Who is responsible for your data

Tichu is operated by Urs Bunker, An der Aare 14, 3000 Bern, Switzerland (see the Legal Disclosure for the full operator details). For the purposes of this policy, the operator is the "controller" of your personal data. You can reach us at tichusupport@gmail.com for anything in this policy, including to exercise any of the rights described below.

This policy is written against the Swiss Federal Act on Data Protection (FADP), which applies because the operator is based in Switzerland. Because players from the EU are an expected part of this game's audience, we have also written it with the EU General Data Protection Regulation (GDPR) in mind. We have not appointed a separate EU representative under GDPR Article 27; this is a known open item, not an oversight — see the note at the end of this page.

What we collect

Account information

When you create an account: your chosen username (the only name other players see; older accounts may also hold a display name), your email address, and, if you sign in with Google, the identity information Google provides to confirm who you are (we do not receive or store your Google password). If you choose a password for this site, we store only a salted, one-way hash of it, never the password itself; we cannot read it back. If you add a country or an avatar, we store those too.

Gameplay and ranking data

The tables you create or join, your seat and team, your match results, your rating and its history, and whether a special card (Tichu, Grand Tichu) was called and succeeded. This history is what powers your profile, match replays, and the public leaderboard.

Security and anti-collusion data

Your IP address is the network address your device uses to reach our server. We store it, and in ranked play a device fingerprint as well, to keep the site secure and to detect accounts that may be colluding (for example, the same person playing both sides of a match). It is a security signal, not a profile field: other players never see it, and staff look at the ranked-play records only when a join looks unusual. We do not use it for advertising or any purpose unrelated to the security and integrity of the game. These are the places in our database where it is stored:

• Sign-in. The address you signed in from is stored with that sign-in session, next to your browser's user-agent text (which names the browser and the operating system).
• Emailed links. When a message with a one-time link is requested (confirming an account, choosing a password, changing an email address, or a staff verification), the address the request came from is stored with that link.
• Staff verification. When a moderator or administrator confirms their identity again for a sensitive action, the address is stored with that record.
• Seats and matches. When you take a seat at a table, ranked or casual, the address is stored with the seat. When a match starts, it is copied into that match's record.
• Ranked play. When you join a ranked table we also keep, for the anti-collusion check: a connection history for your account (each address and device fingerprint we saw you use, and when you last used it); the network you most recently joined from (the address shortened to its network prefix) with the device fingerprint; and, when two players seated together share a network or a device, a note for staff review that names the two accounts and records the joining player's address or device fingerprint.

Moderation data

If you report another player or a table, or if a restriction (such as a mute or ban) is ever applied to your account, we keep a record of that — including, where relevant, an appeal you file and its outcome.

Chat

Table and lobby chat messages are delivered live between players. We do not store the text of chat messages in our database, our logs, or our backups — only that a message was sent, for rate-limiting and delivery-confirmation purposes, not its content.

Account emails

When you create an account, ask for a new password, or change your email address, we send your email address and a one-time link to Resend so it can deliver the message. The link works once, and expires after 2 hours for a new account or 1 hour for a password or email change. We also email you when your password or email address is changed. Resend also handles the message content and delivery records needed to send these.

Cookies

We use exactly two cookies, both strictly necessary for the site to work: one keeps you signed in (tichu_session; it ends when you close your browser, or after 30 days if you tick “Keep me signed in”), and one carries you through the few minutes of finishing a new Google sign-up (tichu_pending_signup). Both are deleted when you sign out or expire on their own; neither is used for tracking, analytics, or advertising. We do not currently use any analytics or advertising cookies or tools, and we will update this section if that ever changes.

Why we process your data

• To create and run your account, and to let you find, join, and play at tables.
• To calculate and display ranked results, ratings, and the leaderboard.
• To detect and prevent cheating, collusion, and abuse in ranked play.
• To review reports, enforce our conduct rules, and handle appeals.
• To respond when you contact us.
• To meet legal obligations we may be subject to.

Where GDPR applies, we rely on performing our contract with you (running the account and game you signed up for), our legitimate interest in keeping ranked play fair and the service secure, and, where applicable, legal obligations.

Who we share it with

We do not sell your data, and we do not use it for third-party advertising. These services receive data to run the site and its sign-in options:

• DigitalOcean — hosts the server and database this site runs on, in the Netherlands.
• Google — verifies your identity if you sign in with Google (Google Identity Services). Google processes this under its own privacy policy, and may process it outside Switzerland or the EU/EEA, including in the United States.
• Resend — delivers account emails (confirming a new account, choosing a password, changing your email address). We send it your email address and the message containing your one-time link. Resend stores customer data, including message content and delivery logs, in the United States. See Resend's data-handling information and subprocessor list.

International transfers

Our server is in the Netherlands (within the EU/EEA). Google may process sign-in data outside Switzerland or the EU/EEA, including in the United States, under its own safeguards. Resend stores email addresses, sign-in messages and delivery logs in the United States. Its Ireland sending region controls where email is sent from, not where this data is stored. Resend's Data Processing Addendum includes standard contractual clauses for transfers from the EU/EEA and Switzerland.

How long we keep it

We keep match history, ratings, and the audit trail of staff actions indefinitely — this is the game's historical record, and it is also what makes the leaderboard and match replays meaningful for every player involved, not just you.

Network addresses and device fingerprints are different. An automatic job that runs once a day erases each one once it is more than 90 days old:

• Sign-in sessions, staff verification records and match records: the address is erased and the record stays (a sign-in session keeps its browser text, and match history is kept as described above, without the address). The 90 days run from the sign-in, the verification, or the start of the match.
• Emailed-link requests: the whole request record is deleted once it is more than 90 days old. The links themselves stop working after at most two hours.
• Seats: the address is erased within a day after you leave the seat, and in any case 90 days after you took it.
• Ranked-play connection history: an entry is deleted 90 days after the last time you used that address and device; using it again starts its 90 days over. The record of the network you most recently joined from is deleted 90 days after your latest ranked join.
• Notes for staff review: the address and the device fingerprint in a note are erased 90 days after the note was made. The note that two accounts shared a network or a device stays.

This describes our database. We keep a daily backup of the database for 14 days, so an address that has been erased can remain in a backup for up to 14 days longer. The counters that limit repeated sign-in attempts per address are not kept in the database and expire by themselves within an hour.

Resend states that it keeps email content and delivery logs for 30 days on its Free, Pro and Scale plans, and that backups persist for seven days. See its retention information for details.

Download your data and delete your account

Download a copy of your data

Open your profile, scroll to the very end of the page and follow the small link “Your data and account”. On the page it opens, press Download. You get one JSON file with your own data: your account details (username, email address, country and picture if you set them, the language of your emails, when you joined and how you sign in), every match you played with your seat, team and rating change, your rating and its history, the reports you filed, the restrictions applied to your account and the review requests you filed (without the staff's notes and reasons), and the players you muted. The file also lists what it leaves out and why: the IP addresses and device details we record to detect cheating (including the address recorded when a match started), staff notes and the staff's reasons for review decisions, reports other players filed about you, who muted you, your password, Google's identifier for your account, and information about the other players in your games. You can download it once an hour.

Delete your account

On the same page, under “Delete your account”, type your username and confirm with your password. If you have no password (for example because you sign in with Google), we email a confirmation link to your address and you confirm on the page it opens, while signed in. Deleting takes effect at once and cannot be undone. You cannot delete your account while you are in a live match (finish or leave it first); a seat you hold at a table that has not started is given up for you.

What is removed: your account is renamed to a placeholder such as JaneDoe_K7M2QX (JaneDoe_ and six random characters), and your email address, picture, country, email-language setting (reset to the default), password hash, Google link, sign-in sessions and any unused email links are removed. The personal mutes you set are deleted, and your old username is replaced in the vote log of a waiting table. You are signed out everywhere. Nothing we keep maps the placeholder back to your old name. Your old username and email address become free again: anyone, including you, can register with them, and a new account starts with no history.

What stays: we do not erase the account row itself, because other players' own match history, replays and ratings depend on it. Your completed matches, replays and ratings therefore remain visible to other players under the placeholder name, and moderation records (reports you filed or that were filed about you, restrictions, review requests and the audit trail of staff actions) are kept as described under “How long we keep it”. Deleting your account clears the address of your sign-in sessions and of a seat you hold and removes your emailed-link requests; the other IP addresses and device fingerprints described under “Security and anti-collusion data” are not removed when you delete your account. They stay for the same anti-cheating purpose until the 90 days given under “How long we keep it” are over. Text that you or our staff wrote in a free-form field, such as the description of a report or a staff note, is kept as written and could contain your name. Players who played with you may still recognise your games under the placeholder. Chat messages are not stored, but a message already shown in another player's open window stays there until they reload.

If you cannot sign in, or something here does not work for you, email tichusupport@gmail.com.

Your rights

Subject to applicable law, you can ask us to:

• Tell you what personal data we hold about you (see “Download your data” above).
• Correct inaccurate data.
• Delete your account (see above).
• Object to, or ask us to restrict, certain processing.

Email tichusupport@gmail.com for any of these, or for anything the download and delete buttons do not cover. If you are not satisfied with our response, you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or, if you are in the EU, your own country's data protection authority.

Security

Connections to this site are encrypted (HTTPS), and your session is protected by a signed, browser-only cookie. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Changes to this policy

We will update this page if what we collect or how we use it changes — for example, if we ever add analytics or a payment feature. Check back here if you want to know what has changed; the date at the top reflects the last update.