Privacy Policy

Last updated October 25, 2026

Ninety-Eight ("we", "us") is a small online card game at play98.app, run by an individual in Ontario, Canada. This policy explains what we collect when you play, why, who we share it with, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The short version

You can play as a guest without an account. Accounts are needed to host rooms and to subscribe to Pro.
We keep the minimum needed to run the game: your account email, display name, plan, and basic usage counts.
Game chat isn't stored. It lives only in the game server's memory while the room is open, unless someone reports a message.
Voice chat goes directly between players' browsers and is never recorded.
We don't sell your information, show ads, or use tracking cookies. Our visit counts are cookieless.

What we collect

If you have an account

Account details: your email address, the display name you choose, and how you sign in (email and password, a magic link, Google or Apple). Passwords are handled by our sign-in provider and we never see them.
Plan and billing status: whether you have Pro, when it renews, and a customer reference from Stripe. Card details go directly to Stripe; we never receive or store them.
Usage counts: how many AI chat messages tables you host have used this month, so we can apply the fair-use limit.
Saved AI players: up to five custom AI personalities you choose to save (a name and a short description).
Profile picture: the avatar you pick, or, with Pro, a photo you upload. Photos are cropped and shrunk to 256 x 256 pixels on your device before upload (which also removes location data stored in the photo), kept in our Supabase storage, and shown to people you play with. Choosing another picture deletes the old photo.

When you play

Game and chat: the name you enter, your moves, and chat messages. These are held in the game server's memory only while the room exists, then discarded.
Game statistics: when a game ends we record its start and end time, number of players and AI players, the result, cards left, the room's plan, and the host's account reference. No names or chat are included.
Reports: if someone reports a chat message, we keep a copy of that message, a few messages around it for context, the names involved, the reason given, and the account references of the sender and reporter if they were signed in.
Voice chat: audio travels directly between players' browsers using WebRTC and is encrypted. When a direct connection isn't possible, it's relayed through Cloudflare, still encrypted. We don't record or store voice.
Technical logs: our hosting provider keeps short-lived server logs (such as errors and IP addresses) for security and troubleshooting.

Cookies, local storage and permissions

We don't use advertising or tracking cookies, and the game's fonts and code are served from our own server.

Analytics: we use Umami, a privacy-focused analytics service, to count visits and a few in-game actions (such as games started, rooms created, and people opening or starting Pro) so we can improve the game. Umami doesn't use cookies, doesn't build a profile of you, and doesn't track you across other sites; we never send it names, email addresses or chat. If your browser's "Do Not Track" setting is on, we don't count you at all.

To work, the game saves a few things in your browser's local storage, on your own device:

Your sign-in session, if you have an account, so you stay signed in.
Your seat in the current room, so a refresh or dropped connection puts you back in your game.
Your preferences: name, theme, sound and voice volumes, and chat settings.
A random device ID, so when a host removes someone from their room, that person can't rejoin it.

These are strictly necessary for the game or remember choices you made, aren't used to track you on other sites, and are cleared if you clear your browser's site data. When you subscribe to Pro, Stripe's checkout and billing pages (on stripe.com) set their own cookies for payment security; see Stripe's privacy policy.

Microphone: the game only asks for microphone access when you choose to join voice chat, and your browser asks for your permission first. You can withdraw it any time in your browser settings. We don't use your camera or location.

AI players

When a Pro table has AI players, recent game chat, the AI player's personality, and a description of the game state are sent to Anthropic's Claude API to write the AI player's lines and, for custom personalities, to set how it plays. Anthropic processes this to provide the service and, under its commercial terms, does not use it to train its models. Please don't share personal information in game chat.

Who we share it with

We use a few service providers to run the game. They only process information on our behalf:

Railway: hosts the game server.
Supabase: sign-in and our database (accounts, saved players, game statistics, reports).
Stripe: payments for Pro.
Anthropic: AI player chat, as described above.
Cloudflare: relays voice chat when a direct connection isn't possible.
Umami: cookieless, privacy-focused visit and event counts.
Google and Apple: only if you choose to sign in with them.

Some of these providers store or process information outside Canada, including in the United States, where it may be accessible to local authorities under their laws. We may also disclose information if required by law, or to protect players' safety.

How long we keep it

Account information: while your account exists. If you ask us to delete your account, we delete it and its saved players.
Game chat: only while the room is open.
Game statistics: kept to understand how the game is used. They contain no names or chat, and the link to your account is removed when your account is deleted.
Reports: kept while they're reviewed and for as long as needed to keep the game safe, such as to enforce a ban.
Billing records: kept by Stripe as required for tax and accounting.

Your choices and rights

You can see and change your email and display name on the Account page, and manage or cancel Pro through the billing portal. You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account, by emailing support@play98.app. If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

Children

Ninety-Eight isn't intended for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has given us personal information, contact us and we'll delete it.

Security

Connections to the game are encrypted, database access is restricted to the game server, and we keep what we collect to a minimum. No system is perfectly secure, so please use a unique password.

Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll let account holders know in the game or by email.

Contact

Questions or requests: support@play98.app.