XUNYANG — Privacy policy

Effective and updated: October 25, 2026.

Operator and copyright holder: fuba. Contact: fuba (contact details on the public profile). This cooperative tile game does not require an account. This policy distinguishes information processed during connections from information recorded or stored.

1. Online connections and your IP address

A direct WebRTC connection can reveal your public IP address, port and browser-exposed network candidates to the connected peer. The host connects to each guest; guests connect to the host. Hiding local addresses using mDNS does not guarantee that your public IP address is hidden. An IP address can suggest your approximate area and network provider. Public rooms connect you with strangers. Guests do not exchange connection candidates or IP addresses with one another. The host may learn each guest’s IP, and each guest may learn the host’s IP. The host device relays all game messages.

Hiding your IP from peers requires measures such as relay-only connections from the outset. This game prefers direct connections and does not offer a relay-only mode. Falling back to TURN does not guarantee anonymity. Relaying is unavailable when TURN is unconfigured or its budget is exhausted. Select “Agree and connect” only if you accept this sharing. You can cancel and play solo Practice instead.

2. Information, purposes and retention

Information	Where and why it is processed	Recording and retention
Nickname	Your device and fellow players, to identify players and display match history.	Your own nickname stays in localStorage until changed or cleared. Peers hold it in memory during the game. Guest and private-host names do not reach the operator’s server. Public-host names are published and stored in the directory described below.
Board, selections, score, last four matched pairs and names at that time, pointers and pins	Host and guest devices for cooperative play and synchronization.	In device memory during play. Not sent to or stored on the operator’s server. A peer can separately record or screenshot shared information; the game cannot prevent that.
Room high score, all participant names at the record, contribution leaders and tiles taken	Host and fellow-player devices, to retain the record across rounds and for late joiners.	In memory while viewing the room, including later rounds and the host-disconnected screen. Cleared when leaving the room or closing the page. Not saved to the operator’s server or localStorage. Later renaming does not rewrite an earlier record.
Room code, p1–p16 seat, random session token, connection time and rate-limit timestamps/counts	Cloudflare Worker / Durable Object for signaling, seat limits and abuse prevention.	Temporarily attached to active WebSocket sessions; discarded by the application on disconnect.
SDP / ICE candidates, which may include IP addresses and ports	Forwarded through Cloudflare to the connected peer to establish WebRTC.	No application database or log records them. They are processed temporarily in transit.
Public room code, host nickname, count/capacity, board dimensions, waiting/playing status, update/expiry times and a private update capability	Cloudflare Worker / Durable Object provides a public room list. Anyone can read the code, host name, counts, dimensions and status. Guest names, IP addresses, tiles, selections and scores are not included.	Recorded only when a host explicitly publishes a room. Refreshed every 30 seconds; hidden 90 seconds after the last update and deleted by cleanup within a further 90 seconds. Deletion is attempted on host departure; the same expiry applies if that fails. Third parties can record public listings. The former random queue has been retired.
TURN usage totals, accounting periods and last check; temporary usernames, room/seat pair and credential expiry	Cloudflare for relay budgets and issuing/revoking credentials.	Credentials last up to ten minutes; reservation records are removed on the next scheduled refresh after expiry, normally within five minutes. The latest weekly/monthly aggregates are overwritten on the next successful accounting update and may remain unchanged while accounting is stopped. It contains no game content.
Sound/music preferences, language and traffic limit	Your device, to remember your settings.	localStorage until changed or cleared. No advertising/tracking cookies or analytics identifiers.
Cleared solo levels, best scores and times, last selected level	Your device, for the 100-level solo progression and records.	localStorage until changed or cleared. Not sent to the operator’s server or other players.
IP address, timestamps, URL, User-Agent, traffic volume and other network metadata	Cloudflare provides delivery, WebSockets, STUN and TURN, and processes metadata for operation, security and abuse/incident response.	The app does not create its own IP/User-Agent access logs; Workers Observability is disabled. Cloudflare’s own processing, logs and retention follow its policies and applicable contracts. This is not a guarantee that no service provider records information.

3. Providers and fellow players

Cloudflare, Inc. (United States) supplies hosting, signaling, STUN and TURN when needed. Information may be processed across its global network, including outside Japan. Access controls, limited-life tokens, encryption and provider management restrict processing to what is needed. See Cloudflare’s privacy policy and Data Processing Addendum. This app cannot independently fix every processing country or provider retention period.

Public-host nicknames and room metadata are visible to everyone. Other nicknames and game information are shared with fellow players; connection information is shared with the host, the relevant guest and Cloudflare. Except where required or permitted by law, personal information is not sold or provided to advertising companies for unrelated purposes. The game does not request camera, microphone or precise location access. Do not put your real name, address or phone number in your nickname.

When TURN is used, encrypted game traffic also passes through Cloudflare. The app server does not decrypt or store that traffic as plaintext boards or nicknames.

X sharing buttons link to the post composer. Room sharing passes an invitation URL including its room code; score sharing passes the score and game URL. Participant names are not added automatically, and nothing is posted automatically. No X embeds, scripts or connections load before you select a sharing link. Posting and X’s processing of connection and account information follow X’s privacy policy. Posting an invitation lets people who see it join that room.

4. Your choices and requests

Leave waiting or play using Back, Leave or by closing the tab. Edit your nickname in the lobby or Settings. Use “Clear saved settings” or your browser’s site-data controls to clear local values. Renaming does not rewrite names already shared in that game’s match history.

Contact fuba using the profile linked above for access, correction, deletion, restriction, notification of purposes, complaints or other privacy requests. We check what information we actually hold, verify identity only as necessary and respond as required by applicable law. We cannot recover server-side game histories that we never held. Contact information and message content in inquiries are used to answer and handle the request, and retained as necessary for handling and legal obligations. Requests for legally required operator details are accepted through the same contact.

5. Security and updates

We use HTTPS/WSS, encrypted WebRTC DataChannels, Origin checks, input/size/rate limits, limited-life connection tokens and restricted access to credentials. We investigate incidents, limit impact, prevent recurrence and make notifications or reports where required. Policy changes appear on this page with an updated date.