Privacy Policy

Who controls your data

REXCODE DIGITAL LTD is the controller for Go Mancala. It is a private company limited by shares registered in England and Wales under company number 17088152 and is registered with the Information Commissioner’s Office under reference ZC205511. Its registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Data we use

• Account data: email address, username, display name, password-authentication records and account timestamps.
• Public identity data: optional avatar, optional chosen country, rating, rank, public badges, achievements and competitive statistics.
• Game data: room and match identifiers, participants, moves, results, scores, series state, rating changes and match history.
• Social and safety data for registered users: friend connections, blocks, direct and match chat, reports, moderation outcomes and limited presence state.
• Progress data: XP, levels, missions, daily streaks, notifications and wallet ledgers.
• Technical data: a private IP-derived country observation, security events, rate-limit keys, browser/session identifiers, error logs and short-lived realtime connection data. The edge country observation is not made public by default.
• First-party product analytics: a bounded in-memory session identifier, event name and limited gameplay context. We do not store its identifier in your browser.
• Optional Google Analytics, after consent: page URL/title and a short allow-list of navigation or game-mode events. We do not send names, email addresses, room codes, chat, report text or account identifiers.

Why we use it

We process account, game and social data to perform our contract with registered players and provide requested gameplay. We use legitimate interests to secure the service, prevent abuse, keep authoritative match records, understand reliability and operate proportionate community-safety controls. Optional Google Analytics relies on consent and remains disabled unless you accept it. Where law requires consent, we ask before using the relevant feature—for example browser notifications.

Guests

Guests receive a locally stored random identity and nickname so private rooms, bot games and reconnect can work without an account. Room seat tokens are stored locally or for the tab. Guest play does not create a reusable public account profile. Guests cannot send match chat or friend/private messages, upload or edit an avatar, publish custom profile imagery, or create other social/profile content.

Who receives data

Cloudflare provides hosting, security, network and realtime infrastructure. Supabase provides authentication, database and avatar storage infrastructure. If you accept optional analytics, Google processes the limited analytics data described above. Service providers process data under their own contractual and security terms. Data may be processed outside the United Kingdom; we use the transfer safeguards made available by those providers and review them as the service changes.

Retention

Active room/queue state is kept for its lifecycle and no more than 24 hours after expiry. Routine chat, resolved invitations/notifications and security records are kept for no more than 90 days; first-party event data for no more than 13 months; and identifiable completed match/rating records and closed safety records for no more than 24 months. Older match records are anonymised where historical integrity remains useful. Account/profile data remains while the account is active; dormant accounts are reviewed after 24 months. Documented safeguarding, complaint, law-enforcement, fraud, legal or backup exceptions may temporarily suspend deletion and are reviewed at least every 90 days.

Your choices and rights

You may ask for access, correction, erasure, restriction, portability or objection where the law provides those rights, and withdraw analytics consent at any time through Cookie settings. You may also complain to the UK Information Commissioner’s Office. Profile controls allow you to correct key identity data; blocking and reporting tools are available in social and match contexts. Registered players can permanently delete their account from Settings. The deletion flow verifies the current password, removes personal account data and anonymises only the historical records that must remain for integrity, safety or legal reasons. You may also email privacy@gomancala.com; we may need to verify account ownership.

Children

Go Mancala is a general-audience strategy game, not a service directed specifically at children. We assess it as likely to be accessed by under-18s and apply privacy-minimising safeguards broadly without collecting unnecessary date-of-birth, identity-document or biometric age data. Guests cannot communicate or publish profile content; registered-user text interactions remain subject to report, block, mute and operator review. Do not share sensitive personal information in usernames or chat.

Contact

For privacy and data-rights correspondence, email privacy@gomancala.com or write to: Data Protection, REXCODE DIGITAL LTD, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Changes

We will update the effective date and explain material changes here. Where a change materially affects how registered players’ data is used, we will provide an appropriate in-product notice.