Privacy policy
Last updated
You can practise Koi-Koi against the computer without an account, and those games stay in your browser. To play online you sign in with Google; the game then keeps a profile with the name, avatar and statistics other players see, the rooms you open while they exist, and an encrypted record of each online match, with the result both players signed, that is set to be deleted after 30 days. There are no ads, no analytics and no tracking code.
This policy covers the Koi-Koi Online game at hanafuda.lemme.dev, in English and Japanese, whether you play in a browser tab or installed as an app, and the guide pages of this site. “We” means whoever runs Koi-Koi Online. The data is used only to run the game: sign-in, matches, profiles and rankings, and keeping scripts and cheats out. This policy describes what the game actually does as of the date below.
Practice without an account
Games against the computer run entirely in your browser: the moves and results are never sent to our servers and do not count towards the rankings. What practice keeps stays on your device: the game settings you chose for it, a count of finished games (which decides when the game suggests installing it as an app) and device settings such as sound, all listed under what is stored on your device.
Opening the game page still contacts Google, even for practice: the game starts Firebase App Check, which runs reCAPTCHA Enterprise. The game and these guide pages also load their fonts from Google Fonts. Both are described under services that receive data.
Signing in with Google
Online play needs a Google account; no other kind of sign-in is accepted. When you sign in, Google shares your account’s basic profile with Firebase Authentication, which keeps an account record for this game: a user id, your email address, your Google name and profile picture link, and when the account was created and last signed in.
The game itself uses only the user id, to tell players apart, and your Google name, once, as the first suggestion for your display name. It never shows your email address or your Google picture to other players, and it asks Google for nothing else: no contacts, no files, no mail. The site operator can see the account record in Firebase’s console and in an administration tool.
Your profile and the rankings
Your first sign-in creates a profile in Firebase’s database (Cloud Firestore). It holds:
- your display name (up to 24 characters), your avatar’s seed and its background colour;
- your online statistics: matches played, wins, losses, points won and your best round;
- when the profile was created, when you were last active and when a match was last added to your statistics.
Other signed-in players’ games can read these profiles, which is how the lobby shows names and avatars and how the rankings list the top ten players by their online wins, losses and points won. Next to your name, everyone sees a four-character tag such as #A34E, worked out from your user id and never stored. Your avatar is drawn in the browser from its seed; the seed is not sent to any avatar service. You can change your name and avatar at any time under Edit profile.
The statistics change only when both players’ games have signed the same result for an online match (see online matches): the database checks that the two agree, and adds each match once. For every match added, your account keeps a marker (the match, your seat, whether you won or lost, and the points and best round it added), and a note of the last match added; only you can read them, and they are kept as long as your profile, so that no match is ever counted twice. With the administration tool, the operator can correct your statistics or display name, and can hide an account from the rankings. The games of signed-in players can see which accounts are hidden, so as to leave them out; the operator’s short note of the reason is kept apart, and no player can read it. A copy of your own profile is also kept on your device, so the game can show it at once and offline.
Your profile and your account record are kept for as long as the account exists. Inactive accounts are not deleted automatically; see deleting your data.
Rooms and online matches
Rooms, join requests and the state of a match pass through Firebase’s Realtime Database, and so do the moves whenever the two browsers are not connected directly (see direct connection). Each move, and everything else the two games send each other during a match, is encrypted end to end before it leaves your browser and signed; the servers relay and store it but cannot read it. The operator can see the records below in Firebase’s console, but not the moves inside them.
| What | Who can read it | How long it is kept |
|---|---|---|
| A roomIts code, the host’s name and avatar, whether it is public or has a password, its settings, the version of the game it was made with and who is seated; also, under the host’s account, which room they host | Any signed-in player who has the code; the two players see everything in it | Until the host closes it (“Close room”) or creates another room, never while a match is being played in it. There is no automatic clean-up of rooms a host never closes. |
| A lobby entry (public rooms)The host’s name and avatar, the number of rounds and the settings | Any signed-in player | While the room waits for a guest and the host is connected |
| A request to joinYour name, avatar and user id and, for a locked room, a check value worked out from the password you typed (never the password itself) | You and the room’s host | Until you withdraw it or the room is closed; the accepted guest’s request is removed when the seat is freed |
| A room passwordAs a check value worked out with scrypt and salted with the room code (never the password itself) | No player; only the security rules use it | Until the room is closed |
| The state of a matchWhether each player is connected and since when (by the server’s clock), the key-exchange messages (public keys only), the encrypted connection details and match status, and who ended the match, when and why (resigned, stayed away, stopped it as disputed, or played it to the end), with an encrypted note only the other player can read | The two players | Until the seat is freed after the match, or the room is closed. When the host frees the seat, how the match ended stays in the room for that guest alone to read, until the next guest is let in or the room is closed. |
| MovesEach one encrypted and signed, with the other player’s encrypted answer; only while the two browsers are not connected directly | The two players | Removed from the Realtime Database once both players have signed it; whatever is left goes when the seat is freed or the room is closed |
| The match recordThe room code, both players’ user ids and public signing keys, the number of rounds, and every move, still encrypted | Only the two players; no player can change or delete it | Set to expire 30 days after it is written; the database then deletes it automatically |
| The result of a matchEach player’s signed statement of how the match ended (the final scores and best rounds, the winner, and how it ended), the same statement encrypted for the other player, or, from a player whose game did not confirm it, a note that it did not, with its one-word reason encrypted for the other player | Only the two players; no player can change or delete it | Set to expire 30 days after it is written; the database then deletes it automatically |
The match record keeps every move with both players’ signatures, and the result both players signed, so that a match can be checked afterwards; the game itself shows only whether the result is confirmed. A match changes the statistics only when both players’ statements are the same (see your profile and the rankings). Your device keeps what it needs to go on with a match after a reload or a relaunch, encrypted, as listed under what is stored on your device.
Direct connection
Every online match connects the two players’ browsers to each other (WebRTC), so each player can see the other’s IP address. With Hide my IP address switched on in the game’s settings (off by default), your side connects only through a TURN relay, or, where the game has none, through its server; your opponent then does not see your IP address. The create-room form and the invite page say which applies.
To find a route between the two browsers, they ask public STUN servers run by Google and Cloudflare for their own public addresses. When the two networks cannot reach each other that way, the connection can go through a TURN relay service (at present Metered), which sees both players’ IP addresses but only encrypted data. The connection details are exchanged in the room, sealed with the match’s keys, so the database never sees the addresses in them. Whenever the direct connection is not up, the moves go through the Realtime Database instead, encrypted as always.
What the other player sees
During an online match, your opponent’s game sees your display name, avatar, tag and user id; whether you are connected, and since when; your moves as you make them, and your cards only as you play them; how you ended the match; and the result you signed. It also sees your IP address, through the direct connection, unless you switched on Hide my IP address. It never sees your email address, your Google picture, your other matches or your settings.
Their device keeps the match, encrypted, for up to 7 days, like yours. If you leave a match against them before it ends (you resign, stay away until they claim the win, or stop it with a dispute), or claim a win their game does not confirm, their browser notes it with your user id and your name at the time (see hanafuda:v1:moderation under what is stored on your device).
What is stored on your device
The game keeps these entries in your browser’s local storage. They are not sent anywhere, and clearing this site’s data in your browser removes them.
hanafuda:v1:lang- The language you chose (English or Japanese), so pages open in it.
hanafuda:v1:session- A marker that you are signed in on this device, so the game opens on the right screen. Removed when you sign out.
hanafuda:v1:profile:<user id>- A copy of your own profile (user id, name, avatar, colour) for a quick and offline start.
hanafuda:v1:settings- Device settings: sound on or off, its volume, and whether to hide your IP address.
hanafuda:v1:houseRules:room,hanafuda:v1:houseRules:practice- The game settings you last chose for a room and for practice.
hanafuda:v1:rulesPanel- Whether the rules panel stays open beside the table on a wide screen.
hanafuda:v1:games-finished,hanafuda:v1:install-promo- How many games you have finished here, and when you dismissed the suggestion to install the app.
hanafuda:v6:match:<user id>:<room code>:<session>- An online match you are playing or have just played, encrypted: its keys, the moves both players signed, the times the game needs to back or refuse a claim of a win, and where its result stands, so that you can reload, close the app and come back to it, and so that the result can still be confirmed after you left the room. It cannot be read without the key below. Deleted once its result is settled and you have left the room, and in any case 7 days after its last change.
hanafuda:v6:vault-key:<user id>- The key that encrypts those saved matches, itself encrypted with a key that the browser keeps in its own database (IndexedDB,
hanafuda-vault) and never lets any page copy out. hanafuda:v6:active-match- Which online match you were last playing (the room code, your seat and the match’s session) and when, so the game can take you back to it.
hanafuda:v6:psk:<room code>- A key worked out from a room password you entered (never the password itself), kept only until the match has started, so that a reload in between can finish connecting; after that it is inside the saved match.
hanafuda:v6:seat:<user id>:<room code>- Only in browsers without the Web Locks feature: which of your tabs is playing that room, for a few seconds at a time, renewed while it plays.
hanafuda:v1:moderation:<your user id>- Your notes as a host: players who left a match against you before it ended, or claimed a win your game did not confirm (with their user id, the name they had then, the reason and the date) and players you banned from your rooms for 12 hours (with when the ban ends). The notes stay in your browser; a ban only marks that player’s join request as refused.
Signing out deletes the saved matches, their key and the note of the last match on this device. Session storage, which the browser clears when the tab is closed, holds the saved match and its key instead in a browser that cannot keep them (some private windows), whether the game has already taken this tab back to an unfinished match, an invite link while a sign-in page is open, the version the tab last updated to, and whether you closed the language hint. Besides the key that protects the saved matches’ key, the browser’s own database (IndexedDB) holds what the Firebase software keeps: your sign-in session, its App Check token and the dates it was used (which it reports to Google with its version details).
The service worker, which lets the game start and practice work offline, keeps copies of this site’s pages, program files, card pictures, icons and the Google Fonts files in the browser’s cache. They are the same for everyone and contain nothing about you.
Services that receive data
Koi-Koi Online has no servers of its own besides these services. Each processes data under its own terms and privacy policy, listed at the end of this page.
| Service and what it is used for | What it receives |
|---|---|
| Firebase (Google)Hosting, Authentication, Realtime Database and Cloud Firestore: serving the site, sign-in, rooms, moves and profiles | The data described on this page, and your IP address and browser details with each request. The Realtime Database is in Google’s europe-west1 region (Belgium). |
| reCAPTCHA Enterprise (Google)Through Firebase App Check: checking that requests come from the real game and not from a script | Information about your device and browser, sent to Google for analysis whenever the game page is open |
| Google Fonts (Google)The fonts of the game and of every page on this site | Your IP address and browser details, as with any download |
| CloudflareDelivering the site: its domain is served through Cloudflare’s network | Your IP address and browser details with each request |
| STUN servers (Google, Cloudflare), TURN relay (Metered)The direct connection of online matches | Your IP address; the relay also carries the encrypted data |
The game is protected by reCAPTCHA, and Google’s Privacy Policy and Terms of Service apply. Google may process data in countries other than your own under its terms.
No ads, analytics or tracking
The game and this site contain no advertising, no analytics and no tracking code, and set no cookies of their own. We do not sell your data or share it for advertising. Google’s sign-in page, reCAPTCHA and Cloudflare are run by those companies and may use cookies of their own under their policies. The guide pages run only a short script that reads your language choice and sign-in marker (listed above) and, on some pages, small tools such as the points calculator.
Your choices and deleting your data
- Change what others see: edit your display name and avatar under “Edit profile”.
- Close your rooms: “Close room” in the room, or “Close it” in the lobby, deletes the room, its lobby entry, its join requests and its password check value. While a match is being played in it, the lobby offers “Resign and close” instead. If the other player of its last match was away when it ended and has not confirmed the result yet, “Close room” keeps the room without an opponent for them, and “Close it” asks first.
- Clear your device: sign out (which deletes your saved matches and their key), and clear this site’s data in your browser’s settings (or uninstall the app) to remove everything listed under what is stored on your device.
- Stop the game’s access to your Google account: remove it in your Google Account under Third-party apps & services. This stops future sign-ins; it does not delete what is already stored.
- See or delete your data: the game has no button for deleting your account. Contact us (see below) and we will send you what is stored about your account, or delete your account record, your profile, your statistics with the markers of the matches counted in them, and any room you host. Match records and results are deleted automatically 30 days after they are written.
Children
Online play needs a Google account, and Google sets the age at which people may manage their own account in each country. The game is not directed at children; practice against the computer needs no account at all. If you believe a child has signed in without permission, contact us and we will delete the account.
Changes to this policy
When the game starts storing or sharing something new, this page will be updated before the change goes live, with a new date below and under the page title.
Effective date: .
Contact
For questions about this policy or requests about your data: [TODO: contact address]. The about section of the credits page says more about this site, and the FAQ answers common questions about the game.
Policies of the services we use
- Privacy Policy. Google
- Terms of Service. Google
- Privacy and Security in Firebase. Google
- Google Fonts: privacy questions. Google
- Privacy Policy. Cloudflare
- Third-party apps & services (your Google Account). Google: Where you can remove this game’s access to your Google account.