OUT3 privacy notice
This notice describes what the OUT3 web application actually does. It covers the technical facts of how the game works; it is not a complete legal policy for every jurisdiction, and formal legal review is still pending for some items noted below.
Account and identity
OUT3 does not use email/password accounts on the web. When you enter Multiplayer, the app generates a random guest credential and stores it in your browser's local storage, along with the display name you choose. That credential is sent to our authentication service (Nakama) to create or resume your guest session; it is not linked to an email address, phone number, or real-world identity.
What is stored, and where
- In your browser (local storage): your guest credential, your chosen display name, and simple preferences — reduced-motion setting, whether you have seen this privacy notice, and your tutorial/onboarding progress. None of this is sent anywhere except your own guest credential and display name, which are sent to our authentication service to sign you in.
- One cookie: the Practice (single-player) mode uses one short-lived, `HttpOnly`, `Secure`, `SameSite=Strict` session cookie so the server can track your in-progress practice match. It is not readable by page scripts and is not used for tracking across sites.
- On our servers: your guest account record, your display name, and the state of matches you play (cards drawn and played, resources, turn history) while a match is in progress or recently finished, so the game can be authoritative and so you and your opponent see a consistent, correct game state. Server logs record operational events (errors, connection issues) using a one-way pseudonymized identifier, not your guest credential or display name, in the normal case.
Optional gameplay analytics
OUT3 can collect gameplay usage statistics (Google Analytics) to understand which screens are reached, whether matches finish, and where errors occur. This is off by default: nothing loads and no data is sent until you explicitly choose "Yes, share gameplay analytics" on the first-run screen or in Settings, and you can change this choice at any time. If enabled, Google Analytics sets its own cookies (named _ga and _ga_*) in your browser to recognize repeat visits; these are cleared when you turn analytics back off. The events we send carry only the screen/action, the game mode, whether a match was won/lost/drawn, a coarse match-length bucket, and a generic error code — never your display name, guest credential, hand or deck contents, or any other player's data. Analytics data is not anonymous in the strict technical sense (the cookie above is a persistent identifier), so we do not describe it that way; "usage statistics" is the accurate description.
What we do not do
We do not load advertising or third-party tracking scripts of any other kind, and gameplay analytics (above) never loads before you explicitly accept it. We do not sell or share your data with advertisers, because we do not collect data for that purpose in the first place.
Connections
All traffic between your browser and OUT3 (the site, and the game's realtime connection) is encrypted (HTTPS/WSS). Requests for the site and game data go only to OUT3's own servers.
Other players
Your opponent sees your display name and the parts of the game state a real player is normally allowed to see (for example, your face-up cards and public board). Your hand and hidden information are never sent to your opponent's browser.
Deleting your data
Our backend supports a data-deletion request mechanism for guest accounts. Because guest accounts have no email of their own, deletion requests are handled through the support contact below rather than a self-service button in the app today. See Support for how to reach us and what to include. We do not currently publish a fixed data-retention period; if you need to know how long a specific type of data is kept, ask us.
Children
OUT3 does not knowingly collect personal information from anyone, and does not ask for age, name, email, or other personal details to play as a guest.
Contact
Questions about this notice or your data: mailto:dynastydomination2026@gmail.com.
Status of this notice
This is an initial, minimal notice describing the technical reality of the current web release. It does not yet state a governing legal entity, business address, or jurisdiction, and does not claim compliance with any specific privacy law (for example GDPR or CCPA) — those determinations require owner and legal review and are tracked separately, not asserted here.