Privacy Policy
The short version: we store what a gaming account needs to function, and nothing else. No ad networks, no tracking pixels, no analytics scripts, no selling your data — not because a regulation made us say that, but because we genuinely cannot be bothered. Your data's most exciting journey is into a leaderboard.
1. What we collect
| Thing | Why |
|---|---|
| Username, email, password | It's an account. The password is hashed (bcrypt) — we couldn't read it if we wanted to, and we don't want to. |
| Date of birth | Gates 18+ chip play. Used for one boolean question: "adult or not". We're not planning your birthday party. |
| Game results & scores | Your records, the leaderboards, team standings. This is the product. |
| Chip ledger | Every chip movement, so balances can't silently go wrong and disputes have receipts. |
| IP address | Rate-limiting sign-in attempts and API abuse (rolling windows), plus we store your registration IP and most recent login IP for fraud and ban-evasion prevention. Visible only to admins, never public, deleted with your account. |
| A session cookie | HLGSESSID keeps you signed in. That's the whole cookie story — no third-party cookies, no "partners". |
2. What's public
Your username, avatar color, team, and game records (scores, wins, results history) appear on public profiles, leaderboards and standings — that's the competitive part of a competitive platform. Your email, birth date, chip balance and wallet history are never public.
3. Third-party games you authorize
If you connect a third-party game, it gets exactly the scopes you approve on the consent screen — identity, records, wallet balance, or chip spend — and nothing more. Tokens expire after 30 days. What a developer does with data you share with their game is on them and their privacy policy; if one behaves badly, tell us and we'll cut their access plumbing.
4. Third-party services we use
- Google Fonts & cdnjs — your browser fetches fonts and game libraries from their CDNs, which see standard request data (IP, user agent). That's how CDNs work.
- PayPal — only if real-money deposits are ever enabled. Payment details would go to PayPal, not us; we'd store the order reference and how many chips you bought.
That's the complete list. If it ever grows, this page grows with it.
5. How long we keep it
As long as your account exists. Rate-limit buckets expire in minutes; expired API tokens are dead on arrival; game rooms self-delete after 24 hours.
6. Deleting your account
Ask, and it's gone: account, email, birth date, wallet, the lot. Leaderboard rows go with it. We don't do the "deactivated but secretly retained forever" thing.
7. Security
HTTPS everywhere, hashed passwords, hashed API tokens, parameterized queries, and a healthy fear of our own audit notes. No system is unhackable; if we ever have a breach that affects you, we'll tell you plainly instead of hiding it in a press release.
8. Children
Under 13? No account. 13–17? Full free play, zero chip features, and we'd still recommend beating adults at mahjong, which is legal and satisfying.
9. Changes
If this policy changes materially, we'll say so on the site — not bury it in an email titled "An update to our terms" that nobody has ever opened in human history.
Questions or deletion requests: reach the operator through HaoLabs. See also the Terms of Service.