Privacy Policy

Last updated: 3 October 2026

BridgeABC is a small, free place to play bridge. It carries no advertising, no analytics and no third-party trackers, and it asks for no personal details — not even an email address. This page explains exactly what is stored and how to get rid of it.

Who is responsible

The controller for the data described here is Willem Mevius, who runs BridgeABC as a personal project. For anything on this page — questions, access requests, deletion requests — write to privacy@sudokuchaos.com.

What is stored, and why

Your account

An account is needed to play, because the other people at your table have to be able to tell who is who. We store:

• Your chosen name. This is the only identifier we hold. It is shown to the other players at your table and publicly on the daily and weekly leaderboards, so please don't use your real name if you'd rather not be identifiable.
• Your password, stored only as a salted PBKDF2-SHA256 hash. It cannot be read back, by us or by anyone who obtained a copy of the database.

We do not collect an email address, a real name, a date of birth, a profile, or anything else. We do not know who you are.

Your play

• Daily-problem results — your score on each day's problem, which is what the daily and weekly leaderboards are built from.
• Vugraph scores — your result on each board you play from an imported match, so you can compare it with the original table.
• Live tables and team matches — while a game is running, your name is attached to your seat so the table can be shown to the other players. These records are short-lived and disappear on their own once the game is over.

Stored in your browser, not on our server

The site uses your browser's local storage — not cookies — to hold a single value, bridge_auth_token, which keeps you signed in. It is set only when you log in, is never used to track or profile you, and is removed when you log out. You can also delete it at any time by clearing site data in your browser.

Cookies

This site sets no cookies. Because we use no non-essential cookies or storage, there is no consent banner to click.

Server logs and visitor counting

Our hosting provider processes the technical information every web request carries, including your IP address, so that the service can run and be protected from abuse. We do not build our own logs of visitors, and we do not combine this with your account.

To see whether anyone uses the site at all, we keep one aggregate number per day: how many different browsers loaded a page. It is counted from a one-way code that changes every day, so it cannot identify you, cannot be followed from one day to the next, and is never combined with your account. No cookie or browser storage is involved; only the daily totals are kept, and the counters are deleted after about three months.

Legal basis

Where the GDPR applies, we rely on:

• Performance of a contract (art. 6(1)(b)) for your account, sign-in, and the games and leaderboards you signed up for.
• Legitimate interests (art. 6(1)(f)) for keeping the service running, secure and free of abuse.

How long it is kept

• Your account: until you delete it.
• Daily results and leaderboard entries: about 60 days, after which they expire automatically.
• Vugraph scores: as long as the imported match is kept, up to a year.
• Team matches: they drop off the list 24 hours after they are created.
• Sign-in sessions: they expire 90 days after you last used them, and immediately when you log out.

Who else can see it

Other players see your name — at your table, in the lobby's table list, and on the leaderboards. Beyond that, nobody buys, receives or licenses this data. It is never used for advertising and never sold. Two suppliers process it on our behalf, under their standard data-processing terms:

• Fly.io — hosting. The application and database run in Fly's Paris (France) region.
• Upstash / Fly Redis — the database that holds accounts and results.

These suppliers are US-headquartered companies serving the data from the EU; their processing agreements include the European Commission's Standard Contractual Clauses to cover any transfer outside the EEA.

Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. In practice:

• Erasure is self-service. Log in, click your name in the lobby, and choose "Delete my account". That removes your account, every device you're signed in on, your daily results and leaderboard entries, and your vugraph scores. It is immediate and cannot be undone.
• For anything else, email privacy@sudokuchaos.com and we will respond within one month. Because we hold no email address, we can only answer requests from someone who can log in to the account concerned.

If you think we've handled your data badly, you can complain to a data protection authority — either the one in your own country, or ours, the French CNIL.

Children

Bridge suits every age, but if you are under 16, please ask a parent or guardian before creating an account.

Changes

If this policy changes, the new version appears here with a new date at the top. There is no mailing list to notify, since we hold no addresses.