Privacy policy
Tahúr: A Blackjack Adventure · by Wasi Mahin · effective 13 October 2026
The short version: the game is built to collect as little as possible. No ads, no tracking, no cookies, no third-party analytics. You can play without an account. If you make one, it isn't tied to your name, and you can download or delete everything in one tap.
Who's responsible
Wasi Mahin ("I", "me") makes Tahúr and is responsible for the data described here (the "controller" under the GDPR). Contact: support@tahurgame.com
What stays on your device
Your progress, settings and save codes are stored on your device: browser storage on the web, app storage on phones and computers. They don't leave it unless you turn on cloud save, play online or send feedback. The game also keeps three small notes for the anonymous counts below (the day you first opened it, the last day it counted you, and which milestones it has already counted) and, if you have an account, its device key. These are needed for the game to work or are covered below; there are no cookies.
What the game sends, and why
| Data | Why | Kept |
|---|---|---|
| Account (only if you turn on cloud save or play online): a random account id, and for each signed-in device a key (stored only as a one-way hash), a label such as "Chrome · macOS", and when it was added and last used | To recognise your devices, so you can sync and see or sign out devices | Until you delete the account or sign the device out |
| Email sign-in (optional): a keyed, one-way hash of your email address, never the address itself. The address is used once per code to send it. | So you can sign in on any device with a code | Until you remove it or delete the account. Codes expire in 10 minutes. |
| Passkeys (optional): the passkey's public key and id. The private key stays on your device or in your password manager. | Sign-in with Face ID, a fingerprint, a phone or a security key | Until you remove it or delete the account |
| Cloud save: your game save (the name you chose in the game, your look, progress and collection) and a few earlier copies | Playing the same save on several devices; undoing a bad overwrite | Until you delete the account. Earlier copies: the last five. |
| Online play: your rating, win/loss record and, if you play ranked, your in-game name on the leaderboard; results of online matches | Matchmaking, fair pairing and the leaderboard | Until you delete the account (match records stay without your id) |
| During a duel: your in-game name, look, level and powerups | Shown to your opponent | Only for the length of the match |
| Anonymous play counts: that the game was played today; milestones such as "won a first match", each counted once; matches, drafts, mystery boxes opened and minutes played; with the game version, kind of device and the day you first opened the game | Knowing whether the game works for people and what to fix | Daily totals only, up to 25 months |
| Crash reports: the error, where in the code it happened, the game version, and browser name and major version with operating system | Finding and fixing bugs | 180 days after the error was last seen |
| Feedback you send, in the game or on the website: what you write, its kind (bug, idea, feedback), an email if you give one (only used to reply), and, if you leave the box ticked in the game, game info (version, screen and browser details, a progress summary including your in-game name, settings, recent errors) | Reading and answering you; fixing what you report | 12 months |
| Platform waitlist (optional, on the website): your email, the platforms you picked and when you agreed | Sending you one email when Tahúr arrives on those platforms | Until you leave the list (a link in every email) or until that email is sent; unconfirmed sign-ups after 7 days |
Anonymous counts and crash reports carry no account id, device id, cookie or IP address and can't be linked to you or your account. You can switch them off at any time in Settings → Feedback & privacy; if your browser sends a Global Privacy Control signal, they start switched off.
Who else handles data
- Cloudflare hosts the website, the game and its servers, and processes standard request data (such as IP addresses) to deliver and protect them, under its privacy policy and its data processing terms, which include the EU's standard contractual clauses for transfers outside the EU. I don't store IP addresses; to stop abuse, the server counts requests per IP address for a minute at a time, in memory only. Cloudflare Web Analytics counts visits to this website and the game's pages (pages viewed, country, referring site, page speed) without cookies and without identifying visitors (how it works).
- Resend sends sign-in codes and waitlist confirmations, if those are switched on: it receives the address and the email's text to deliver it (privacy policy).
- App stores: in the app versions, optional purchases are handled entirely by Google Play, the App Store or Steam. Nothing is sold in the browser version.
Nothing is sold, and nothing is shared for advertising.
Why I'm allowed to (EU and UK)
Cloud save, sign-in and online play are part of the service you ask for (contract). Anonymous counts, crash reports, security measures and the leaderboard rest on my legitimate interest in keeping the game working, fair and safe, balanced by keeping them minimal, anonymous where possible, and easy to switch off. Feedback and the waitlist are sent only when you choose to, and you can withdraw at any time (consent).
Keeping it safe
Everything travels encrypted (HTTPS, with HSTS). The database is encrypted by Cloudflare, and on top of that, cloud saves, feedback and waitlist emails are encrypted with a separate key that is never stored in the database. Device keys and sign-in emails are stored only as one-way hashes, and passkeys only as public keys, so a copy of the database wouldn't reveal them. Access to the servers is limited to me, with two-factor sign-in. If a breach ever puts your data at risk, I'll tell the regulator within 72 hours where required, and tell you in the game and by email if I have it.
Children
Tahúr is for players aged 13 and over and isn't directed at children. The online features don't ask for personal information. If you believe a child under 13 has given me personal information, email me and I'll delete it.
Your rights, and how to use them
- See and download: Settings → Account → Download my data gives you everything the server holds about your account, as a file.
- Delete: Settings → Account → Delete account removes your account, cloud saves, sign-in methods and devices straight away. Without the game, use tahurgame.com/delete-account with your recovery code, or email me. Progress stored on your own device stays until you reset it or clear the site's data.
- Correct, object, restrict, withdraw consent: change your in-game name in the game, switch stats off in Settings, leave the waitlist from any of its emails, or email me.
- Complain: you can contact your data protection authority. I'd rather fix it first, so please email me.
I answer requests within 30 days.
Changes
If this policy changes, the new version will be posted here with a new date, and important changes will be announced in the game.