Privacy

Last updated: 20 October 2026. This page describes the information used by LinesClash. For support or privacy requests, contact info@zyvrus.com.

In your browser (localStorage)

• Nicknames, display preferences, an unfinished local game, and unverified local win counts. Clearing site data removes them.
• No passwords, tokens, or seat secrets are kept in localStorage.

Cookie

• ga_guest: a random, signed, HttpOnly identity for reconnecting to your online seat and recovering eligible guest progress; its 30-day lifetime renews when you load a game-site page. Clearing cookies, private browsing, or expiry can lose access to guest progress. Signing in can link server-verified progress to your account. Browser-reported victories do not become official achievements by signing in.
• Optional sign-in uses an encrypted HttpOnly Auth.js JWT cookie, expiring after seven days. Production cookies require HTTPS. Sign out clears your browser session; deleting the account invalidates account actions from every session.
• ga_popunder_seen: a 24-hour HttpOnly cookie limiting sponsored-tab opportunities, including blocked or failed requests. A timestamp in localStorage applies the same daily limit immediately across page loads.

Online game state

• Active rooms, seats, nicknames, connection leases and move lists are held in private shared storage on Microsoft Azure SQL. This supports reconnecting across app replicas and restarts. Empty rooms normally expire after about 30 minutes and finished rooms after about two hours; replay evidence has a separate retention period below.
• Pending server-verified online result receipts are retained for up to 24 hours or until claimed. They identify the eligible browser session and the server-calculated result.
• Completed competitive matches retain private replay evidence for up to 90 days: match and participant identifiers, board configuration, AI policy version where applicable, turns, scoring and server timestamps for new moves. This evidence supports independent score verification and duplicate-reward prevention. Earlier matches or turns may not have this evidence.
• Temporary guest-session reports and matching blocks expire within 24 hours. They contain guest identifiers and a problem category, without voice content. Reports are not a staffed moderation service.

Network metadata

Microsoft Azure hosts the website and live account/game database. Hosting and network providers may log connection metadata, including IP addresses, as part of their operations. LinesClash does not include raw IP addresses in player profiles, match records or activity analytics. Request limits use temporary network-address information in memory and keyed one-way identifiers in short-lived database buckets.

Optional account storage

Player accounts store a unique handle, salted scrypt password hash, creation time, optional display name, bio and selected game avatar, plus server-verified aggregate scores and AI challenge progress. The live database is Microsoft Azure SQL. Player email, Google profiles and plaintext passwords are not stored. The separate operator dashboard stores its administrator email and salted password hash.

Delete your account from Profile to remove its live account, linked activity, profile and scores and release the handle. Unlinked anti-replay receipt hashes may remain until their 24-hour expiry. Private competitive replay evidence can remain until its 90-day retention expires. Prior data can also remain in restricted recovery backups, including a pre-migration database copy, until those copies are retired. Contact us for questions about retained data.

Activity and medals

Signed-in players can discover other registered players and view their display name, chosen game avatar, bio, join month, live presence, human rank, earned medals, aggregate results, AI challenge progress and retained match summaries. Guests cannot access this directory or other players’ profiles and history. Your handle remains your account identifier; display name, bio and avatar can be edited from Profile. Anonymous opponents appear as Guest player. Private administrator notes, browser identifiers and account credentials are never included in these player views.

Visit sessions use a 30-minute inactivity window. Page loads and route changes count as page views; heartbeat retries do not add views. Signed-in browser records are grouped by account in the player dashboard; anonymous browsers cannot reliably be identified as the same person. Short-lived random page-view identifiers are retained for two days after their last heartbeat to deduplicate requests. Compact per-browser visit, page-view and match-start totals are stored with your activity. The private admin site is excluded from game-site traffic.

We store a one-way pseudonymous browser identifier, nickname, optional account link, first and last visit, aggregate match counts, outcomes, medals and limited match summaries. Official AI challenge progress comes from server-controlled duels; completed games, draws and recorded forfeits contribute according to the rank rules. Browser-reported games can contribute activity telemetry but cannot award official medals, ranks, leaderboard credit or account progression. Nightmare can use your saved record for optional in-game banter. Competitive replay move lists are retained as described above; audio is not recorded.

A fixed snapshot of early registered players’ existing match summaries and earned awards is preserved as operator-approved history, until the account is deleted. These older records retain their original scores and dates; they do not supply missing replay evidence or replace verified AI rank requirements. New browser reports cannot enter this preserved snapshot.

Live presence expires after two minutes without a visible-page heartbeat. Activity is marked inactive after seven days. Detailed match summaries and daily visitor links are retained for up to 90 days (at most 20,000 match summaries), daily totals for one year, and unlinked guest profiles for one year of inactivity. Lifetime aggregate totals remain. Administrative medal changes are audited for one year. Deleting an account removes its linked activity and medals; unlinked guest identities remain subject to their retention period.

Optional private-room audio

Microphone access requires your explicit action and browser permission. It starts muted; audio travels directly to consenting room peers, or via an operator-configured TURN relay. Your consented microphone session survives brief network reconnects. Leaving audio, leaving the room, or losing an expired room releases microphone tracks. No audio is recorded, transcribed, or retained. TURN credentials expire after ten minutes.

Hosting and relay operators may retain their own operational network logs. Microphone permission is optional and is not required to play.

Advertising

Lobby and completed-match pages include clearly labelled Adsterra advertisements. Adsterra and its advertising partners receive network information such as your IP address and browser information when their scripts or ads load, and may use their own cookies or identifiers. Banner advertisements run in separate same-origin frames; their third-party scripts may access the publisher page and its storage. Native advertisements use sandboxed frames. Camera and microphone access are disabled for ad frames. On your first eligible daily Play action, the supplied Adsterra Smartlink may open a sponsored tab while the game continues in the original tab. Popup blockers are respected. Entering a game performs a full document navigation to dispose lobby advertising code.

Read the Adsterra privacy policy. Blocking advertisements does not prevent gameplay.

Contact

For support, account questions or privacy requests, email info@zyvrus.com. Include your player handle when relevant; never send your password.