Privacy policy

1. Owner and contact

NARDIKA is operated by Kostyantyn Murashkin, Ukraine. For questions about personal data, access, correction or deletion, contact m2359k@gmail.com.

2. Data we process

Account records contain your email, chosen player name, built-in avatar or resized photo, creation date, email verification status, game coin balance and transaction ledger. Passwords are stored as cryptographic hashes with a random salt, never as the original password.

Uploaded photos are cropped to 128×128 and converted to WebP without EXIF or other original metadata. Only the current thumbnail, up to 24 KB, is stored; the original file is not retained. The thumbnail has a public URL which contains no email. Uploading a replacement overwrites the current thumbnail; choosing a built-in avatar removes it from the working record. Older private backups may contain a previous thumbnail.

Guest games receive random invitation and seat-access identifiers. The server stores match state, rolls, game events, moves, results, scores and timer data. Linking a game to an account stores the association between that account and its seat.

Connections process IP addresses and HTTP/WebSocket technical information needed to deliver data, rate-limit requests and protect the service. Support requests contain the information you provide.

Overall service statistics use random browser and visit identifiers, page paths without parameters or secret links, device category, approximate country, referring domain and short cleaned campaign tags. Visit tables store hashes of identifiers, not full IP addresses, full User-Agent strings or full page URLs. Country lookup uses a local DB-IP Lite database without sending the IP to its supplier; VPNs may affect the result.

New registrations record the sign-up method, approximate country and association with a visit when available. Local games may send a de-identified start and finish event for overall statistics; these are not account results and cannot change a balance.

3. Google sign-in

If you choose Google sign-in, NARDIKA receives a Google account identifier, email, email verification status and profile name to create or access your account and connect saved games. You may change your name in your account; the Google profile photo is not saved as your NARDIKA avatar.

Only openid, email and profile permissions are requested. NARDIKA does not request Gmail, Google Drive, contacts or calendar access. Google tokens are processed to verify sign-in and are not retained for ongoing access to other Google services.

Your Google identifier and email are stored in the account database. Your email may be sent to Brevo to deliver requested service messages. Google data is not sold, used for personalised advertising or shared for marketing email campaigns.

4. Why we use data

Data supports sign-in, email confirmation, password resets, profiles, online game history and statistics, validation of game actions, reconnection and protection against abuse.

Registration is optional for computer games, shared-device play and invitation games with friends. Local games are not submitted as account results. Random matchmaking requires a verified account and uses the selected game variant, a universal 20/60 timer, your session and game coin balance.

Private overall statistics help the owner understand visits, registrations and matchmaking. The owner can see the game variant in an active queue and join as a regular opponent. An approximate online counter temporarily records active browsers and game connections. Activity expires after 60 seconds and is not retained as visit history.

5. Providers and hosting

The main game server and database are hosted on an OVHcloud VPS in Canada. Google provides optional sign-in. Brevo sends service messages for email confirmation and password resets, receiving the recipient address and message content with a one-time link.

Providers may process data outside your country under their own terms and policies. They support operation of the service. Public game state and invitations do not include a player’s email, password or Google identifier.

6. Cookies and browser storage

Accounts use a secure HttpOnly session cookie valid for up to 30 days. Google sign-in uses a temporary request-validation cookie for up to 10 minutes. Public site connections use HTTPS.

Guest access, invitations and pending commands are saved in browser sessionStorage. Theme, sound, move-hint, animation and language preferences are saved in localStorage until changed or cleared. Clearing storage may remove a guest’s access to their game seat.

The game and information pages do not load advertising pixels or third-party analytics services. Google pages and email services also apply their own settings and policies.

First-party analytics use signed HttpOnly cookies with a random browser identifier for up to 90 days and a visit identifier that expires after 30 minutes without a new page view. Do Not Track and Global Privacy Control disable page-view and local-game analytics. Necessary game records, authentication and temporary activity of connected accounts continue to support the service.

7. Retention and protection

Account data is retained until a deletion request is processed. Game history and events have no automatic deletion period so games can be restored and checked.

Sessions last up to 30 days, email confirmation links up to 24 hours and password reset links up to 30 minutes. Expired records are periodically cleared. A consumed one-time link cannot change a password or verify an email again.

Detailed page views, visits and local-game messages are automatically cleared after 90 days. Confirmed online game summaries and registration records remain with necessary game history. Overall statistics do not show email addresses, passwords or access tokens.

Protection includes access controls, hashed passwords and tokens, command validation and private backups. Deleting a working record does not immediately remove it from all previous backups. Archived backups are used for recovery; deletion requests must be respected if data is restored.

8. Managing your data

You can change your name and avatar, change your password and sign out on all devices from your account. Request a copy, correction or deletion at m2359k@gmail.com. We must verify that you control the account; do not send your password.

Deleting or unlinking an account does not necessarily require deletion of de-identified game events concerning both players. We will clarify what can be retained and removed. An automatic account deletion button is not yet available.

You can revoke Google permission in your Google account settings. This prevents further Google sign-in but does not itself delete your NARDIKA profile. Contact the operator to request profile deletion.

9. Policy changes

The current version is published on this page with its revision date. Material changes to processing purposes require updated information for users.