Privacy Policy

This policy describes what NowPlay collects when you play here, why, how long it is kept, and how to get it removed. It covers nowplay.gg and the games served under it.

NowPlay is an independent project, operated online only. For anything in this policy — including a request to see, correct or delete your data — email privacy@nowplay.gg, and we will reply.

What we collect

When you create an account

Accounts are created by signing in with Google or Discord, or by registering a passkey. We never see or store your password — the provider authenticates you and tells us who you are. From that we store:

Data	Where it comes from
Email address	Your Google or Discord account
Display name	Your provider profile; you can change it
Avatar image URL	Your provider profile
Country	Derived from your connection, not from GPS
Preferred language	Your browser, or your setting
Account created and last seen times	Our servers

If you sign in with a passkey, we store the passkey's public key and a device label you choose. A public key cannot be used to impersonate you, and the private key never leaves your device.

When you play

• The result of each match, the moves made, and who played
• Your rating per game, including your highest rating and when you reached it
• Whether a match was abandoned, and how it ended

Match records are shared history: they belong to everyone who played, so they survive your account being deleted. They are unlinked from your identity — see Deleting your account.

Technical data

• Your IP address, used to derive your country and to apply rate limits. We do not store the raw address in our own database.
• Your browser's user agent, in server logs
• Error and diagnostic logs, which may name the match and the account involved

Cookies and similar storage

Name	Purpose	Lifetime
jwt	Keeps you signed in	Short-lived; refreshed automatically
refresh	Renews your session without asking you to sign in again	Up to 30 days
cm_state	Remembers your cookie choices	180 days
fpid	Advertising identifier, set only if you allow advertising cookies	Until consent expires or is withdrawn
_fc_consent_data	The consent prompt's own record of your choices	13 months
euconsent-v2, addtl_consent	Standard industry consent signals (IAB TCF), so advertisers can read your choices	13 months
_gpp	The equivalent signal for US state privacy laws	13 months

The consent prompt also stores a copy of these signals, and a cached vendor list, in your browser's local storage under names beginning IABTCF_, IABGPP_ and _fc_.

The session and consent cookies are necessary for the site to work or to honour your choices, and are set without asking. Anything used for advertising or analytics is set only after you agree. You can change your mind at any time using the consent button in the bottom-left corner of any page.

Advertising

Free accounts may see advertising served through Google Ad Manager. Whether those ads are personalised depends entirely on the choice you made in the consent prompt. If you decline, you still see ads, but they are not based on a profile of you.

Your consent choice is recorded with a timestamp and version so we can show what was agreed and when. Consent expires after 180 days and we ask again.

Who else sees your data

• Cloudflare — hosts the entire platform. All data is processed on their infrastructure.
• Google — if you sign in with Google, and for advertising where you have allowed it.
• FlexyConsent — runs the consent prompt and records your choices.
• Discord — if you sign in with Discord.

We do not sell your personal data. We do not share it with anyone not listed here, except where the law requires it.

Where your data is processed

NowPlay runs entirely on Cloudflare's global network, so your data may be processed in any country where Cloudflare operates, including outside your own. Cloudflare's data processing terms, including its standard contractual clauses for transfers out of the UK and EEA, govern that processing.

How long we keep it

• Account data — until you delete your account
• Sessions — refresh tokens expire after 30 days; sign-in tokens in minutes
• Consent records — 180 days, then we ask again
• Diagnostic logs — a rolling window, currently 24 hours for per-game logs
• Match history — indefinitely, unlinked from deleted accounts

Deleting your account

You can delete your account from your profile page. When you do, we remove:

• Your email, display name, avatar and country
• The link between your account and Google or Discord
• Your passkeys and recovery codes, so the account can no longer be signed into
• Your ratings, notifications, friends and any subscription records

A record with your account's internal ID is kept so that matches other players took part in remain intact. It carries no personal data and shows as "Deleted Account". Abuse reports made about an account are also retained, so that moderation history is not erased by deleting and re-registering.

You can also export your data from the same page, and request a copy or a correction by emailing us.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, object to how we use it, or take it elsewhere. Use the tools on your profile page, or email privacy@nowplay.gg. If you are in the UK or EEA and you think we have got something wrong, you may complain to your local data protection authority.

Children

NowPlay is not intended for children under 13, or under 16 in the EEA where local law sets that age. We do not knowingly collect data from them. If you believe a child has created an account, email us and we will remove it.

Changes

We will update this page when our handling of data changes, and change the date at the top. If a change is significant, we will tell you in the product before it takes effect.