Privacy Policy
Version 2026-11 · in force from 14 November 2026
Short version: guests give us nothing but a nickname. Account holders give us an email address, a username and a password. We use them to run the game and keep your account safe — never for advertising, never sold, no tracking.
1. Who is responsible
AQVIK decides how your data is used (the "data fiduciary"). Contact: support@aqvik.com. Grievance officer: Prakash Raj, support@aqvik.com.
2. Playing as a guest
- 18+ confirmation. Before you create or join a room you confirm that you are 18 or older. Your browser remembers the answer; the game server only checks that it was given and does not store it.
- Nickname, room and moves. The name you type is shown to the other players in your room. The game itself (moves, cash, cities) is kept in the game server's memory and in a recovery file on its disk while the room exists, so a game survives a server restart. A room and its file are deleted 30 minutes after no player is online in it, or 1 minute after everyone has left. Please use a nickname, not your full name.
- Network address. Your IP address is used in memory to limit connections and room creation per address (protection against abuse). We do not store it in a database. Our hosting provider's request logs contain it; the provider keeps those logs for up to 90 days, in the United States.
- Your browser. The game stores your nickname, language, board choice and a reconnect code in your browser's local storage, so you can rejoin a game. Clear your browser data to remove them.
3. With an account
| What | Why | How long |
|---|---|---|
| Email address | Sign-in, confirming the address, password reset, security notices | While the account exists |
| Username, display name, avatar, language, theme | Your public player identity and settings | While the account exists |
| Password | Sign-in; stored only as an Argon2id hash, never readable | While the account exists |
| Age check result (not your date of birth) | Accounts are 18+; your date of birth is checked and immediately discarded | While the account exists |
| Signed-in devices (browser and system name, times) | Keeping you signed in; showing your devices in Settings → Security | Up to 30 days per sign-in |
| Security events (sign-ins, password changes; a shortened network prefix, never a full IP) | Protecting your account and investigating misuse | 1 year |
| Which Terms and Privacy versions you accepted, and when | Record of your agreement | While the account exists, then without your identity |
| Online games: seats, moves, results, opponents' display names | Running the game, fair results, your match history | Kept as match history; after an account is deleted it shows as "Deleted player" |
| Optional product-update emails | Only if you switch them on; off by default, can be switched off any time | Until you switch them off |
An account whose email is not confirmed within 7 days is deleted automatically. We do not ask for your phone number, location, contacts or payment details, and there are no ads or analytics on AQVIK PLAY.
4. Cookies
Only the cookies needed to keep you signed in safely: a session cookie, a refresh cookie and a security (CSRF) cookie, all first-party and secure. No advertising, analytics or third-party tracking cookies.
5. Who else handles the data
- Railway (hosting of the website, game servers and database; servers in Singapore, request and server logs in the United States).
- Brevo (sending account emails).
- GitHub (storing encrypted database backups; we alone hold the key).
They process data only on our instructions. Data may therefore be processed outside India, as Indian law allows. We share data with authorities only when the law requires it.
6. Keeping it safe
Encrypted connections everywhere; passwords hashed; saved game states, data exports and backups encrypted; access to production limited to the operator. If a breach affects your data we will inform you and the Data Protection Board of India as the law requires.
7. Your rights
- Access and portability: download all your data in Settings → Privacy.
- Correction: change your display name, username, avatar and settings in Settings; to correct your email address, write to us.
- Deletion: delete your account in Settings → Privacy. After a 14-day cancellation window your personal data is erased; encrypted backups that may still contain it expire within about a month and are never used to bring a deleted account back.
- Withdrawing consent for optional emails at any time, without affecting the rest.
- Nominating someone to exercise these rights if you die or cannot act, by writing to the grievance officer.
- Grievance: write to support@aqvik.com; we acknowledge within 24 hours and aim to resolve within 7 days. You may then approach the Data Protection Board of India.
8. Children
AQVIK PLAY is only for people aged 18 or older. Accounts check the date of birth; guests confirm they are 18 or older before they create or join a room. We do not knowingly collect data about children. If you believe a child has played, write to the grievance officer and we will delete what we hold.
9. Changes
Each version has a number and a date. Before an important change takes effect we post it here and email account holders at least 15 days ahead. See also the Terms of Service.