This is a plain-language privacy policy for Quoridors.com (the “Service”), available at quoridors.com and operated by Surreal Games LLC. It explains what information we collect, why, how we use and protect it, and the choices and rights you have. We've tried to keep it readable, but it is a legal document - please review it with your own counsel before relying on it commercially.
Quoridors.com is built to need as little of your data as possible. We don't sell your data, we don't share it for cross-context behavioural advertising, and we don't run advertising trackers. We do use Google Analytics to understand how the site is used - see section 3d. Most of what we keep is the minimum required to log you in, match you with an opponent, and maintain your rating and game history.
The Service at quoridors.com is operated by Surreal Games LLC (“we,” “us,” or “our”), which is the data controller responsible for your personal information under this policy - meaning we decide what data is collected and why.
If you have any privacy question, you can always reach us at the email above.
This policy applies to the Quoridors.com website, game client, and any related pages we operate. It does not apply to third-party websites or services we link to (for example, Google's sign-in service), which have their own privacy policies. See Section 13.
When you use the Service, our servers and infrastructure automatically record certain technical data, which is standard for running any online game reliably and securely:
How we use IP addresses. We use IP addresses to maintain security, prevent abuse, match and connect players, diagnose technical problems, and comply with legal obligations. We do not use them to build advertising profiles.
We use a small number of on-device technologies. There is no advertising network, no advertising pixel, and no cross-site tracking on this site of any kind. We use one third-party analytics service, Google Analytics, described below.
Cookies. We set two of our own. Both are first-party - only quoridors.com can read them -
and both are HttpOnly, meaning no script running on the page can read them
either:
quoridor_session - strictly necessary to keep you signed in.
Without it you can't stay logged in. It is dropped when you close your browser, or lasts
30 days if you chose "stay signed in".quoridor_vid - a random value with no meaning outside this site, used
for one thing: counting how many separate browsers visited in the last 24 hours, on
an operator dashboard only we can see. If you are signed in, the same record notes which
account was last active on that browser, so the dashboard can show how many of the day's
visitors were signed-in players. It is never read to log you in or to decide what
you may do, is never shared with anyone, and cannot follow you to other websites, because
no other website can read it. The cookie lasts 30 days and the visit records are
deleted after 7 days. Blocking or clearing it costs you nothing - no part of the
site depends on it.Google Analytics. We use Google Analytics to understand how people
use the site - which pages are visited, how visitors arrived, roughly where they are (country
or city, estimated from the IP address), what kind of device and browser they use, and how long
they stay. We use it to see what is working and what to improve, and for nothing else. Google
Analytics sets two cookies, _ga and _ga_TYR029NDSZ,
which hold a random identifier for your browser and the state of your current visit. They last
up to 2 years, and their contents are sent to Google along with each page you view. We
do not send Google your username, email address, or account, and the password-reset,
email-verification and unsubscribe pages do not load Google Analytics at all. Google handles
this data under its own privacy policy; you
can read how it works in How
Google uses information from sites that use its services.
Browser localStorage - your settings stay on your own device so the game
looks and plays the way you left it: board theme and piece style, difficulty, whether hints and
the evaluation bar are shown, wall-placement confirmation, and which one-off notices you have
already dismissed. Guest statistics - results of games played without an account - are
kept here too. This data stays on your device and is not sent to us as part of an
account.
What loads from other companies. Our font is served from our own servers. Reading a page here loads Google Analytics, as described above, and nothing else from a third party. Two further exceptions, both of which you choose by using them: if you sign in with Google, Apple, or Discord, that provider's code runs on the sign-in page and the provider sees that request, which is inherent in signing in with them; and our email sign-in and sign-up form loads Cloudflare Turnstile, which is there to keep automated sign-ups out.
So the cookies on this site are one that is strictly necessary, one limited first-party visitor count that is not shared with anyone, and the two Google Analytics cookies. We do not show a cookie-consent banner. You can stop Google Analytics by blocking or clearing its cookies, or with Google's opt-out browser add-on; the game works exactly the same either way. If we ever add advertising technologies, we will ask your consent before setting them.
We use your information only to operate and improve the game:
We do not sell or rent your personal data, we do not use it for third-party advertising, and we do not use your gameplay or personal information to train generative AI models.
To protect the integrity of ranked play and keep the community safe, we may automatically or manually review gameplay patterns, login activity, and account activity to detect cheating, rating manipulation, botting, the use of external engines, multi-account abuse, spam, or other violations of our Terms. Where we find violations, we may warn, restrict, suspend, or close the account involved.
This section applies to organised tournaments only. It does not apply to ordinary play. Playing ranked, casual or puzzle games on Quoridors is never proctored and never recorded, and nothing below is switched on for you by playing normally.
Tournament games are proctored: from the draw until you are knocked out or the event ends, you share your entire screen through the screen recorder on our bracket page, and it is recorded. Your browser uploads the recording to our server every few seconds while you play. Only the screen is recorded - no camera and no microphone. Alongside it we keep a log of when your screen share started and stopped, and whether your browser reported a second screen attached. During a tournament game the game page also tells us when the board is not in front of you - when you switch to another tab, window or screen - and we keep how long you were away on each of your own moves, with the fair-play results for that game. We do this for one purpose only: to settle a fair-play question about that tournament if one is raised.
Our legal basis for this is your consent, given when you register for the tournament and withdrawable at any time (see section 6).
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:
Some information is visible to other players and to the public as part of how a competitive game works, including your username, ELO rating, leaderboard position, completed ranked games, and match history (which may be viewable as replays). Please avoid choosing a username - or sharing anything in connection with your profile - that contains personal information you wouldn't want others to see.
We share personal information only in the limited circumstances below.
We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under U.S. state privacy laws.
Because we do not track you across other websites or serve targeted advertising, we do not behave differently based on Do Not Track (DNT) browser signals. We honour applicable opt-out preference signals such as Global Privacy Control (GPC) where the law requires - though since we don't sell or share data for advertising, there is generally nothing for such a signal to opt out of.
We keep personal data only as long as we need it:
We use reasonable technical and organisational measures to protect your information, including:
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and any relevant authority as required by law.
We and our service providers may store and process your information in the United States. If you are located elsewhere, your data may be transferred to and processed in a country with different data-protection laws than your own. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can contact us for more information about these safeguards.
The Service may link to third-party sites and services (for example, Google sign-in, or our About and Terms of Service pages). When you use Google to sign in, and for the data Google Analytics collects, Google's handling of your data is governed by Google's own privacy policy. We are not responsible for the privacy practices of third-party services, and we encourage you to review their policies.
localStorage.You have the right to: access your data; correct inaccurate data; delete your data; restrict or object to processing; data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office) - though we'd appreciate the chance to resolve any concern directly first.
You have the right to know what personal information we collect and how we use it; to access and delete it; to correct it; and to not be discriminated against for exercising these rights. Because we do not sell your personal information or share it for cross-context behavioural advertising, there is no “opt-out of sale/sharing” to exercise - but you may still make access and deletion requests at the email below.
Email contact@quoridors.com. We may need to verify your identity before acting on a request (so we don't disclose or delete the wrong account's data). We aim to respond within the timeframe required by law (generally within one month under GDPR, and 45 days under California law, with extensions for complex requests). You may use an authorised agent to submit a request where the law allows.
If account deletion is available through the website, you may delete your account directly from your account settings. Otherwise, you may send a deletion request to contact@quoridors.com. After deletion, your account data is removed or anonymised as described in Section 10, though it may persist briefly in encrypted backups before being overwritten.
Quoridors.com is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without appropriate parental consent, we will delete that information as soon as reasonably practicable. If you believe a child has provided us with personal information, please contact us at contact@quoridors.com.
We may update this policy from time to time to reflect changes in our practices or the law. When we do, we'll revise the “Last updated” date above. For material changes, we'll provide more prominent notice - such as a banner on the site or an email - before the change takes effect. We encourage you to review this page periodically.
Questions, requests, or concerns about this policy or your data:
© 2026 Surreal Games LLC