Privacy

Privacy policy

Last updated 15 September 2026

Who we are

Paddle Duel (https://paddle-duel.com) is a free two-player browser game operated by an individual developer based in Türkiye. This policy explains what personal data the game collects, why, who it is shared with, how long it is kept and what choices you have. Questions and requests: ozerharmona@gmail.com.

What we collect

  • Account data. A display name you choose. If you create an account with e-mail we store the e-mail address and a salted hash of your password (never the password itself). If you sign in with Google we store the identifier Google assigns to your account, your e-mail address and your name as provided by Google. We never see your Google password.
  • Gameplay data. Your matches (opponent, category, result, power share, Elo and XP changes), level, badges, streaks, mastery, chosen cosmetics, the number of matches played each day and rewarded-ad credits. Match results are shown on public leaderboards and in the public results feed under your display name.
  • Technical data. A random session token stored in your browser to keep you signed in, your theme preference, and server logs containing your IP address, browser type and the pages requested, used for security and to keep the service running.
  • Analytics. Google Analytics 4 counts visits and which parts of the game are used (pages viewed, matches started, ads watched, results shared). IP addresses are anonymised. In the European Economic Area, the United Kingdom and Switzerland analytics cookies are only set after you consent in the prompt.
  • Advertising. Rewarded video ads are served by Google AdSense (H5 Games Ads) when you choose to watch one for extra matches. Google may set cookies and process your IP address and device information to show and measure ads. In the EEA, the UK and Switzerland you are asked for consent first, and you can choose non-personalised ads.
  • Payments. Paid features are not live. If they launch, card details will be handled by the payment provider on its own pages and never reach our servers.

Why we use it

To run the game (matchmaking, rooms, results, leaderboards), to keep your progress across devices when you link an account, to keep the service secure and prevent abuse (rate limiting, forfeits, fraud checks on ad rewards), to understand which features are used and improve them, and to fund the game with rewarded ads. Under the GDPR the legal bases are performance of the contract with you (running the game and your account), our legitimate interests (security, statistics, promotion) and your consent (analytics and advertising cookies where consent is required).

Who we share it with

We do not sell personal data. Data is processed by these service providers on our behalf: Amazon Web Services (hosting, servers located in Frankfurt, Germany), Google (sign-in, Analytics, AdSense advertising) and, if you use them, the social networks where you share a result link. Google processes data under its own privacy policy. Some Google processing takes place outside the European Union under the standard contractual clauses approved by the European Commission. We disclose data to authorities only when required by law.

Google sign-in and Google API Services

Signing in with Google uses Google Identity Services and asks only for your basic profile (identifier, e-mail address, name). We use it to create or link your Paddle Duel account and for nothing else.

Our own promotional account uses YouTube API Services to upload the game's daily quiz videos to our own YouTube channel. That integration accesses only our channel; it never reads, stores or processes other users' YouTube data. By using YouTube features you also agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. Paddle Duel's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke any access granted to Paddle Duel at myaccount.google.com/permissions.

Cookies and browser storage

The game itself uses browser storage, not cookies: a session token, your theme choice and a note that you dismissed the onboarding. Google Analytics and Google advertising may set cookies as described above, subject to consent where required. You can clear browser storage and cookies at any time; you will simply be signed out.

How long we keep it

Account and gameplay data are kept until you delete your account. Server logs are kept for up to 30 days. Database backups are kept for 14 days. Google Analytics data is kept for 14 months. Guest accounts that are never linked and stay inactive for 12 months may be removed.

Your rights and choices

You can rename yourself, change your cosmetics, sign out of a device, or sign out everywhere from your profile. You can withdraw consent to analytics or advertising cookies through the consent prompt or your browser settings. To access, correct, export or delete your personal data, or to object to processing, write to ozerharmona@gmail.com; we answer within 30 days and delete accounts on request. If you are in the EU or UK you may also complain to your data protection authority.

Children

Paddle Duel is not directed at children under 13 and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will remove it.

Security

All traffic is encrypted with HTTPS. Passwords are stored as salted hashes. Access to the server and the database is limited to the operator. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Changes

We may update this policy as the game changes. The date at the top shows the latest version, and significant changes will be announced on the site. This version is effective from 15 September 2026.