🍪 Privacy policy

1 Who we are and how to reach us

The Ludo Akhara service — the website https://ludoakhara.com, the apps for Android, iOS, Windows and macOS, and the online game server — is provided by Ludo Akhara, Republic of Kazakhstan (“we”). We decide why and how your data is processed, so we are its controller (data fiduciary).

Questions about personal data — privacy@ludoakhara.com. Anything else — the support form or support@ludoakhara.com.

2 The short version

Ludo Akhara is an online board game. We collect as much data as it takes for you to play, keep your progress and climb the leagues. We do not sell data, we show no ads, and we use no third-party analytics or advertising services.

3 What we collect

Account: nickname, e-mail, a password hash (we neither store nor see the password itself), chosen language, the date you accepted the terms.

Google, Google Play Games (Android) or Apple sign-in: we store the account identifier Google, Google Play Games or Apple issues. On your first sign-in, the name on your Google account becomes your nickname (if there is none — the part of your e-mail before “@”; with Google Play Games — your Play Games player name; with Apple — the part of your e-mail before “@”). This nickname is public: other players see it at the table and on the leaderboard. You can change it in your profile. We do not store your Google, Google Play Games or Apple e-mail, photo or password.

Avatar: a photo you upload yourself. We crop it to a 256×256 square and keep it on our server; other players can see it. You can replace or remove it at any time.

Guest profile: a random nickname like “Гость-1234” (Russian for “Guest”) and a session token. We know neither a guest’s name nor their contacts.

Game data: games and their moves (the server records and re-checks online games to catch cheaters), results, statistics, rating and its history, leagues, achievements, tokens and the log of their credits and debits, friends and table invites.

Technical data: IP address, device and browser type, platform and sign-in time — in the session record. We use the IP address to guess your country only to pick the default interface language: a database on our own server does it, no external service is called, and we do not store the country. Server logs are kept for security and debugging: they hold the IP address, requested address, time, device or browser type, and — in service records about sent e-mails — the recipient’s e-mail. Sign-in tokens and session cookies are not written to logs.

Confirmation codes: for code sign-in and password reset we store the one-time code together with the e-mail it was sent to.

Cookie banner choice: we record on the server what was chosen and when (linked to the account if you are signed in), so that consent can be shown if needed.

Bug reports: only if you press “Send report” in the app yourself — your text, the game’s technical log (game and connection events; it may contain the nicknames at your table and the room code), platform and OS version, and the sender’s IP address. Reports are never sent on their own.

Support requests: name or nickname, reply e-mail, topic and message.

Reports and moderation: who reported whom, the reason, the game and the comment, and moderators’ decisions.

Table chat: messages and reactions are delivered to the players at the table in real time and are not stored on the server. If you report a player, the report contains only what you write in its comment.

4 Cookies and on-device data

Essential cookies remember your sign-in, your language and your cookie-banner choice, and protect forms against forged requests. The site does not work without them.

Analytics cookies: we currently set none. If we add any, only after your consent (“Accept all” in the banner); the “Essential only” button forbids them. Your choice is remembered for a year; change your mind any time by clearing the site’s cookies.

The apps keep a sign-in token and game settings on your device. Uninstalling the app erases them.

5 Why we use it and on what basis

To perform our contract with you (the terms of use): account and sign-in, sync across devices, online games, rating, leagues, tokens, friends, support replies.

Legitimate interest — a fair and safe service: protection against account takeover and spam, anti-cheat and fighting match fixing, handling reports, fixing bugs from bug reports, anonymised statistics to improve the game.

Consent: uploading an avatar, sending a bug report, analytics cookies (if we ever add them), a teenager’s account — with a parent’s consent. You can withdraw consent at any time; that does not affect processing done before.

Legal obligations: answering lawful requests from public authorities.

6 Who we share it with

We never sell or rent your data. It is received only by:

Hosting providers — they store data on their servers on our behalf: Vultr (The Constant Company, LLC, USA), data centre in India (Mumbai); earlier app versions and the old site address are served by Contabo GmbH (Germany), data centre in the EU (France).

Google and Apple — only if you choose to sign in with them (with Google — including Google Play Games on Android): they confirm your identity under their own privacy policies.

Google Fonts — the website’s pages load fonts from Google’s servers, so Google receives the site visitor’s IP address and browser details.

Telegram — e-mails to @ludoakhara.com addresses reach us through a Telegram bot, so their contents pass through Telegram.

Other players see your nickname, avatar, rating, league, achievements and statistics — in your profile, at the table and on the leaderboard.

Moderators — strictly within the scope of a specific report. Public authorities — only on a lawful demand.

7 Where your data is stored

Servers: Vultr (The Constant Company, LLC, USA), data centre in India (Mumbai); earlier app versions and the old site address are served by Contabo GmbH (Germany), data centre in the EU (France). This is most likely outside the country you live in, and outside Kazakhstan where the operator is based. By using the service you agree to this cross-border transfer.

Wherever the data sits, we protect it the same way: connections are encrypted (HTTPS/TLS), passwords are stored only as hashes, and only the project team has access to the servers.

8 How long we keep it

Account, statistics, tokens, friends, avatar and session records with IP addresses — for as long as the account exists. Deleting it in your profile or in the app erases them at once (details). A guest profile is deleted the same way.

Played games stay in opponents’ history, but unlinked from you. The log of moderation decisions — up to three years (fair play requires it), then it is deleted automatically. Confirmation codes — up to one day.

Support requests and bug reports — as long as we need them to reply and fix the bug; deleting the account does not erase them, but we will delete them if you ask at privacy@ludoakhara.com. Server logs are capped in size and overwritten in rotation.

9 Your rights

You can: find out what data we hold about you and get a copy; correct it (nickname, language and avatar — yourself, in your profile); delete the whole account; withdraw consent; object to processing based on legitimate interest.

Send requests to privacy@ludoakhara.com from the address the account is registered to. We reply within 30 days; if we need something more to verify it is you, we will ask.

If you are not satisfied with our answer, you can complain to the data protection authority of your country — for example, the authorised personal data protection body in Kazakhstan, the Data Protection Board of India, or the supervisory authority of your EU country of residence.

10 For users in India

Under the Digital Personal Data Protection Act, 2023, complaints are handled by our Grievance Officer: Maxim Menshenin, grievance@ludoakhara.com. We reply within 30 days.

You may nominate a person to exercise your rights if you are unable to do so yourself. If our answer does not satisfy you, you can approach the Data Protection Board of India.

11 Children and teenagers

The game content is suitable for all ages (3+): no violence, no real-money gambling, no purchases. But the account, online play and chat are for ages 13 and up. The game is not directed at children under 13, and we do not knowingly collect their data.

From 13 to 18 — or until the age at which the law of your country lets you consent to data processing yourself — an account may be created only with the consent of a parent or legal guardian. By signing up you confirm you are at least 13 and that such consent has been given.

We show no ads to teenagers and do not track their behaviour for targeting. If we learn that a child under 13 has an account, we delete it together with its data. A parent can ask us to do so at privacy@ludoakhara.com.

12 Advertising

There are no ads in Ludo Akhara right now, and no data goes to ad networks. If ads ever appear, we will update this policy in advance, name the ad partners and ask for your consent wherever the law requires it.

13 Changes to this policy

If the policy changes in any meaningful way, we will say so right on the site rather than bury it in a footnote. The effective date is always shown at the top.