1. Information We Collect

Account data: when you register we collect your username, email address, and a hashed version of your password.

Profile data: avatar URL and biography that you optionally provide.

Usage data: game participation history, match results, and in-game statistics.

Technical data: IP address, browser type, and session information collected automatically when you use the platform.

2. How We Use Your Information

To operate and improve the platform, including matchmaking, leaderboards, and game history.

To communicate with you — account verification emails, important service notices, and (where you have opted in) product updates.

To ensure platform security and prevent abuse.

3. Data Storage and Retention

Account and profile data is stored in a PostgreSQL database hosted on a private server. Active session tokens are stored in Redis with a 7-day expiry.

We retain your account data for as long as your account exists. If you delete your account, personal data is removed within 30 days, except where retention is required by law.

4. Sharing of Data

We do not sell your personal data. We may share it with third-party service providers that help us operate the platform (e.g. email delivery via Resend, log aggregation via Betterstack). These providers are contractually bound to handle your data securely and only for the purposes we specify.

5. Your Rights

You have the right to access, correct, or delete the personal data we hold about you.

You may also request a copy of your data or object to certain processing. To exercise any of these rights, contact us at legal@night-room.com.

6. Security

We implement appropriate technical and organisational measures to protect your data, including password hashing (bcrypt), httpOnly cookies for session tokens, HTTPS-only communication, and HTTP security headers (HSTS, CSP, X-Frame-Options).

7. Children's Privacy

The platform is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this policy periodically. We will notify registered users by email of material changes. Continued use of the platform after the effective date constitutes acceptance.