Privacy Policy

Overview

Traingame is an online multiplayer train-route board game and is the controller of information processed on Traingame's own servers. This policy explains what we collect, why we use it, how long we keep it, and how you can access or delete it.

Information We Collect

Account information includes your email address, username, password hash, verification status, account preferences, and authentication-provider links. If you use Google sign-in, we receive the Google account identifier, email address, email-verification status, display name, and profile image provided for the openid, email, and profile scopes. We do not request Gmail, Drive, Contacts, Calendar, or other Google account content.

Gameplay information includes guest handles, match participation, match configuration, moves, scores, replay history, friend requests, game invites, and notification state. Anonymous visitors receive a temporary guest identity. Match and replay data is saved on Traingame's servers; if that guest later creates an account, the previous guest matches are added to the account's history. Chat is not stored in persisted replay records.

Support information includes problem reports you submit, the category and text of the report, the current page URL, the related match id when present, and whether the report came from a signed-in account or guest session.

Technical information may include signed session cookies, IP address, browser and device details, referring pages, and a limited set of anonymous first-party usage events such as page views, tutorial progress, game starts and results, matchmaking waits, connection problems, performance measurements such as load times and frame rates, account registration, problem reports, and client errors. Event properties are restricted and do not include free-form gameplay or profile text. Traingame does not run third-party session recording on this build.

Legal Bases

Where applicable law requires a legal basis, we process account and gameplay data to perform our contract with you and provide the service you request; security, limited measurement, debugging, and abuse-prevention data for our legitimate interests in operating a reliable game; and information needed to comply with law. You may withdraw consent or object to legitimate-interest processing by contacting us.

How We Use Information

We use information to:

• create accounts, sign users in, maintain sessions, and prevent unauthorized access;
• verify email addresses or provider sessions and send account messages;
• run matches, matchmaking, replays, chat, friend requests, and game invites;
• show profile, match history, notification, and preference features;
• debug, secure, measure, and improve Traingame;
• review problem reports and respond to support or privacy requests;
• comply with legal, security, and operational obligations.

Usage Analytics

Traingame records anonymous usage events, such as page views, Play Now presses, tutorial progress, game starts and results, queue waits, connection problems, performance measurements such as load times and frame rates, sign-ups and error counts, to learn how the game is used and to fix problems. These events contain no account or guest identifiers, names, email addresses or chat text, and they set no cookie and use no browser storage.

To count visits, the server combines your IP address and browser user agent with a random value that changes every day and keeps only a short one-way hash; it does not store the IP address. Your country comes from the network location. Cloudflare processes these events for us, and they are deleted after about three months. If your browser sends Global Privacy Control or Do Not Track, no events are sent.

Cookies And Similar Technologies

Traingame uses signed session cookies to keep you signed in, preserve guest sessions, and protect account and game state. The app also uses browser storage for preferences and client-side connection state. Traingame does not use advertising or third-party measurement cookies.

Sharing

We do not sell personal information. We disclose information only as needed to provide or secure Traingame, comply with law, or use service providers acting on our behalf.

Service providers include Cloudflare for hosting, storage, account email, and usage analytics, Google for sign-in, and Discord for team notifications. Those providers process information under their own terms and privacy policies or on our behalf under appropriate obligations.

Our team gets notices in a private Discord server when an account is created, when someone presses Play, opens a public game, or is looking for players, and when someone sends a problem report. These notices show a player's public player name and the text of a problem report. They never include email addresses or account IDs.

Some gameplay data is visible to other players in a match, friends, invited players, or people with access to a replay or invite link, depending on the feature and match settings.

Security And Retention

We use technical and organizational safeguards such as HTTPS, signed cookies, hashed passwords, rate limits, access controls, and encrypted secret storage. No online service can guarantee perfect security.

We apply the following active-system retention periods:

• account profiles and account-linked match history remain until the account is deleted;
• temporary guest identifiers in replay data are anonymized after 90 days; the non-identifying gameplay replay may remain available;
• anonymous usage analytics events are deleted after about three months;
• support reports have no fixed deletion period yet; reports linked to an account are deleted with that account;
• expired sign-in sessions and verification tokens are deleted within 30 days after they expire;
• open support or safety records may remain while needed to investigate and resolve the issue or meet a legal obligation.

When you delete an account, shared replays remain for the other participants, but Traingame permanently replaces your player name and identifiers in stored match records with a “Deleted Player” label. Matches still in progress, or not yet recorded, at that moment keep the name you played under. Your profile, sign-in sessions, linked sign-in identities, preferences, social records, and support reports are deleted. Usage analytics are anonymous and are not linked to the account. Backups and security logs may retain limited information for a short period before routine expiry.

Your Choices

You can play with a temporary identity where available and can use the Data & Privacy section of your profile to download a portable JSON copy or permanently delete the Traingame data linked to your account. Deleting a Traingame account does not delete an external Google account.

You may also request access, correction, deletion, restriction, or an objection by contacting us at privacy@traingame.io. We may need to verify your identity before acting. Depending on where you live, you may also have a right to data portability or to complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

Children

Traingame is not directed to children under 13. Do not use Traingame if you are under 13. If you believe a child provided personal information, contact us so we can review and delete it when appropriate.

Changes

We may update this policy as Traingame changes. When we make material changes, we will update the date above and, when appropriate, provide additional notice in the app or by email.