The short version: almost nothing, and none of it is sold

• Your Google account: the Google account id, your email address, your name and your avatar URL, as Google hands them over at sign-in.
• API keys: stored hashed. The full key is shown once, when it is created, and cannot be read back afterwards — only a short prefix is kept so you can tell your keys apart.
• Usage counters: how many calls a key made per day, per surface. That is what billing is computed from; the requests themselves are not stored beyond the server logs below.
• The points ledger: every credit — welcome, monthly, purchase, referral, adjustment — and your current balance.
• Top-up claims: what you type into the claim form — the amount, the coin, the network, the address you were told to pay and, optionally, your transaction hash.
• Game results: finished online matches (mode, scores, duration, who played) and your rating per ladder.
• Server logs: ordinary web-server and application logs, which include your IP address. They are rotated away after about 30 days.

There is no advertising pixel and no behavioural profile. If — and only if — you accept cookies on the banner, Google Analytics counts page views with an anonymised IP; it is not tied to your account and nothing about your browsing of the public pages ever is.

Two are functional and always set: the session cookie that keeps you signed in, and the CSRF token that stops a form on someone else's site from posting as you. A third, cookie_consent, only remembers whether you pressed OK or "No thanks" on the banner.

Google Analytics cookies are set only if you accept, and even then the tag is not fetched until you interact with the page. No advertising cookies, no cross-site tracking. The full list, and a button that resets your choice, is on the cookie policy page.

Cloudflare sits in front of the site and may set its own cookies for security and bot filtering. Those are Cloudflare's, not ours, and we read nothing from them.

Your data is never sold, rented or handed to advertisers. The third parties involved at all, and only in the way you would expect:

• Google — sign-in. Google knows you signed in here; we get an id, an email, a name and an avatar.
• Google Analytics — page-view counts, and only with your consent. Anonymised IP, no advertising features; see the cookie policy.
• Cloudflare — DNS and proxy. Every request passes through it.
• Let's Encrypt — the TLS certificate that makes the connection HTTPS.
• Public CDNs — jQuery (code.jquery.com), Alpine (jsDelivr) and the page font (Bunny Fonts) are loaded from them on every page, so they see the request the way any web host does.
• The blockchain you pay on — a crypto transfer is public by nature. Your transaction, its amount and the addresses on both sides are visible to anybody, permanently, and nothing on this site can change that.

Your name and rating appear on the public game leaderboard if you play rated matches. Nothing else about an account is ever published.

Ask on the feedback form and give the address you signed in with; the account is then deleted: the Google profile, the keys, the usage counters, the ledger and the claims all go with it.

Any remaining balance is forfeited — points are not refundable, so deletion is also the end of them. Ask for what you have first if you want a copy. Anonymous rows that no longer identify you, such as an old game result with its player detached, may survive in the match history.

AI crawlers are welcome on the public data pages — results, streaks, tables, tournaments, teams, head-to-head, the predictor. The rules are in robots.txt, with a machine-readable summary at llms.txt.

The account area, the admin panel and the sign-in flow are disallowed, and the key-gated surfaces answer 401 to anything without a key. No page that carries personal data is crawlable.