This policy explains what personal data CueMasters ("we") collects when you use the website and the game, why we use it, who else receives it, how long we keep it and what rights you have. It applies to the website, the game and the emails we send.
Who is responsible
CueMasters is the controller of your personal data: we decide what it is used for and are responsible for it. For any question about your data, write to [email protected] or use the contact form on the website.
Account data
When you create an account we store your player name, email address and password (as a one-way hash, never in readable form), your language, your newsletter choice and, if you turn it on, your two-factor authentication keys and recovery codes. If you buy or upload a profile picture, we store the picture.
We also keep technical data about the browsers and connections your account is used from, for security, fair play and the country flag shown next to your name.
Game data
When you play, we store your ranking points, wins and losses, achievements, the cues you own and use, boosts, your friends list and friend requests, and every online match you finish: the rules, the players, the score, the points it earned, per-match statistics and a record of the shots, which lets the match be replayed by anyone.
Without an account you play as a guest. The game keeps a random device token in your browser so the same guest comes back, and stores the guest's record in the same way.
What you write in chat is sent to the other players in the lobby or at the table and kept for 90 days so our staff can look into reports; it is then deleted. Reports you make or that are made about you are kept with the decision taken. Some chat lines are also read by automatic filters.
Emails, forms and the newsletter
We email you to confirm your address, reset your password, send receipts, warn you about security events and tell you about significant changes to the terms. These messages are part of the service and cannot be switched off while you have an account.
The newsletter is sent only if you subscribe, on the website or at registration. We record when and from where you subscribed, and newsletters count whether they were opened and which links were followed, so we can see what readers find useful. Every newsletter has an unsubscribe link, and unsubscribing ends the counting too.
A message sent through the contact form reaches us by email together with the name and address you gave, and is kept in our mailbox as long as it is needed to answer you.
Why we use it and on what basis
To provide the service you asked for: your account, matches, rankings, friends, replays and purchases (performance of a contract).
To keep the service safe and fair: we use technical and game data, including chat, to protect accounts, stop cheating, spam and abuse, enforce the terms and answer disputes (our legitimate interest in a safe service, which we balance against your interests).
To meet legal duties: we keep purchase records for as long as accounting and tax law requires (legal obligation).
With your consent: the newsletter, and the marketing cookies described in the cookie policy. You can withdraw a consent at any time; what was done before stays lawful.
Some decisions are automated: chat and name filters stop links, contacts, advertisements and swearing, and a match that looks unfair earns no ranking points. These decisions only limit chat for a short time or withhold the points of a single match; any lasting sanction is taken by a person, and you can contest every decision by writing to [email protected].
Visit statistics and ads
To see how the site and the game are used, we count page views and events such as "started a match" with a tool that runs on our own server. It sets no cookies and keeps nothing that identifies you, only anonymous totals (legitimate interest).
To see whether our ads work, we may load an advertising partner's pixel. It runs only if you accept marketing cookies (consent); the partner then receives information about your visit, such as the pages you open, and handles it under its own privacy policy. You can withdraw your consent at any time through "Cookie settings" at the bottom of every page.
Where your data goes
Some of these providers process data outside the European Economic Area, under the safeguards the law requires, so that your data keeps the same protection.
How we protect it
Connections to the website and the game are encrypted, passwords are stored as one-way hashes, two-factor authentication is available to every account, payment details never pass through our systems, and access to personal data is limited to the staff who need it for support and moderation, under confidentiality. No system is perfectly secure; if a breach puts your data at risk, we tell you and the supervisory authority as the law requires.
How long we keep it
Account and game data stay for as long as your account exists. When you delete your account, your personal data is deleted at once; the results of matches you took part in remain without your name, so other players' records stay complete. Chat lines are deleted after 90 days. Purchase records are kept for as long as accounting and tax law requires, with the personal data limited to what those records need. Technical data about browsers and connections is kept for a limited time and then deleted. Guest accounts that have not played for a long time may be removed, and newsletter consent records are kept for as long as we have to be able to show that you subscribed.
Your rights
You can see and correct your data in your account settings, download everything we keep about you as a file, and delete your account there too. You also have the right to ask us for access to your data, to have it corrected or deleted, to restrict how we use it, to receive it in a portable form, to object to processing based on our legitimate interest, and to withdraw a consent you gave. Write to [email protected]; we answer within one month.
If you think we handle your data unlawfully, you can complain to the data protection authority of the country where you live.
Children
An account is for people of at least 14 years of age. Where the law of your country sets a higher age for agreeing to the use of your data online, a parent or guardian must agree for you. We do not knowingly keep data of younger children; if you think a child has created an account, write to [email protected] and we will delete it.
Changes
We update this policy when the service or the law changes. The date at the top shows the current version, and we tell registered players by email about significant changes before they apply.