Who is responsible

The Ceqio project is the data controller. You can contact us on Discord or at ceqiocompany@gmail.com.

What we collect

• Account information — your username, display name, and password. Passwords are stored only as a salted hash, never in plain text. An email address is collected only if you choose to provide one.
• Gameplay data — the boards you play, bids, card plays, scores, ratings, and match/tournament history, so the game can function and show results.
• Session data — a login cookie and a per-window session token used to keep you signed in and to enforce one active session per account. Each login record also stores the network address and browser user-agent it was created from.
• Error diagnostics — when something goes wrong, a technical error report (stack trace, page, release version, and an opaque account identifier) so we can find and fix it. These reports deliberately exclude your username, email address, network address, and session cookie.
• Anonymous demo counters — if you play a public demo without an account ("Beat the AI" or Free play), we increment aggregate counters: how many visits began, how many finished a hand, and a rough duration band. These are totals only. No account, identifier, network address, or record of your individual visit is stored, and nothing here can be linked back to you.

Why we use it, and our legal basis

• To provide the game — accounts, matchmaking, ratings, history and results. Legal basis: performance of our agreement with you.
• To keep it secure and fair — protecting accounts, enforcing one active session, and preventing cheating or abuse. Legal basis: our legitimate interest in a secure and fair service.
• To find and fix faults — error diagnostics and operational logging during beta. Legal basis: our legitimate interest in a working service.
• To contact you about your account, if you provided an email address. Legal basis: your consent, which you may withdraw at any time by removing the address in your account settings.
• To understand how many people try the demos — the aggregate counters above. These contain no personal data, so data-protection law does not apply to them.

Who we share it with

We do not sell your data and we do not share it for advertising. We use two service providers, which process data only on our instructions:

• Google Cloud — hosting for the application, database and backups.
• Sentry — error monitoring. It receives the technical error reports described above. We have configured it not to send personal information: your username, email address, network address and session cookie are stripped before an error report leaves the server or your browser, and screen recording ("session replay") is switched off.

If you contact us on Discord, that conversation is subject to Discord’s own privacy policy. We may disclose information if required by law.

Where your data is stored

Ceqio runs in the European Union: the application, database and backups are hosted in Finland, and error monitoring uses Sentry’s European region in Germany. We do not transfer your personal data outside the European Economic Area.

Cookies

Ceqio uses a login cookie and a per-window session token. These are strictly necessary to sign you in and to enforce one active session per account — without them the game cannot work — so we do not ask for cookie consent. We do not use advertising cookies, analytics cookies, or third-party trackers.

How long we keep it

• Account and gameplay data — while your account exists. Deleting your account removes it.
• Login sessions — up to 7 days, after which they expire and the record is deleted.
• Backups — up to 14 days, after which they are rotated out. Deleted data can persist in a backup until that window passes.
• Error diagnostics — retained by Sentry for a limited period under their retention policy, then deleted.
• Anonymous demo counters — kept indefinitely. They are totals with no personal data in them.

Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable form. Where we rely on your consent, you may withdraw it at any time.

• You can delete your account at any time from your account settings, which removes your account data.
• For anything else, contact us at the address above and we will respond as soon as we can.
• If you believe we have handled your data improperly, you have the right to lodge a complaint with the data-protection supervisory authority in the country where you live or work.

Children

Ceqio is not directed to children under 13 (or the minimum age required where you live). If you believe a child has provided us data, contact us and we will remove it.

Changes

As Ceqio develops we may update this policy; the version and date above will change and we will keep prior versions on record.

• beta-2026-07-28 — named our service providers (Google Cloud and Sentry) and what each receives; stated that all data stays in the EU/EEA; added our legal basis for each purpose, how long we keep each kind of data, the cookie position, your right to complain to a supervisory authority, and the anonymous demo counters.
• beta-2026-07-18 — first published version.