are kept in local storage. They never leave your device.

3.4 Technical information collected by our service providers

Like any website, every request your browser makes reveals your IP address, browser type and the page requested. This is received by our web host, by Supabase when the site talks to our database, by jsDelivr (the content delivery network that serves the Supabase code library), and by Google when ads or the consent message are loaded. These providers keep short-term logs for security and operations.

3.5 Advertising information collected by Google

Google AdSense and its partners may collect information such as cookie identifiers, your IP address, device and browser details, and how you interact with ads, in order to serve, personalise (where permitted) and measure ads and to prevent fraud. See section 6.

3.6 Analytics

We do not currently use Google Analytics or any other analytics service. The site's code contains an optional Google Analytics 4 integration that is switched off. If we ever switch it on, we will update this policy first, and in the EEA, UK and Switzerland it will only use analytics cookies if you consent.

4. How We Use Information and Our Legal Bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases under Article 6:

  • Performance of a contract (Art. 6(1)(b)) to create and run your account, save your games and statistics, show you on leaderboards, run multiplayer matches and provide replays, and to send service emails you ask for, such as account confirmation and password reset links.
  • Legitimate interests (Art. 6(1)(f)) to keep the site secure and working, prevent cheating and abuse (including suspending accounts that break our terms), store and publish anonymous guest game records and site-wide totals, improve our games and AI opponents using aggregated or de-identified data, and answer your messages. We have weighed these interests against your rights; you can object at any time (see section 11).
  • Consent (Art. 6(1)(a)) for advertising cookies and personalised ads in the EEA, UK and Switzerland, collected through Google's consent message, and for analytics if we ever enable it. You can withdraw consent at any time without affecting earlier processing.
  • Legal obligation (Art. 6(1)(c)) where we must keep or disclose information to comply with the law.

We do not use your data for automated decision-making that has legal or similarly significant effects on you.

5. What Other Players Can See

  • Your username, statistics and leaderboard positions are public.
  • Finished games appear in the public recent-games feed and can be replayed move by move by anyone. A replay shows the moves, result, game settings and your username if you were signed in; guest games are labelled Anonymous.
  • In multiplayer, your opponent sees your username and your moves in real time.
  • Your email address is never shown to other players.

6. Advertising and Google

We use Google AdSense to show ads, which is how the site stays free. Ads currently appear in side rails on wide desktop screens. Google's advertising disclosures, which we are required to pass on to you:

  • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
  • You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu.

If you opt out or decline consent you will still see ads, but they will not be personalised to you. Google may still use cookies or similar technology for limited purposes such as frequency capping, fraud prevention and measurement, subject to your consent choices where required. Learn more in How Google uses information from sites or apps that use its services, How Google uses cookies in advertising and Google's Privacy Policy.

7. Consent and How to Change Your Choices

We use Google's consent management platform (Google Privacy & messaging, which is certified under the IAB Europe Transparency & Consent Framework). Visitors from the European Economic Area, the United Kingdom and Switzerland see a consent message on their first visit. Until you make a choice, Google Consent Mode tells Google tags that advertising and analytics storage are denied for those regions, so personalised ads and advertising cookies are not used.

You can change or withdraw your choices at any time with the Privacy & Cookie Settings link in the footer of every page, which reopens the consent message. Where Google's US state privacy message applies, the same link opens the "do not sell or share" option described in section 12. If the consent tool cannot load (for example because of an ad blocker), the link takes you to the choices section of our cookie policy, which explains the browser and Google settings you can use instead.

8. Who We Share Information With

We do not sell your personal data for money. We share it only with the service providers that run the site, and only as far as needed:

  • Supabase, Inc. provides our authentication, database and real-time multiplayer services. Our project is hosted in the United States (AWS region us-east-2, Ohio). Supabase also sends our account emails, such as confirmation and password reset links.
  • Google (Google LLC, and Google Ireland Limited for users in the EEA and Switzerland) provides advertising through AdSense and the consent message.
  • Our web hosting provider (GoDaddy) serves the website's files.
  • jsDelivr delivers the Supabase JavaScript library to your browser.

We may also disclose information if required by law, to protect the safety of our users or the public, or to enforce our terms of service. If the site were ever transferred to a new owner, your information would transfer with it under this policy, and we would tell you first.

9. International Transfers

Our database is located in the United States and Google processes data in the United States and other countries. If you are in the EEA, the UK or Switzerland, this means your personal data is transferred outside your region. Where the recipient is certified, these transfers rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions; otherwise they rely on the European Commission's Standard Contractual Clauses (and the UK addendum) included in our providers' data processing terms, together with their technical and organisational security measures.

10. How Long We Keep Information

  • Account details and statistics: for as long as your account exists. When you ask us to delete your account, we delete it together with your profile, statistics and the games linked to it within 30 days.
  • Guest game records and anonymous position statistics: kept indefinitely for replays, site totals and engine tuning. They are not linked to any account.
  • Multiplayer match records: for as long as the accounts involved exist, or until deleted on request.
  • Emails you send us: for as long as needed to deal with your request, and normally no longer than two years.
  • Service provider logs: kept by Supabase and our host for limited periods set by their own retention policies.
  • Data in your browser: until you log out (session tokens) or clear this site's data.
  • Google advertising cookies: lifetimes are set by Google, and are described in Google's own policies linked in section 6.

11. Your Rights

Depending on where you live, and in particular if you are in the EEA, the UK or Switzerland, you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectify inaccurate data;
  • erase your data ("right to be forgotten");
  • restrict how we use it;
  • data portability: receive the data you gave us in a machine-readable format;
  • object to processing based on legitimate interests;
  • withdraw consent at any time, using the Privacy & Cookie Settings link for advertising choices;
  • complain to your local data protection authority (in the UK, the Information Commissioner's Office).

How to exercise them: email admin@playversusai.com, ideally from the address registered to your account, and tell us what you would like us to do. We may need to confirm that the account is yours before acting. We respond within one month, and there is no charge. For data held by Google about your ad interactions, use Google's privacy controls as well.

12. US State Privacy Rights (including California)

If you live in California or another US state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia or Utah), you have additional rights.

What we collect

In the past 12 months we have collected these categories of personal information: identifiers (username, email address, IP address, cookie and session identifiers); internet or other electronic network activity (games played and moves made, and interactions with ads collected by Google); and inferences drawn by Google for ad personalisation. The sources, purposes and recipients are described in sections 3, 4 and 8. We do not collect sensitive personal information as defined by these laws.

"Selling" and "sharing"

We do not sell personal information for money. However, allowing Google and its partners to use advertising cookies for personalised ads may count as "selling" or "sharing" personal information for cross-context behavioural advertising under California law and similar laws. You can opt out of this "sale" or "sharing" by using the Privacy & Cookie Settings link in the footer (which opens Google's opt-out option where it is available in your state), by turning off personalised ads in Google Ads Settings, or by emailing us. We do not knowingly sell or share the personal information of anyone under 16.

Your rights

You may request to know what personal information we hold about you, to receive a copy, to correct it, and to delete it, and to opt out of sale, sharing and targeted advertising. Send requests to admin@playversusai.com. We will verify your request by confirming you control the email address on the account, and you may use an authorised agent with your signed permission. If we decline a request, you can appeal by replying to our decision. We will not discriminate against you for exercising any of these rights.

13. Children

PlayVersusAI is a general-audience site and is not directed at children under 13. You must be at least 13 to create an account, and if you are under the age at which you can consent to data processing in your country (up to 16 in some EEA countries), you need a parent or guardian's permission. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email admin@playversusai.com and we will delete it.

14. Security

Data travels between your browser and our providers over encrypted HTTPS connections. Our database uses row-level security rules that limit what each account can read and change, and passwords are stored only as hashes by Supabase. No system is perfectly secure, so please use a password you do not use anywhere else.

15. Changes to This Policy

When we change how we handle data, for example by adding a new service provider or enabling analytics, we will update this page and the date at the top before the change takes effect. Significant changes will also be noted on our What's New page.

16. Contact Us

Questions, requests or complaints about privacy: admin@playversusai.com. You can also use our contact page. We aim to reply within 48 hours.