Privacy

What bearoff stores about you, who else sees it, and how to make it stop. Last reviewed 4 October 2026.

bearoff is a backgammon game run by one person, not a company. It is paid for by nobody: there are no adverts on it, nothing about you is sold or shared for marketing, and there is no profiling beyond counting visits. The short version of everything below is that we keep what the game needs to work and very little else.

Who is responsible

Christian Brown is the data controller under the UK GDPR for everything on this page. Contact: the contact form, which arrives with "Privacy request" already chosen and reaches a person, not a queue. If you think something here is being done wrongly you can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather hear about it first.

What we store

• Your email address, because it is how you sign in - a code is emailed to it - and how an opponent invites you to a game.
• Your display name, which other players see, and a profile picture if you upload one. Uploads are kept in private storage; the game serves resized copies and never links to the original.
• Your games: the moves, the dice, the results and the running score against each opponent. The move-by-move record of a finished game is not kept forever - see how long things are kept.
• Chat messages you send to an opponent. They are stored in plain text and both of you can read them for as long as the account exists. They are not end-to-end encrypted, and an administrator can read them - to look into something one of you has reported, or to answer a question you have asked us for help with. Every time a conversation is opened that way it is written down: who opened it, whose it was, when, and why. Nobody reads them for any other reason.
• Your settings - colours, language, notification choices, how the board faces - saved on the server so they follow you between devices.
• Notification subscriptions, if you turn on push notifications: a token that identifies the browser or phone to its push service, nothing more.
• Sign-in records: the codes you were sent (briefly) and the sessions that are currently signed in, so you can end them. Neither is kept once it stops working - see how long things are kept.
• Messages you send us through the contact form, and our replies. They are kept so that somebody can answer, and they go when the account does.

Why we may

The law asks us to say which of its reasons covers each of those, so, in its terms:

• To run the game you asked for (a contract with you): your email address, display name and picture, your games, your chat, your settings, your notification subscriptions and your sign-in records. Without these there is no account and no game.
• To keep it safe (our legitimate interest in a service that is not abused): the record of sign-in attempts with the address they came from, the limits on how often anything can be asked for, the logs of requests to our servers, which carry your IP address and are kept for 28 days and then deleted, and the written record of every time an administrator opens something private.
• Because you said yes (consent, which you can withdraw): counting your visit with Google Analytics, sending push notifications to a device, and emailing someone you have invited. Say no on the analytics bar, turn notifications off in settings, or simply do not invite anyone, and that processing does not happen.

How long things are kept

Most of what is listed above is kept for as long as the account exists, because the game needs it to work: your address signs you in, your settings follow you around, your results are half of somebody else's score. Two things are deliberately not.

The move-by-move history of a finished game - every roll and every checker moved - is kept for the three most recent finished games against each opponent, and for at least two days after any game ends. After that it is deleted, in a sweep that runs on a schedule rather than the moment a game becomes the fourth, so in practice games sit a little past the limit before they go. Older games keep their result, their date and their effect on the score; only the replay of how they were played is removed. Games still in progress are never touched, however long they take.

The reason is that a move history is a great deal of data about a person that nobody, themselves included, ever looks at again - and keeping data after it has stopped being useful is the thing we should not be doing. It also keeps the copy of your data you can download small enough to actually read. A game whose moves have gone says so in that download, so you can tell deletion from loss.

The credentials behind signing in are deleted a week after they stop working. A four-character code stops working fifteen minutes after we email it, used or not, and so does the sign-in link sent beside it; the links in notification emails that take you straight to a game last seven days. A session stops when you sign out on that device, and otherwise a year after you last used it - and because at most five devices stay signed in at once, signing in on a sixth ends the one you had gone longest without using. A notification registration stops when you turn notifications off on that device, or when its browser or phone tells us the subscription is gone. A week after any of those, the record itself is deleted rather than kept as something that no longer works.

So signing out on a device really does remove it, rather than only switching it off, and a code emailed to you last month is no longer on file next to the address it went to. Nothing still working is ever touched: a session on a laptop you have not opened for eleven months still signs you in, and this deletes only things that have already stopped being able to do anything.

If someone invites you and you have no account

A player can invite an email address that has never used bearoff, and we send that address one email. We record that we did so - the address, and who invited it - for one reason: to guarantee we never send it a second one. That record is kept even after you unsubscribe, because deleting it is what would let the emails start again.

Every such email carries an unsubscribe link that needs no account and no sign-in. It offers both stopping the invitations and blocking the address from ever receiving anything from us again.

Who else sees anything

Your browser is made to contact these while you use bearoff - both the game and these pages, this one included. They are the complete list; a test in the codebase fails the build if a new one is added without appearing here.

Beyond the browser, the game runs on Google Cloud in Belgium and its database and backups are on Google Cloud in London; sign-in and notification emails are sent through Resend, an email service in the United States. Both can necessarily see the data they carry, and both handle it under their data-processing terms. Where data leaves the UK, as it does for Resend, it goes under the safeguards the UK GDPR requires for that: the standard contractual clauses and the UK's addendum to them. Every request to bearoff also passes through Google Cloud's edge, which sees your IP address and uses it to keep out attacks and to limit how fast any one address can ask for things; the logs of those requests are kept for 28 days and then deleted.

Cookies

bearoff sets one cookie of its own, called bearoff_consent. It remembers whether you said yes or no to Google Analytics when the bar along the bottom asked, holds nothing but that answer, and lasts six months. It is written for bearoff.app and play.bearoff.app together, so you are asked once rather than on each. Your sign-in is kept in your browser's local storage instead, which is not sent to anyone.

Google Analytics runs, and sets its own cookies (see the list above), only after you have said yes. Say no and nothing from Google loads at all. To change your mind, clear the cookie in your browser and the bar will ask again; a browser or extension that blocks analytics will not affect the game in any way.

Closing your account

There is a button for it in settings, and it takes effect immediately rather than raising a request with anybody. When you press it:

• Any game still in progress is resigned, so opponents waiting on you are not left stuck.
• Your email address and display name are overwritten, your profile picture is deleted, and any Google or Apple sign-in link is removed - so signing in with that provider cannot resurrect the account. The sign-in codes we had emailed to that address are deleted outright at the same moment, rather than waiting for the usual week, so no copy of the address is left behind.
• Every signed-in session and notification subscription is ended.
• You appear to former opponents as "Deleted player".

Finished games and the messages in them are not deleted at that point, and this is deliberate: they belong to your opponent as much as to you, and erasing them would rewrite their history and their score. Once the other player has also closed their account, everything the two of you shared - the games, the messages, the score - is deleted outright.

If you want more than that, write in and we will do it by hand.

Taking a copy of your data

There is a second button in settings, beside the one that closes the account: Download my data. It gives you a zip holding everything listed further up this page - your account and your settings, every game with its moves and its dice, both sides of every conversation, who you have played and who you have invited. Nothing is prepared in the background and emailed to you later: it is built as you download it, so what you get is what is held at that moment. It can be downloaded once a day, because building it reads every turn of every game you have played.

Inside are plain JSON files, one for each kind of record - account.json, games.json, turns.json, chat.json and so on - which refer to each other by id rather than repeating themselves. Any text editor will open them.

Two things are deliberately left out. The sign-in token behind each session and the push token behind each device are not in it, because a copy of this archive going astray should not also be a way into the account - the sessions and devices themselves are listed, and logging out ends a session as switching off push notifications ends a device. Your profile picture is in there too, exactly as you uploaded it.

Children

bearoff is not aimed at children and asks for no age. It is a backgammon board; there is nothing on it directed at children, and no advertising.

Changes

If this page changes in a way that matters, the date at the top changes with it. There is no archive of previous versions - this is a small game, not a bank.

Getting in touch

Questions about any of this, or a request to see or delete what is held about you: use the contact form, which arrives with "Privacy request" already chosen. It reaches a person, not a queue.