Privacy Policy

Last updated: 2026-07-04

This Privacy Policy explains what personal data the 1vs1 platform and its games (currently SYNAPSE) — the “Service”, hosted at 1vs1.games (and 1vs1.pi) — collects, why we collect it, how long we keep it, and the choices and rights you have. We aim to collect only what is needed to run the game, keep it fair, and keep it secure. This document describes exactly what the application actually collects — nothing more.

1.Who we are (Data Controller)

The data controller responsible for your personal data is: Stefan Ćirović (individual / sole operator), Republic of Serbia. For any privacy-related question or request, you can contact us at [email protected].

2.Data we collect

We collect the following categories of data, and only these:

2.1 Account data

Accounts are managed through Supabase Auth. Depending on how you sign up, we process:

• Email & password sign-up: your email address, your chosen username, and a password. Your password is never stored in plain text — Supabase stores it as a salted hash.
• “Login with Google” (Google OAuth): your email address and basic Google profile information returned by Google during sign-in. We do not receive your Google password.

2.2 Game data

• Your bot-IQ and PvP-IQ (Elo) ratings/scores.
• The list of game modes you have learned/unlocked.
• Your chosen avatar (an emoji selected from a fixed list), shown to other players.

2.3 Telemetry / event logs

To diagnose bugs, prevent cheating, and improve gameplay balance, we record technical event logs in a database table named client_logs. Each log entry may include:

• your user_id and username;
• event type, level (e.g. info/warning/error) and message;
• event metadata, which may include your last ~12 UI steps/navigation and per-round gameplay details: solving times, the answer option you chose, whether it was correct, the time until your first interaction with the board, and the puzzle’s generation parameters (rule, board size, random seed) — for bot duels, training sessions and PvP matches (for PvP matches, the puzzle rule and seed are never included in these logs);
• application version;
• your user-agent (browser and device information).

Retention: telemetry logs are kept for 30 days and then deleted.

Some diagnostic entries belonging to other players may include your username (for example, as the opponent of a match). If you delete your account, such entries in other players' logs are not erased immediately, but are removed within the 30-day telemetry retention window.

2.4 Feedback

If you send feedback through the app, we store:

• the title and message text you wrote;
• the interface language and the screen you were on;
• the last few navigation steps (screen names only) to help us reproduce the issue;
• your user-agent.

Retention: resolved feedback is kept for up to 180 days; unresolved feedback is kept until we have processed it.

2.5 Match data (PvP)

For player-vs-player play we temporarily store matchmaking pairings (who was matched against whom) and match results. Match records themselves are deleted approximately 7 days after the match ends. Longer-lived per-round statistics derived from matches are described in section 2.5b below.

2.5b Per-round gameplay telemetry

We record your moves for statistics and to improve the game. For each round of a PvP match we store a per-round record in a database table named match_rounds, containing:

• the round outcome: the answer option each player chose, whether it was correct, and who won the round;
• timing signals: the server-measured solving time (authoritative), the time reported by your device, and the time until your first interaction with the board (an anti-cheat and analytics signal);
• the puzzle’s generation parameters (rule, board size, colours, difficulty pool, random seed) so the puzzle can be reproduced for balancing and fairness analysis;
• your user_id (and your opponent’s), match and round identifiers.

Purpose: game balancing, difficulty calibration, fair puzzle generation, and cheating prevention. These records are never shown to other players and are not readable from the game client.

Retention: per-round records are kept for up to 24 months, then deleted. If you delete your account, the link between these records and your identity is irreversibly removed (the records remain only in anonymous form, no longer connected to you).

2.6 Friends & challenges

If you add friends, we store the friendship link between your account and theirs, and the friend requests and match challenges you send or receive (sender, recipient, selected modes, status, timestamps). This is used solely to operate the friends and challenge features. Friendships are kept until you remove the friend or delete your account; requests and challenges are transient records.

2.7 Server-side data (IP addresses)

When you connect to the Service, your IP address is processed by our infrastructure providers — Cloudflare (hosting / CDN) and Supabase (backend) — for the purpose of operating the Service and protecting it (security, abuse and fraud prevention, network routing). We do not use IP addresses for advertising.

3.Why we use your data (purposes & legal bases)

4.Third parties & sub-processors

We rely on the following service providers, who process data on our behalf or as part of delivering the Service:

5.International data transfers

We host the backend in the EU region. However, some of our providers (e.g. Google, Cloudflare, jsDelivr) operate globally, so your data — including your IP address — may be processed in countries outside your own, including outside the European Economic Area. Where such transfers occur, we rely on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses (SCC) and the relevant providers’ data processing terms.

6.Cookies, local storage & tracking

We do not use advertising or third-party tracking cookies. We use the browser’s localStorage and sessionStorage strictly for functional purposes:

• remembering your language choice;
• a “gate” flag (entry/age acknowledgement state);
• your Supabase authentication session token (so you stay logged in);
• a session-count flag (basic session bookkeeping).

These functional items are necessary for the app to work and are not used to profile you or to serve ads.

7.Data retention summary

8.Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Rectify / correct your data — for example, you can change your username in Settings;
• Delete your account — in the app go to Settings → Delete account. This permanently deletes your account and the associated data;
• Object to certain processing based on legitimate interests.

To exercise any of these rights, or if you have questions, contact us at [email protected]. You may also have the right to lodge a complaint with your local data protection authority.

9.Children’s privacy / age

The Service is intended for users who are at least 13 years old. If you are in the EU/EEA or another country with a higher minimum digital-consent age (for example 16 in parts of the EU, or 15 in Serbia), you must meet that higher age. It is not directed at children under that age, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it.

10.Payments & advertising

There are currently no payments and no advertising in the Service. If paid features are introduced in the future (for example via Stripe or Pi), this Policy will be updated accordingly before such processing begins.

11.Security

We use reputable providers and reasonable technical and organizational measures to protect your data (for example hashed passwords, encrypted connections, and access controls). No method of transmission or storage is 100% secure, but we work to keep your data safe.

12.Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the Service where appropriate.

13.Contact

Privacy contact: [email protected]
Data controller: Stefan Ćirović (individual / sole operator), Republic of Serbia