What do we store, and why?
A guest only has a generated name, which disappears after a day. An account holds your name, e-mail address, password (encrypted), avatar, ratings, game and tournament history, friends and blocks — so that games, ratings and history work. We do not sell data or combine it with other sources.
Who is responsible for your data
The data controller is the OMGLoft service (omgloft.com). For personal-data matters, write to us through the form on the Contact page.
Cookies
Our own cookies remember your sign-in and language. Ads are shown by Google AdSense — on your first visit Google asks for consent to its advertising cookies; without it, ads are not personalised.
Google, as a third-party vendor, uses cookies to serve ads based on your previous visits to this and other sites. Advertising cookies let Google and its partners choose ads for you. You can turn off personalised ads in Google Ads Settings, and you can read how Google uses data from partner sites on this Google page.
Chat and conversations
Table chat is not stored, and messages with swear words are not sent. The server remembers your messages from the last hour: if someone reports you, they are attached to the report. Reports and moderation decisions are kept so they can be explained later.
Only the two of you can read conversations with friends; moderators see just a reported message with an hour of the conversation before and after it. Messages older than 6 months are deleted, and all of them go when you delete your account. You can turn conversations off in your privacy settings.
Fair play
In ranked and tournament games the server computes simple signs of unfair play (even move times, unusually many wins, a jump in rating). A sign is only a marker for a moderator; we keep the game record of a player with several signs for 30 days. A ranked block only happens after several signs and can be appealed; only a moderator can ban an account.
Server log
Our server records every page request: IP address, page address (without parameters), time, response code and browser name — for security and robot-traffic statistics. The log is deleted after 14 days; the statistics keep only numbers.