Privacy policy
Last updated:
This policy explains what personal data reversi.site processes, why we process it, how long we keep it and what rights you have.
In short
- You can play without an account and without telling us who you are.
- Our server does not write IP addresses to its logs. We count page views only as daily totals.
- We set one cookie of our own: it remembers your cookie choices.
- Google Analytics runs only if you allow it. Your game stats are saved on your device only if you allow it, and they are never sent to us.
- If you write to us, we use your message only to reply.
- We don't show ads, and we never sell data.
Who is responsible for your data
reversi.site is run by Opak Oy (business ID 2950233-8), a company registered in Finland. Opak Oy is the controller of the personal data described in this policy.
Postal address: Opak Oy, Kivikastintie 24, 65300 Vaasa, Finland
You can send privacy questions and requests with our contact form or by post. We have not appointed a data protection officer, because the law does not require one for a service like this.
What we process and why
We have no user accounts, and you never need to give us your name to play. This section lists everything we process, grouped by what you do on the site.
When you visit the site
When you open a page, your browser sends a request to our server. Like every request on the internet, it includes your IP address, the address of the page, your browser type (the user agent) and usually the page that linked to us (the referrer). We need these details to send the page back to you.
- Hosting. Our server runs at Fly.io in Amsterdam, the Netherlands. Fly.io's network receives your request at the Fly.io location nearest to you and passes it on to our server.
- No IP addresses in our logs. Our server uses the request details only to deliver the page and to protect the service. It does not write IP addresses or browser details to its logs. To stop abuse, for example to limit how many requests one address can send, it keeps a scrambled key made from the IP address in memory for at most 15 minutes. The address itself is not kept.
- Daily page view totals. When our server delivers a page, it adds one to that day's totals: which page, whether the device is a phone or a computer, and whether the visit came from a search engine, social media, another site or directly. The device type and the source are worked out from the browser type and the referrer while the page is sent; neither is stored. The totals contain no IP addresses, cookies or other identifiers, and they can't be linked to you.
- Technical logs. Our application logs contain technical events and errors only, without IP addresses or other identifiers. They are kept in Fly.io's log service for 7 days.
Legal basis: our legitimate interests in running a working and secure website and in knowing how much it is used (Article 6(1)(f) GDPR).
When you play online
The online connection opens only when you choose Online or open an invite link. Games against the computer and two-player games on one device run entirely in your browser, and their moves are not sent to us.
- Connection. Your browser opens a connection to our server. Like any request, it uses your IP address. We don't log it.
- Moves. Your moves go through our server, which checks them and sends them to your opponent. Games and private rooms exist only in the server's memory, and they are deleted when they are no longer needed: a finished game after at most 10 minutes (so that a page reload still shows the result) and an unused private room after at most 30 minutes. We don't keep game records on the server.
- Reconnecting. So that you can continue after a page reload, your browser keeps a random session ID in its session storage. It is deleted when you close the tab.
- Nickname (optional). If you choose a nickname, it is shown only to your opponent in the current game. Our server keeps it only in memory while your game or private room exists and never writes it to disk or to logs. Your browser remembers it for next time as one of your settings. Please don't use your real name.
- Reactions. You can send one of six preset reactions, which our server passes to your opponent. There is no free-text chat.
- Private rooms. If you create a private room, our server makes a room code and an invite link. The first person who opens the link joins your room, so share it only with the person you want to play.
- Daily totals. We count online activity, such as searches and finished games, as daily totals without identifiers.
Online matchmaking pairs you with another player who is searching at the same time. If no other player is available, you are matched with our computer opponent instead, and the game tells you so before it starts.
Legal basis: our legitimate interest in providing the online game you asked for (Article 6(1)(f) GDPR).
Settings and stats on your device
Some features save data in your browser's storage. This data stays on your device, and we can't see it. The only exception is the online session ID, which your browser sends to our server to reconnect you to your game.
- Necessary (always on): the settings you choose yourself, such as theme, sound, move confirmation, board style, your last game mode and level, and your online nickname if you set one; an unfinished game, so that you can continue after a reload; and the online session ID. Settings are saved only when you change them. Your cookie choices are saved in a cookie, described under Cookies and storage on your device.
- Stats on this device (only if you allow it): your game statistics, streaks, rating, achievements, daily challenge history and the level of the computer opponent in online matchmaking. If you don't allow it, this data is kept only until you leave the page.
You can delete your stats at any time with Reset my data, or by turning off Stats on this device in Cookie settings. Clearing your browser's data for reversi.site deletes all of it.
Legal basis: storing what is strictly necessary for a service you asked for, such as your own settings, does not need consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014). For Stats on this device we ask for your consent (section 205 of the same Act and Article 6(1)(a) GDPR).
Analytics (only if you allow it)
If you allow Analytics in the cookie banner or in Cookie settings, we do three things:
- we load Google Analytics 4,
- your browser sends a few game events, such as “computer game finished”, to our own server, which adds them to anonymous daily totals, and
- your browser tells our server when a script error happens on a page. We only count these error reports. No details about you or your device are stored.
Google Analytics collects information such as the pages you view, how long you stay, the site that referred you, your device and browser type, and your approximate location (for example country and city). Google Analytics 4 does not log or store IP addresses: for visitors in the EU, Google uses the IP address only to work out the approximate location and then discards it. Google Analytics sets two cookies, _ga and _ga_, which tell visits from different browsers apart. We set them to expire after 13 months.
We have turned off Google signals and ads personalization, and our Google Analytics account is not linked to any advertising service. We use Google Analytics only for statistics; it doesn't tell us who you are. Detailed event data is deleted from Google Analytics after 2 months.
Google Analytics is provided by Google Ireland Limited. Google LLC in the USA processes the data as its sub-processor (see Transfers outside the EU/EEA). Learn more: How Google uses information from sites or apps that use our services.
Legal basis: your consent (Article 6(1)(a) GDPR and section 205 of the Finnish Act on Electronic Communications Services). Analytics is off until you turn it on. You can withdraw your consent at any time in Cookie settings, linked at the bottom of every page. We then delete the Google Analytics cookies and stop sending game events and error counts. If Google Analytics was already running on the page, the page reloads so that Google Analytics is no longer loaded. If you are in the middle of a game, the game is not interrupted, and Google Analytics stops completely the next time a page loads. Withdrawing consent does not affect processing that took place before it.
When you contact us
When you send a message with the contact form, your browser sends your name (optional), your email address and your message to EmailJS, which delivers them to our mailbox. EmailJS also receives the technical details of the request, such as your IP address. Nothing is sent to EmailJS until you send the form.
We need your email address to reply; your name is optional. We use your message only to answer you and to handle your request. If you write to us by post, we use your letter in the same way.
Legal basis: our legitimate interest in answering messages (Article 6(1)(f) GDPR). When you use your data protection rights, we handle your request and keep a record of it because the law requires us to (Article 6(1)(c) GDPR).
Who receives your data
We don't sell or rent personal data, and we don't share it with advertisers. These service providers process data for us, only on our instructions and under data processing agreements:
- Fly.io, Inc. (USA) hosts our server, which runs in Amsterdam, the Netherlands.
- Google Ireland Limited (Ireland) provides Google Analytics, only if you allow it. Its sub-processor Google LLC is in the USA.
- EmailJS Pte. Ltd. (Singapore) delivers contact form messages. Its servers are in the USA (Amazon Web Services).
- Our email provider stores our mailbox.
In online games your opponent sees your moves, your nickname if you choose one, and your reactions. We disclose personal data to authorities only when the law requires it.
Transfers outside the EU/EEA
Some of our service providers are based in the USA or use servers there. We use them only with the safeguards that the GDPR requires:
- Fly.io, Inc. and Google LLC participate in the EU–US Data Privacy Framework. The European Commission has decided that the framework ensures an adequate level of protection for personal data transferred to participating companies (adequacy decision of July 10, 2023). Google also uses the European Commission's Standard Contractual Clauses.
- EmailJS transfers data to its servers in the USA under the European Commission's Standard Contractual Clauses.
- If our email provider processes data outside the EU/EEA, it does so under an adequacy decision or the Standard Contractual Clauses.
Contact us if you would like more information about these safeguards or a copy of them.
How long we keep data
| Data | How long |
|---|---|
| Your IP address and other request details | Only while your request or connection is being handled. A scrambled key for abuse limits stays in memory for at most 15 minutes. Nothing is written to disk or logs. |
| Our technical logs (no IP addresses or other identifiers) | 7 days |
| Fly.io's own technical records of its network | Decided by Fly.io for running and protecting its network |
| Online games, private rooms and nicknames | Only in our server's memory while needed: a finished game at most 10 minutes, an unused private room at most 30 minutes. Reactions are passed on and not kept. |
| Daily totals (page views, games, events, errors, cookie choices) | Indefinitely. They are anonymous and contain no personal data. |
Your cookie choices (rv_consent) | 12 months |
| Settings and stats on your device | Until you delete them or clear your browser's data. Session data until you close the tab. |
| Google Analytics cookies | 13 months |
| Google Analytics event data | 2 months (aggregated reports are kept longer) |
| Contact messages at EmailJS | Up to 30 days |
| Contact messages in our mailbox | Up to 12 months after the conversation ends |
| Data protection requests and our replies | 3 years after the request is closed |
Some browsers, such as Safari, delete cookies set by a script after 7 days, so cookies may disappear sooner than listed here.
Your rights
Under the GDPR you have the right to:
- get access to the personal data we hold about you (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- have the processing of your data restricted (Article 18);
- receive data you gave us based on your consent in a portable format (Article 20);
- withdraw your consent at any time in Cookie settings (Article 7(3)).
Right to object: you can object at any time, on grounds relating to your particular situation, to processing that is based on our legitimate interests – delivering the site, running online games and answering messages (Article 21 GDPR).
Because we don't store IP addresses or other identifiers, we usually can't find any data about you in our systems, apart from messages you have sent us. If that is the case, we will tell you (Article 11 GDPR). Data saved on your device is under your own control, and you can delete it at any time.
To use your rights, contact us with the contact form or by post. We reply within one month, free of charge. We may ask for information to confirm that a request comes from you.
Right to lodge a complaint
If you think we process your personal data unlawfully, you can lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):
- Website: tietosuoja.fi/en
- Postal address: PO Box 800, 00531 Helsinki, Finland
- Email: tietosuoja@om.fi
You can also complain to the data protection authority in the EU or EEA country where you live or work. We would appreciate the chance to fix the problem first, so please contact us too.
Children
reversi.site is suitable for players of all ages, and you can play without giving us any personal data. If you are under 13, please ask a parent or guardian before you allow Analytics or Stats on this device, choose a nickname for online games or send us a message.
In Finland, where we are based, children can give their own consent to online services from the age of 13. Some other countries use a higher age limit, up to 16. If you think a child has sent us personal data without permission, contact us and we will delete it.
Automated decisions
We don't make decisions about you based solely on automated processing, and we don't build profiles of you. The level of the computer opponent in online matchmaking goes up or down with your results. This happens only on your device, and it only affects the game.
Security
reversi.site is served only over an encrypted HTTPS connection, and our pages use a strict security policy that blocks scripts from unknown sources. We collect as little data as we can, and access to our server, statistics and mailbox is limited to the people who run reversi.site.
Changes to this policy
We update this policy whenever the way we process data changes. The date at the top shows when it was last updated, and important changes are listed below. If a change affects something you have consented to, we will ask for your consent again.
- : Rewritten for the new version of reversi.site. Our server no longer logs IP addresses, page views are counted on the server as daily totals, the online connection opens only when you choose Online, and you can choose whether to keep stats on your device.