Privacy Policy

1. Controller and contact

MyTurnYet is responsible for deciding how personal data is processed for the service. Contact us at privacy@contact.myturnyet.com for privacy requests, account deletion, access requests, correction requests, or questions about this policy. For legal notices use legal@contact.myturnyet.com.

2. Data we collect

• Account data: username, display name, email address, country/language/time-zone preferences, role, account status, and authentication methods.
• Authentication data: password hashes, session records, password reset tokens, Google account identifiers, Google-provided email/name/profile data, and passkey public credential records.
• Gameplay data: tables, seats, moves, orders, scores, ratings, tournament entries, replacements, NMR/civil-disorder history, table history, and moderation-relevant table events.
• Community data: forum posts, thread activity, friend relationships, private and table chat messages, reports, moderation notes, and support correspondence.
• Technical and security data: IP-derived security signals, device/browser information, request logs, session cookies, rate limits, error logs, WebSocket presence, and anti-abuse signals.
• Notification and email data: email delivery status, web-push subscriptions, device notification preferences, and transactional messages.
• Analytics data: production site analytics such as page views and basic device/browser signals. Analytics are used to understand whether the site works and which pages need improvement.

3. Why we use data and legal bases

We process most account, table, game, message, and support data because it is necessary to provide the MyTurnYet service and enforce the agreement with you. We process security logs, anti-abuse signals, moderation records, fraud prevention data, and service diagnostics for our legitimate interests in keeping the service reliable, fair, and safe. We process some records where necessary to comply with legal obligations. Optional communications, browser notifications, and non-essential analytics or cookies are based on consent where consent is required.

We try to collect only data that is connected to a clear purpose: account operation, authentication, gameplay, community features, fair-play enforcement, security, support, analytics, or legal compliance.

4. Google sign-in data

If you sign in with Google, Google provides MyTurnYet with a stable Google account identifier and selected profile information such as your email address, email verification status, and name. We use that data only to create, link, and authenticate your MyTurnYet account, prevent duplicate or unsafe account linking, and show your account identity in the service.

We do not request Google Drive, Calendar, Contacts, Gmail, or other Google API scopes for ordinary sign-in. We do not sell Google user data. We do not disclose Google user data except to infrastructure and support providers needed to operate MyTurnYet, or where required by law or security needs. You can stop using Google sign-in by contacting support or by using account settings when the connected-account controls are available.

5. Passkeys

Passkeys let you sign in using a browser, operating system, password manager, security key, or device authenticator. MyTurnYet stores the public credential information and credential identifier needed to verify passkey login. We do not receive or store your fingerprint, face scan, device unlock PIN, or other biometric secret. Those remain with your device or passkey provider.

Passkey records are used to authenticate your account, prevent credential reuse on other accounts, and update credential usage metadata such as last-used time and signature-counter state where supported.

6. Cookies, local storage, and analytics

MyTurnYet uses essential cookies and browser storage for login sessions, CSRF/security protections, language and time-zone preferences, passkey ceremonies, table invitations, and normal operation. These are necessary for the service you request.

Anonymous LexiTurn play can use a recovery cookie for up to 30 days. The server stores its hash and links to eligible runs so the same browser can reopen them after a restart. It does not create an account or grant access to account-owned games. Clearing the cookie can end anonymous recovery. See the Cookie Policy for details.

The Fly.io production site may load Cloudflare Web Analytics. If a future analytics, advertising, or tracking feature requires consent under EU or Swedish rules, it should not be activated until consent controls are in place. Browser push notifications are optional and only work after you grant browser permission.

7. Sharing and processors

We share data only where needed to run the service, protect users, comply with law, or follow your instructions. Current or expected service providers include hosting and storage providers such as Fly.io, security and analytics providers such as Cloudflare, email providers such as Resend, Google for Google sign-in, browser and platform passkey providers, and future support or moderation tooling.

Some providers may process data outside Sweden or the EU/EEA. When that happens, we rely on appropriate transfer mechanisms where required, such as EU adequacy decisions, standard contractual clauses, provider data-processing terms, or another lawful transfer mechanism.

8. Retention

• Account records are kept while the account exists. If an account is deleted, we delete data that is not needed and depersonalize records that must remain for table history, ratings, standings, moderation, legal, or security reasons.
• Completed tables, ratings, tournament results, moves, replacement history, and table history may remain as part of the permanent table record, but deleted users should be shown publicly as deleted or depersonalized where possible.
• Forum posts, chat messages, and moderation records are kept while needed for community context, user safety, dispute handling, and abuse prevention. Deletion requests are assessed against those needs and legal obligations.
• Security logs, anti-abuse signals, and operational logs are normally kept only as long as needed for security, debugging, fraud prevention, and legal compliance. Longer retention may apply during investigations.
• Backups are kept for operational recovery and are overwritten or deleted according to backup procedures. A backup may temporarily contain data that has since been deleted from the live service.

9. Your rights

Depending on the situation, you can request access to your personal data, correction of inaccurate data, deletion, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent where processing is based on consent. Send requests to privacy@contact.myturnyet.com. We may need to verify your identity before acting on a request.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy@imy.se, Box 8114, 104 20 Stockholm, Sweden.

10. Children

MyTurnYet is not aimed at children under 16. If you are below the age at which you can consent to data processing in your country, use MyTurnYet only with approval from a parent or guardian. If we learn that we have collected personal data from a child without required consent, we will take reasonable steps to delete or restrict that data.

11. Changes

We may update this policy when the service, providers, legal requirements, or data practices change. Material changes will be posted on this page and, where appropriate, announced in the service or by email.