Privacy Policy

Who controls your data

REXCODE DIGITAL LTD is the controller for Go Mancala. It is a private company limited by shares registered in England and Wales under company number 17088152. Its registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Data we use

• Account data: email address, username, display name, password-authentication records and account timestamps.
• Public identity data: avatar, optional country, rating, rank, public badges, achievements and competitive statistics.
• Game data: room and match identifiers, participants, moves, results, scores, series state, rating changes and match history.
• Social and safety data: friend connections, blocks, direct and match chat, reports, moderation outcomes and limited presence state.
• Progress data: XP, levels, missions, daily streaks, notifications, wallet ledgers and dormant cosmetic entitlements.
• Technical data: IP-derived country code, security events, rate-limit keys, browser/session identifiers, error logs and short-lived realtime connection data.
• First-party product analytics: a bounded in-memory session identifier, event name and limited gameplay context. We do not store its identifier in your browser.
• Optional Google Analytics, after consent: page URL/title and a short allow-list of navigation or game-mode events. We do not send names, email addresses, room codes, chat, report text or account identifiers.

Why we use it

We process account, game and social data to perform our contract with registered players and provide requested gameplay. We use legitimate interests to secure the service, prevent abuse, keep authoritative match records, understand reliability and operate proportionate community-safety controls. Optional Google Analytics relies on consent and remains disabled unless you accept it. Where law requires consent, we ask before using the relevant feature—for example browser notifications.

Guests

Guests receive a locally stored random identity and nickname so private rooms, bot games and reconnect can work without an account. Room seat tokens are stored locally or for the tab. Guest play does not create a reusable public account profile.

Who receives data

Cloudflare provides hosting, security, network and realtime infrastructure. Supabase provides authentication, database and avatar storage infrastructure. If you accept optional analytics after a production Measurement ID is configured, Google processes the limited analytics data described above. Service providers process data under their own contractual and security terms. Data may be processed outside the United Kingdom; we use the transfer safeguards made available by those providers and review them as the service changes.

Retention

Live room state is retained only as needed for play, reconnect and operational recovery. Account and progression data remain while an account is active. Match results, wallet ledgers, safety reports and security records may be kept after an account-deletion request where necessary to protect game integrity, prevent fraud, resolve complaints or meet legal obligations. Chat and operational logs are retained only for a proportionate period set by operational need. We review retention periods as production evidence becomes available.

Your choices and rights

You may ask for access, correction, erasure, restriction, portability or objection where the law provides those rights, and withdraw analytics consent at any time through Cookie settings. You may also complain to the UK Information Commissioner’s Office. Profile controls allow you to correct key identity data; blocking and reporting tools are available in social and match contexts. A self-service deletion workflow is being completed; until it is live, send a written request to our registered office headed “Go Mancala privacy request”. We may need to verify account ownership.

Children

Go Mancala is a general-audience strategy game, not a service directed specifically at children. Because an online board game may nevertheless be accessed by under-18s, we apply privacy-minimising defaults and are completing the documented child-access and data-protection assessments required for launch. Do not share sensitive personal information in usernames or chat.

Contact

For privacy correspondence, write to: Data Protection, REXCODE DIGITAL LTD, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. A dedicated public privacy mailbox will be published only after it is configured and verified.

Changes

We will update the effective date and explain material changes here. Where a change materially affects how registered players’ data is used, we will provide an appropriate in-product notice.