PRIVACY POLICY
Effective August 17, 2026 · Last updated August 23, 2026
See also: Terms of Service
This policy covers mechaduel.com, play.mechaduel.com, and the
downloadable MECHADUEL game, operated by MECHADUEL
(“we”, “us”). It describes what the service
actually does — nothing here is aspirational.
Plain answers first: we collect the minimum needed to run an
online game, we sell nothing, we show no ads, and we use no tracking or
analytics scripts. There are currently no purchases anywhere on the
service, so we never see payment information of any kind.
What we collect, and why
- Accounts. Your email address, a display name you
choose, and a hashed password (we cannot read the password itself). The
email verifies your account, resets your password, and lets us answer
support requests and bug reports you send us. It is never shown
to other players, and your display name is never derived from it.
- Newsletter. Off by default. If you opt in, we record
when you did, and we may send occasional news about the game to your
address. Opting out on your profile takes effect immediately.
- Guest play. A random identifier stored in your game
settings on your device — no email, no personal name; the display name is
generated.
- Gameplay records. Match results, ratings, decks
saved to your account, and the decision log of online matches, used to
replay games, settle disputes, and investigate bugs.
- Chat. Messages you send in a match are delivered to
your opponent and retained for 30 days for moderation,
then deleted automatically. A match where nobody speaks stores no chat at
all. Guest accounts cannot send chat.
- IP addresses. Held in two narrow places: the most
recent address that attempted to sign in to an account (to protect
sign-in against abuse and to let us lift lockouts for the right person),
and inside enforcement records when an account is banned. Short-lived,
memory-only counters also rate-limit account creation and the emails the
service sends (verification, password resets); they never touch disk and
expire within an hour. We keep no browsing or connection history.
- Bug reports. If you press the report button, we
receive what you typed, technical game-state data, and optionally a
screenshot, delivered to our support inbox. If you are signed in with an
email account, the report includes your account email so we can reply to
you; offline and guest reports carry no email and cannot be replied
to.
- Age. Creating an account requires confirming you are
16 or older. We do not collect your birthdate.
What we do not do
- No advertising, ad networks, or sale or sharing of personal data —
with anyone, for anything.
- No analytics or tracking scripts on the website or in the game.
- No cookies beyond what sign-in strictly requires: your session token
lives in your browser’s local storage and identifies your account
only.
- No payment data — there is nothing to buy.
- We never derive public information (display names) from private
information (email addresses).
Where data lives
On servers we rent in the United States (Ashburn,
Virginia) from our hosting provider, Hetzner, with automatic
nightly backups that rotate. Verification, password-reset, and support
email is sent through our mail provider. These providers process data on
our behalf; nobody else does.
How long we keep things
| Data | Kept |
|---|
| Chat messages | 30 days, then deleted automatically |
| Sign-in lockout records | Cleared on successful sign-in, or expire on their own |
| Last sign-in IP per account | Overwritten by each new attempt |
| Match records and ratings | While the service operates |
| Ban records (name, email, IP at the time of the ban) | Indefinitely — they are enforcement evidence |
| Backups | Rotated automatically |
Your choices and rights
- See or correct your data: write to
support@mechaduel.com.
- Delete your account: write to support@mechaduel.com
and we will delete the account and everything it owns. Two honest
exceptions: ban records are retained (deletion must not undo
enforcement), and recently deleted data can persist briefly in backups
until they rotate out.
- Newsletter: toggle it off on your profile at any
time — no confirmation step, no delay.
- If you are in the EU or UK, these are the mechanisms for your GDPR
rights (access, rectification, erasure, objection). The legal bases we
rely on: performance of contract (running the game you asked to play),
legitimate interest (security and moderation), and consent (the
newsletter only). Because the service requires users to be 16 or older,
we do not process children’s data knowingly in any
jurisdiction.
Children
MECHADUEL is not directed at children, and users under 16 are not
permitted. If you believe someone under 16 has made an account, contact
support@mechaduel.com and we will delete it.
Changes
If this policy changes materially, we will say so on mechaduel.com and
update the effective date. We will never quietly start collecting more than
this page says — a change in what we collect is a change to this document
first.
Contact
support@mechaduel.com