Privacy policy

When you join a game as a student, without an account:

• the display name you type (shown on the leaderboard);
• a random guest ID, created in your browser so the game knows which device is yours. It is not linked to your name, email or phone number;
• what you allocate each round and the results that follow.

If you create an account (to host games, or to keep your results as a student):

• your username, email address, display name and, if you add it, your institution;
• if you sign in with Google, the name and email address Google shares for sign-in;
• a password, if you set one. It is stored hashed by the sign-in provider and never visible to me.

If you host, the sessions you create: their settings, their names, and the results of the students in them.

Technical data. Page visits are counted with Vercel Web Analytics, which records the page, referrer, browser and device type and country, in aggregate and without cookies. To slow down password guessing, failed sign-in attempts are counted against the username and a one-way hash of the IP address, for a short window. The hosting providers keep standard server logs.

Only to run the game: to show each round's results, build the standings, let you sign in, stop abuse, and fix what breaks. Nothing is sold, there are no ads, and there is no marketing email.

• The host of a game sees each player's display name, what they allocated each round and their results, and can download them as a spreadsheet.
• Other players see display names and, when the host shows them, the standings (wealth and rank). They never see what another student allocated.
• Service providers process data on my behalf: Supabase (database and sign-in), Vercel (hosting and analytics), and Google, only if you choose Google sign-in.
• Anyone else only if the law requires it.

The site uses only what it needs to work: a sign-in cookie that keeps you signed in, and your browser's local storage for small preferences, such as the name you last joined with or a chart setting. There are no advertising or tracking cookies, which is why there is no cookie banner.

• Game results stay with their session until the host deletes it or deletes their account.
• A guest ID with no activity for 45 days may be removed. The results it played stay in the host's session, with no link back to that guest.
• An account is kept until you delete it.

With an account, you can do both yourself on your account page: Download everything gives you a file of your profile, the sessions you hosted and every round you played, and Delete account removes the account. Deleting a host account also deletes the sessions it hosted.

As a guest, ask the host to delete the session, or email maxalexjansen@gmail.com with the game code and your display name. I answer requests within 30 days.

The Risk Game is made for university classrooms and is not directed at children under 13, who should not use it. When an instructor runs it with a class, the instructor and their institution decide how it is used, and I handle the class's results on their behalf. Students don't need to use their real names; a first name or a nickname works just as well.

Everything travels over HTTPS, and the database only lets each person reach their own records and the games they are part of. No system is perfectly secure, so please don't put anything sensitive in a display name or session name. Data is stored with Supabase and Vercel and may be processed in the United States or other countries where they operate.

If this policy changes, the date at the top changes with it, and a significant change will be noted on the site.

Max Jansen, Massachusetts, USA — maxalexjansen@gmail.com