Privacy

This page says, in plain words, what we collect, why, where we keep it, how long for, and how to get it deleted. There is no small print. It is in two halves: the website you are reading now, and the game. If you have only ever read these pages, the second half does not apply to you.

The website

If you give us your email

We keep your address and a short record of what you agreed to. If you signed up on or after 30 September 2026, that is the exact wording beside the box, the language of the page, and the date you agreed. If you signed up before, it is the date you gave the address and, once we have sent it, the date of the launch email. Nothing else: we do not ask for your name, your phone number or your age.

If you signed up on or after 30 September 2026, we use it to send you an email now and then, when something new arrives. We send each one by hand through Gmail (Google), so a copy of every email we send you, and of any reply you send us, sits in our Gmail mailbox. Every email has a link that takes you off the list in one click: your address is deleted from the list straight away, and we delete the copies in our Gmail within 30 days. You can also just write and ask.

If you signed up before 30 September 2026, you asked for one message: that Pilotta is open. That is the only email we send you, and we delete your address 30 days after that message. We send the launch email through Gmail (Google), and your replies arrive there too, so a copy of that email and of any reply you send us sits in our Gmail mailbox. We delete them together with your address.

The Founder deck. If you signed up before 30 September 2026, your address is also on a separate Founder list. We use it for one thing: when someone signs in to the game with the same address, the game gives them the Founder deck. We keep that list until 29 September 2027, then delete it, so sign in by then to collect the deck. Once your account has collected the deck, we also note against your account number, with the date, that it was a Founder’s gift, so that the check on your progress backup (see Your guest account) never takes it away or counts it against your coins. That note holds no email address, stays with your account after the list is deleted, and is deleted with your account. The unsubscribe link in our emails takes you off the email list only; it leaves you on the Founder list. If you write and ask us to delete your address, we remove it from both lists, and if you have not signed in with it yet, you lose the Founder deck. Deleting your game account from inside the game also takes the address it signs in with off both lists, once that address has been confirmed.

We never sell your address or share it with anyone other than the services named on this page, and we send no advertising.

The box is protected by Cloudflare Turnstile, a human check that decides whether you are a person rather than a script. It runs quietly as soon as the page with the box opens, and only asks you to tick something if Cloudflare is unsure. To decide, Cloudflare looks at your IP address and technical details of your browser and device, such as the browser’s name and version. All we get back is Cloudflare’s answer. Cloudflare also uses those details for a purpose of its own, improving how its check tells people from scripts, and for that part it decides for itself, under its own privacy terms. The game uses the same check (see Your guest account).

Counting visitors

We set no advertising cookies and use no outside analytics service — no Google Analytics, no Facebook pixel, none of it.

We do count how many people open our pages and the game, and we count it ourselves. When a page of the website opens, or the game opens in a browser at pilotta.io/play/, our own server records the date and the hour (not the minute), which page it was (and, for the website’s pages, which language it is written in), the site that sent you here (the site’s name only, never what you searched for), your country and the kind of device, sorted into one of four groups: Android, iPhone, computer, or other. To sort it, the server reads the identifying string your browser sends with every request (the “user agent”), then throws it away: we never keep the name or version of your browser, or the make or model of your device. It does not record your IP address, and it writes nothing into your browser. To tell ten pages opened by one person apart from ten different visitors, it keeps an anonymous code of the day — a one-way scramble of your IP address and browser string that cannot be turned back into you. Every night, after the day ends and its totals are saved, we wipe that day’s codes, so they cannot recognise you tomorrow. So the count can tell us that ten different people read the rules yesterday, or how many of our visitors are on a phone, and can never tell us who they were. We only ever look at it as totals, and at the kinds of device only as weekly or monthly totals.

Counting the game is not recording it. The count says only that the game was opened; it carries nothing about your games, and it happens whether or not you said yes to recording (see Playing on your own against the computer). Our apps for Android, iPhone and computers are not counted this way.

The website pages keep very little in your browser, only on your own device, and send none of it to us: the language you picked; if you use the score sheet (Score), the team names and scores you type into it, so that the sheet is still there when you come back, until you clear your browser data; and, only if you open a special address we use to stop counting our own devices, a note saying not to count that device. The game lives on the same site, at pilotta.io/play/, and keeps its own things in your browser (see Playing on your own against the computer and Your guest account). One of them is a small note saying you have played here before. When a browser carrying that note arrives at pilotta.io from another site or from the address bar, the front page reads the note and goes straight to the game. The note holds no name and no number, never leaves your device, and clearing your browser data removes it.

Fonts

The website’s fonts come from our own site. The game’s loading screen fetches one font from Google Fonts, so Google sees your IP address when the game starts.

The game

Playing on your own against the computer

Your name, level, coins, unlocked decks and phrases, the last fifteen games you played, and a few settings, such as the practice table you last chose, are stored on the device itself — in the browser, or in the app. Clearing your browser data or deleting the app deletes that copy. We also keep a backup copy of your name and progress, from the first time you open the game, even if you only ever play against the computer: see Your guest account. On Android, the phone’s automatic backup to your Google account leaves the game’s progress out; only a move to a new phone that you start yourself can carry it across. When the game opens in a browser, that is counted too, without your name: see Counting visitors.

One exception: recordings of your games against the computer, in the game on the website. If you say yes, then when you play against the computer at pilotta.io/play/ in a browser, the game sends us a recording of each game as it goes: the cards each player was dealt, every bid, every declaration and every card played, the scores, the kind of game and the difficulty you chose, the date, the version number of the game’s code, and a random code made up for that one game and used for nothing else. Your seat is recorded under the neutral name “Player”, never under your name; the computer players keep theirs. The recording carries no account number, no name, no email address and no code for your device, and we do not store your IP address with it. Supabase, the company that runs our database, sees your IP address and your browser’s identifying string (the “user agent”, which names the browser, its version and the kind of device) when a recording arrives, as it does with any request, and keeps them only in its own short-lived technical log of requests. We use the recordings for one thing: to see how the computer players really play against people, so we can make them better. They are kept in our database in Ireland, and we take copies onto our own computers to study them.

Only if you say yes. The first time you tap to start a game against the computer, before the table appears, a short question asks whether we may record your games against the computer, with two buttons: Yes, record and No thanks. Closing the question with × counts as No thanks. Whichever you choose, the game starts straight away; your answer makes no difference to how you can play. We ask once. Recording is off unless you choose Yes, record. If you do, the game you were starting is recorded, and so is every game you start after it; a game already in progress, or one you had put aside, is never sent. You can change your mind at any time with gear button → Profile & Preferences → Record my games vs the computer: switch it off and nothing more is sent from that moment, even in the middle of a game; switch it on and the next game you start is recorded. Whatever was already sent stays until it is deleted with the rest, after 2 years. Only the game at pilotta.io/play/ in a browser records: our apps for Android, iPhone and computers never record your games against the computer. For games against other people, see Playing online.

Your guest account

The first time you open the game, in the game on the website or in our Android and iPhone apps, it makes an account for you without asking, a few seconds after it opens and before you have played anything. It is anonymous: a long random number, and the name you show in the game. Nothing else — no email, no password. It exists so that your progress has a backup that survives a new phone, so that the check on that backup (below) is fair from your very first game, and so that four people at one table can be told apart if you play online. The game makes it only once on a device: a device that already has, or has had, an account is left as it is. Our app for computers does not make one when it opens, and neither does a search engine reading the page.

From then on, the game keeps your sign-in on the device, so that the backup works without you doing anything and you do not have to sign in every time. It is a long code that proves to our database who you are, and it contains your account number and, if the account has one, your email address. Signing out, clearing your browser data or deleting the app removes it. If you sign out, the game does not make another account until you play online.

When the account is made, and each time the game renews its sign-in, Supabase, the company that runs our database, sees your IP address and the identifying details your browser or app sends, as it does with any request. It counts how many guest accounts are made from one IP address in an hour, so that a script cannot make thousands, and keeps the address in its own technical logs.

From then on we hold, against that number: the name you show, and a backup copy of your progress — level, XP, coins, your game statistics (games played and won, and the like), which decks, tables and phrases you have unlocked, the lessons you have finished, and your settings. It is the same information the game already keeps on your device, and the game sends it to us whether or not you ever play online; the copy is what lets you sign in on a second device, or a new phone, and find your things there.

Checking the backup. Each time the game sends us your backup, our database checks that its numbers could have been reached by playing: games, wins, XP, level, coins, and the decks, tables and phrases you own or are using. If something could not have been earned (for example more coins than your games could have paid, or a deck in use that you never unlocked), it is lowered to the nearest possible value, and the game takes the corrected copy at its next sync. Nothing else about your account changes. On a day when this happens we keep a short record against your account number: how many times it happened, the time of the first and the last, which checks failed, and what your backup held before the first correction and before and after the last one (games, wins, XP, level, coins, coins spent, the decks, tables and phrases you own, and the deck and table you were using). It holds no name, no email address and nothing about your device. To pace the check, we also keep one short line per account: the moment its pacing starts from (when the account was made or, for an account that already had a backup when the check began, that moment) and how many games, how many coins (counting coins already spent) and how much XP the backup was allowed at that moment. We use the record to put an honest player’s progress back if a check proves too strict, and to see whether someone keeps trying. If you think your progress was lowered by mistake, write to us and we will look at the record. If we put progress back, or give your account something by hand, we note it against your account number so that your later backups keep it: the extra games, coins and XP, any decks, tables or phrases that count as free for you, a short note of why, and the date. The welcome gift (see our Terms) is noted the same way, but automatically: when your permanent account receives it, its 250 coins are added to that note with the words “signup gift” and the date, and a separate record holds your account number, the number of coins, the moment they were given and the moment the game confirmed they were in your backed-up progress, so that the gift is given only once, and is offered again if the first try was cut short.

The human check. The game uses the same Cloudflare check as the website, in the game on the website and in our Android and iPhone apps. It runs when the game makes your anonymous account (normally once per device, a few seconds after you first open the game), when you make a new account with an email and password, and when you sign in with an email and password. It does not run for the Google or Discord buttons, or when you add an email and password to the anonymous account you already have. When the game makes your anonymous account, the check never shows you anything: if Cloudflare is unsure, the game simply tries again later. At the other moments you usually see nothing either; if Cloudflare is unsure, a small box asks you to tick it. Cloudflare sees the same details as on the website and uses them in the same way. In the web game, your browser also fetches the check from Cloudflare every time the game opens, so Cloudflare receives your IP address and browser details then too, even if the check itself never runs.

Playing online

When an online match finishes we store the result: the date, the score, who won, and the four names at the table. That is what your match history is made of. We do not store the cards of an online match against your name — the server keeps a record of how the hands were played, with every seat reduced to “a person” or “the computer”, and that record carries no name and no account number. We use it to make the computer players less stupid.

While you are actually at a table, our server holds the table in its memory and forgets it when the table closes. Its technical log notes the name and account number of who connected and when, so that we can work out what went wrong when something does.

If you make a real account

You can turn the anonymous account into a permanent one. With an email and password we hold the address and the password — scrambled, so nobody here can read it. If you use the Google or Discord button instead, they tell us your email address and the name on that account, and we keep those. You keep the same account number, so nothing you earned is lost.

If you sign up with an email and password, you can normally play straight away. We send you one email with a link to confirm the address. Until you tap it, the account works like a guest account, and the Founder deck and your match history wait until the address is confirmed. You can ask for the email again, or correct the address, from the account window. If the address is still not confirmed 7 days after you signed up, we remove it and the password from the account: it becomes a guest account again on the same device and keeps everything you earned, but if you sign out after that you cannot sign back in to it. You can add an address again from the account window; this time it has to be confirmed before it is attached to the account.

In the game on the website, the Google button is Google’s own. When the game shows you the window where you sign in or make an account, your browser fetches that button from Google, so Google receives your IP address and your browser’s details at that moment, even if you then choose another way or close the window; if your browser is signed in to Google, Google may connect that request to your Google account, under Google’s own privacy terms. Until you open that window, the game fetches nothing from Google for the button.

Small notes about signing up, kept on your device. If you play as a guest, the game may suggest, after a game against the computer that paid you coins, that you make a permanent account. It keeps on your device the date and time it last suggested this, so that it then waits three days before suggesting it again, whatever you answered. For the welcome gift, the game keeps on your device the number of the account it has added the coins for, until our database confirms they have arrived, so that they are never added twice on that device; after that, it keeps that account’s number as a note that the gift is done, so that it does not ask again. None of these notes is sent to us. Delete my account removes the gift notes; clearing your browser data or deleting the app removes all of them.

Before you make a permanent account (with an email and password, or with the Google or Discord buttons), the account window asks you to tick a box saying you are 14 or over. The box starts unticked every time the window opens, and the game keeps no note that it was ticked, neither on your device nor with us.

Counting players who come back

This count covers only accounts that have gone online (opened online play: a quick match, a table with friends or an invite link, even without finishing a game), or that are permanent accounts (see If you make a real account). The guest account the game makes when it first opens is never counted while it has only played against the computer. Once your account is covered, each day you open the game while it is signed in to it (in the game on the website or in our Android and iPhone apps), our database notes your account number and the date (the date in Cyprus, without the time). There is one entry per account per day, however many times you open the game that day. The first day you are counted, it also notes, once, how you reached us that day. In the game on the website, that is the source named in the link you followed (for example an Instagram post); otherwise the site or app that sent you, sorted into a broad group such as Google, Facebook or Instagram; otherwise “direct”. In our apps, it is simply which app it is. The game works this out when it opens and holds it only in memory while it is open: nothing new is stored on your device. Nothing else goes with it: no name, no email address, no IP address, nothing about your device.

We use these entries for one thing: to count, as weekly totals, how many players come back and which places bring players who stay. We never look at one player’s days, we use them for no decision about you, we never join them to your name, your email address or your match results, and we share them with nobody. If you only ever play against the computer and never make a permanent account, nothing is noted, even though the game has made a guest account for you: that account is made for the backup and its check, never for this count. There is no question and no switch for this in the game; you can object to it at any time by writing to us (see Your rights).

Talking at the table

There is no free chat in Pilotta. You can only say the fixed phrases the game gives you, so there is nothing to store, nothing to moderate, and nothing anyone can write to you.

The test version

A separate test version of the game runs at a different address, for people who agreed to try it before launch. There, games against the computer are uploaded together with the tester’s name and, if they have one, their account number, so we can see how the bots played, along with anything a tester reports through the report button. Testers are told this on the screen the first time they open it. That material is kept in its own database, apart from everything else, and deleted after 2 years at most. On pilotta.io, games against the computer are recorded only as described above: without a name, and only if you said yes.

How long we keep it

Why we are allowed to hold it

Your email: because you agreed. You can take that back at any time, with the link in any email or by writing to us, and we will delete it.

Your account and the backup of your progress: because the backup is part of the game we provide — it keeps your progress safe and lets you take it to another device — and online play cannot work without the account. We make the account when you first open the game, before you have chosen to play online, for one more reason: we have a genuine need for the check on progress backups (below) to count from your first game, or it cannot be fair. Your match results: because they are part of the online play you asked for. The same goes for the note that your account collected the Founder deck: our Terms promise that, once unlocked, the deck stays in your account. The same goes for the record that your account received the welcome gift, and the gift’s coins in the note the check keeps: our Terms promise the gift once per account, and these are how we give it once, and only once, and let you keep it.

The count of players who come back (only accounts that have gone online or are permanent): because we have a genuine need to know whether players return and which places bring the ones who stay, so that we spend our small effort where it works. We keep it to a date and a broad source, look only at weekly totals, and delete it after 13 months. You can object to it at any time, without giving a reason, and we will stop (see Your rights).

The page count, the technical log and the anonymous record of hands: because we have a genuine need to know whether anyone is reading the site or opening the game and on which kinds of device, why the server fell over, and whether the computer players are any good. None of it identifies you, and you can object to it.

The recordings of games against the computer: because you agreed, by choosing Yes, record or by switching recording on in Profile & Preferences. You can take that back at any time with the same switch, and from then on nothing is sent. The recordings are built so that they do not identify you, which is also why we cannot find and delete the ones already sent (see Your rights).

The human check: because we have a genuine need to keep automated scripts away from the email list and the accounts.

The check on your progress backup and what it keeps (the record of corrections, the pacing line, and any gift or repair we note by hand): because we have a genuine need to keep unearned progress out of the game, so that coins, levels and unlocks mean the same for everyone. You can object, and we will weigh your reasons, but the check itself runs for every account.

Where it is kept

The accounts, the progress backups, the match results, the email list, the Founder list, the page count, the count of players who come back, what the check on progress backups keeps, the record of the welcome gift and the recordings of games against the computer sit in a Supabase database on servers in Ireland, inside the European Union. The site itself is served by Cloudflare.

The emails we send you, and any replies you send us, sit in our Gmail mailbox, which is run by Google. Google may store and handle them on servers outside the European Union, under Google’s own terms.

The emails the game sends you about your account — such as the link that confirms your address when you make an account with an email and password — are sent for us by Resend (Plus Five Five, Inc.), a company in the United States. The emails leave from Resend’s servers in Ireland, but Resend keeps its copies in the United States. To send one, Resend receives your email address and the email itself, which contains a link that works once. Resend is allowed to use them only to deliver the email for us; our contract with it forbids any other use. It keeps a record of each email (the address, the date, whether it arrived, and a copy of the email) for 30 days, then deletes it. We cannot shorten that on the free plan we use, but if you ask, we will ask Resend to delete yours sooner. If an email to your address cannot be delivered, or you mark one as spam, Resend also puts your address on a list of addresses not to write to again, where it stays until you ask us to take it off. We send no advertising through Resend, and its features that track whether you open an email or click its link are switched off. To move your information to the United States we rely on the EU–US Data Privacy Framework, which Resend has joined, and on the European Commission’s standard contractual clauses, which are part of our contract with Resend. Resend runs its service with the help of its own subcontractors, all of them in the United States, and must make them protect the information in the same way.

The server that runs the live tables is a Google Cloud machine in the United States. While you are playing, the names at your table pass through it, and its technical log sits there. It holds no account and no progress — those stay in Ireland — and its record of how the hands were played carries no names.

Cloudflare and Google Fonts are worldwide services, so a request from your browser can be answered by a machine outside the EU. Apart from the human check described above, we do not send them anything about you beyond what any website request carries.

Children

Pilotta is a card game and anyone can read these pages. But in Cyprus, a person under 14 cannot agree on their own to a service like this — a parent has to agree for them. So we do not want online play, or permanent accounts (with an email, Google or Discord), for under-14s.

The game does not ask anyone’s age, with one exception: before you make a permanent account, the account window asks you to tick a box saying you are 14 or over. We cannot check that the answer is true, and we keep no note of it: the box starts unticked every time, so the next person on a shared device is asked too. It makes an anonymous guest account on every device the first time it opens, so on a child’s device too (see Your guest account). That account holds a number, the name typed into the game and the backup of progress, and we use it only as this page describes. A parent who does not want it can use Delete my account in the game on the child’s device, or write to us, and the account and its backup are deleted (see Your rights). The next time the game is opened on that device, it makes a new, empty guest account, as it does on any device.

The same goes for recording games against the computer. A child under 14 needs a parent to agree before choosing Yes, record; without that, the answer should be No thanks. Because the recordings carry nothing that tells us who played, we cannot tell a child’s games from an adult’s once they have arrived. A parent can switch recording off in Profile & Preferences at any time.

The count of players who come back covers only accounts that have gone online or are permanent, so a child’s guest account that only plays against the computer is never counted. If a child’s account is counted despite the above, we only ever look at it as totals. A parent can have it stopped by writing to us, or by deleting the account.

If you are a parent and think your child has an account here, write to us and we will delete it, or use Delete my account in the game on their device. You do not need to prove anything or explain yourself.

Your rights

At any time you can ask us to show you what we hold about you, to correct it, to delete it entirely, or to hand it to you in a file you can take elsewhere. Write to us and we will do it — you do not need to give a reason, and it costs nothing. To delete your whole account you do not need to write: use Delete my account in the game’s account window (tap your name on the home screen), and it is done at once.

One thing to know about deletion: the results of matches you already played stay, because they are three other people’s history as much as yours. Your name comes off them, and everything else — your account, your progress, your backup — goes.

The recordings of games against the computer carry nothing that tells us who played them, so we have no way to find yours among the others: we cannot show them to you, hand them to you or delete them on request. To stop new ones, switch recording off in Profile & Preferences. All of them are deleted after 2 years.

You can object to the count of players who come back. Write to us at pilottos.io@gmail.com, from your account’s email address or, if you play as a guest, with your Player code (tap your name at the top of the home screen), and we will stop counting that account and delete the days already noted. You do not need to give a reason, and you keep your account and everything in it. Deleting your account also deletes them.

How to do it, and exactly what is deleted and what is kept, is set out on the Delete your account page.

You also have the right to complain to the Office of the Commissioner for Personal Data Protection of Cyprus.

What we do not do

We do not sell anything about you. We show no advertising. We use no outside analytics service, no advertising cookies and no tracking pixels. We do not build a profile of you, and we let nobody else do it on our pages. Our own count of players who come back is only ever looked at as weekly totals.

Contact

For anything on this page — a question, a correction, or to have everything deleted — write to pilottos.io@gmail.com. We answer within a month, and usually a lot sooner. (Your account itself you can delete straight from the game.)