Privacy Policy

Last updated: 12 August 2026

The short version: you can play the whole game without giving us anything at all. There is no advertising, no tracking, and nothing is ever sold.

No account needed to play. Every part of the card game works anonymously. An account is only required to take part in the weekly challenge or to join a group of friends — because a result on a shared leaderboard has to belong to someone.

Who is responsible

Beleaguered Castle is a small, non-commercial game run by an individual, not a company. For the purposes of UK GDPR, the data controller is the site's owner, contactable at jcmorgan2@gmail.com.

If you play without an account

We do not collect anything that identifies you. Two things happen:

Your game is saved on your own device, in your browser's local storage — your statistics, sound preference, and which weekly challenge you have played. This never leaves your device and we cannot read it.
Three anonymous counters are increased: total players, total games and total shares. These are plain numbers with nothing attached to them. They tell us whether anyone is enjoying the game; they cannot be traced back to a person.

There are no advertising cookies, no analytics service, no tracking pixels and no third-party profiling of any kind.

If you create an account

Accounts are handled by Firebase Authentication, a Google service. We collect:

What	Why
Email address	To identify your account, let you reset a password, and send group invitations or weekly results if you want them
Display name	Shown to other players on your group's leaderboard
Password	Only if you choose email sign-in. It is hashed and stored by Google — we never see, store or transmit your password
Weekly results	Your time and number of moves, so a leaderboard can be built
Game statistics	Games played, wins, streaks and best times
Group membership	Which groups you belong to

If you sign in with Google

We receive your email address, your name and your Google account identifier. We do not receive your Google password and we ask for no other access to your Google account — not your contacts, not your files, nothing else.

What other players can see

This is worth being clear about, because it is the one place your information is shown to others. Any signed-in player can see:

Your display name, and your time and moves for a weekly challenge
Your game statistics — wins, streaks and personal bests — if they tap your name on a leaderboard

Your email address is never shown to other players, including the people in your groups. If you would rather not be recognisable, use a display name that is not your real name; you can change it at any time in your account settings.

Emails we send

Group invitations. When you invite a friend, we send one email to the address you type. That address is used for that single message and is not stored, reused or added to any list. If your friend ignores it, they will not hear from us again.
Weekly results. If you are in a group you may receive a summary of how the week finished. You can turn this off in your account settings at any time.
Account emails such as password resets and email verification, sent by Firebase.

We never send marketing email and we do not sell, rent or share email addresses with anyone.

Who processes your data

Service	What it handles
Google Firebase Authentication, Firestore, Realtime Database, Hosting	Accounts, passwords, game data, leaderboards, anonymous counters, and serving this website
Zoho ZeptoMail (EU)	Delivering invitation and results emails
Google Apps Script	Sending those emails on request, and a weekly total of the anonymous counters to the site owner
Google Fonts	Supplying the typefaces used on these pages. Loading a font sends your IP address to Google, as it would on any site using this service

Where your data is stored

Your account, game results and groups are stored in Google Cloud Firestore in the European Union (multi-region eur3).
The three anonymous counters are stored in a Google database in the United States. These hold no personal data at all — just three running totals.
Google and Zoho are large providers who may process data in other countries under standard legal safeguards.

How long we keep it

Your account data is kept until you delete your account. Delete it and your profile, statistics, weekly results and group memberships are removed. The anonymous counters are simply numbers and are kept indefinitely, because there is nothing personal in them to remove.

Deleting your account

In the game, open the 👤 account button → Delete account. You will be asked for your password to confirm. This removes your profile, your statistics, your weekly results and your group memberships, and closes your sign-in. It cannot be undone.

If you signed in with Google and have trouble deleting your account, email us and we will do it for you.

Your rights

Under UK and EU data protection law you may ask us to:

give you a copy of the data we hold about you
correct anything that is wrong
delete your data (or do it yourself, as above)
restrict or object to how we use it
withdraw consent to emails — the settings page does this immediately

Email jcmorgan2@gmail.com and we will respond within one month. If you are unhappy with the response you may complain to the UK's Information Commissioner's Office at ico.org.uk.

Children

This is a family game and anyone may play it anonymously. Accounts are not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, email us and we will remove it.

Cookies and local storage

We use no advertising or tracking cookies. The game stores small amounts of data in your browser to remember your preferences and your progress, and Firebase stores a sign-in token so you are not asked to sign in repeatedly. Clearing your browser data removes all of it.

Changes to this policy

If this policy changes we will update the date at the top of this page. Significant changes affecting account holders will be mentioned in the game.