Back to EvilFool

Privacy Policy

Last updated

This policy explains what EvilFool collects when you play, why, and who helps us run the game. It describes what the game actually does today, in plain words.

If you have any question about your data, email [email protected].

What we collect

When you create an account, we keep:

  • Your email address, to sign you in and to send you sign-in codes.
  • Your username and country, which other players see.
  • Your full name. Only you can see it.
  • Your password, stored only as a one-way hash (bcrypt). Nobody can read it back, including us.
  • Your Google account ID, only if you sign in with Google (see below).

While you play, we keep:

  • Your game profile: the spirit you play as, the spirits you own, and your coins and diamonds.
  • Your friends: your friends list, and the friend requests and party invites you send and receive.
  • Your games: the rooms you join, your seat, your moves, your emotes and each game's result.
  • Your settings: your notification choices and your preferred region.
  • When you were last active, so your friends can see when you're online.

When we email you a code, to confirm your address or to reset your password, we keep only a hash of it, and it stops working after 10 minutes.

Like any website, our hosting provider receives your IP address and basic details about each request, such as your browser type. We use your IP address only in memory, for about a minute, to block floods of requests. We don't save it.

We don't take payments, so we never see card or bank details. We don't use advertising or analytics trackers.

What other players can see

  • Anyone signed in can find you by your username, and see your username, country flag, spirit and the month you joined.
  • Players at your table see the cards you play and your emotes.
  • Your friends can also see whether you're online or when you were last active, and whether you're in a lobby or a game. They can join or watch your public games.
  • Your email address and your full name are never shown to other players.

Signing in with Google

Signing in with Google is optional. If you use it, we ask Google only for basic sign-in details: your email address and your basic profile.

From what Google sends back, we use your Google account ID, your email address, whether Google has confirmed that address, and your name. Google may also include a link to your profile photo. We don't use or keep it.

If you create your account with Google, your Google email becomes your account email, and your Google name becomes your full name, which you can change in Settings. If you link Google to an account you already have, we add your Google account ID to it.

We never see your Google password. Apart from these basic details, we receive nothing from your Google account: not your contacts, files, calendar or anything else.

Cookies and storage

EvilFool uses only the cookies it needs to work. None of them are for advertising or tracking, and scripts on the page can't read any of them.

  • auth_token keeps you signed in. It lasts 30 days, or until you sign out.
  • pending_signup_id remembers an email sign-up while you enter the code we sent. It lasts 12 minutes.
  • google_oauth protects a Google sign-in while it's in progress. It lasts 10 minutes.
  • google_signup holds your Google details while you finish creating your account. It lasts 15 minutes.
  • google_link holds your Google details while you link Google to an account you already have. It lasts 15 minutes.

Your browser also keeps a small copy of your username, country, coins and diamonds (in local storage, as evil_user) so they show straight away. It's removed when you sign out.

Who helps us run EvilFool

A few companies process data for us, each under its own privacy policy:

  • Vercel hosts the website and runs our servers.
  • Supabase hosts our database, and sends the live updates that tell your screen to refresh.
  • Resend sends our emails: the codes that confirm your address and reset your password.
  • Google handles Sign in with Google, if you use it.

We don't sell or rent your data, and we don't share it with advertisers or data brokers.

How long we keep it

  • Your account, and everything that belongs to it, stays until you delete your account.
  • Game rooms, with their moves, emotes and results, are deleted automatically once nothing has happened in them for a while: 30 minutes for a lobby, an hour for a game in progress, and a day for a finished game.
  • Email sign-ups that are never confirmed expire after 12 minutes, and are then cleared out automatically.

Deleting your account

You can delete your account yourself at any time: sign in, open Settings, choose Account, then Delete account.

It's permanent and happens straight away. Your account, profile, spirits, coins, diamonds, friends, requests and invites are all deleted. If you're in a game at that moment, the game ends with no result and the other players get their buy-ins back.

Your username can stay inside the records of games you played with others until those games are cleaned up, within about a day. Copies may also remain in our database provider's backups for a limited time.

If you can't sign in, email [email protected] from the address on your account, and we'll delete it for you.

Your choices

You can see and change your full name, username, country and region in Settings, and turn notifications on or off there.

To ask about your data, or for a copy of it, email [email protected].

Changes to this policy

If we change this policy, we'll update this page and the date at the top.