privacy policy

1. Introduction & Scope

Welcome to crisskross arena (“we”, “our”, or “us”), available at https://crisscross-ashen.vercel.app. Crisskross is a web-based two-player gaming platform designed for long-distance couples, friends, and family to play interactive multiplayer games and connect in real time.

This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website, sign in using Google Authentication, or use our optional Google Meet video call feature.

2. Information We Collect

We believe in collecting only the minimal amount of data necessary to provide a smooth, enjoyable gameplay experience:

• Google Account Profile Information: If you choose to sign in with Google, we receive your email address, display name, and avatar/profile picture provided by Google Identity Services via Firebase Authentication. When you sign in, your email address is recorded in our database so we can send you notifications about Crisskross.
• Gameplay & Room Information: Ephemeral room codes, player nicknames, player moves, turn selections, active game scores, and connection presence indicators needed to synchronize games in real time.
• Google Meet Space Metadata: When you initiate a video call using our Google Meet integration, we generate and store a meeting URL and meeting code in the temporary room state so both players can join the call.
• Email Update Choice: If you are signed in, whether you asked for email updates, when you chose, and a random key used only for the unsubscribe link in those emails.
• Client Preferences: Local device preferences such as dark/light theme, audio volume, and temporary room reconnection session tokens stored locally in your browser's localStorage.

3. Google API Services & Limited Use Disclosure

Specifically, regarding Google Meet integration:

• We request the https://www.googleapis.com/auth/meetings.space.created scope strictly to create an instant video space for you and your game partner.
• We do not access, record, listen to, store, or process any video, audio, chat messages, screen shares, or transcripts from your Google Meet calls.
• We do not transfer, share, or sell Google user data to third parties, data brokers, advertising networks, or AI training datasets.

4. How We Use Your Data

We use the collected information exclusively to:

• Establish real-time peer-to-peer style multiplayer room synchronization.
• Authenticate your profile and maintain cross-device game progress.
• Facilitate instant Google Meet call creation between connected players in a room.
• Prevent abuse and maintain service uptime and stability.
• Email you about new games and updates - only if you opted in (see below).

Email Updates:Signed-in players are asked once whether they would like an email when we add new games. Only if you say yes do we email you, about twice a month, at the address on your Google account. Every email has an unsubscribe link, and you can also switch updates off at any time from your account menu (“email me about new games”). Saying no, or never answering, means you get no updates. We never sell or share your email address. If we use an email delivery service to send these emails, it receives only your name and email address, and only to send them.

5. Third-Party Service Providers

We rely on trusted, industry-standard infrastructure providers to deliver our service:

• Google Cloud Platform & Firebase: Used for secure user authentication, real-time database room state synchronization, and secure database hosting.
• Google Identity Services & Google Meet API: Used for OAuth 2.0 authentication and instant video conference space creation.

6. Data Retention, Security & Deletion

Security: All network communication is encrypted in transit using industry-standard Transport Layer Security (HTTPS/TLS). Access tokens are kept in client-side memory and are never persisted to external loggers.

Data Deletion: Game room sessions are ephemeral and are cleaned up after games conclude. If you have signed in with Google and wish to delete your account or any stored profile records, you can submit a deletion request at any time by emailing us at [email protected]. We will process and confirm your request within 48 business hours.

Photo Booth Pictures: Photo booth pictures are made on your device and are not uploaded. The one exception is a picture you explicitly choose to share on our home page by ticking the consent box (and, for a picture of two people, confirming the other person agreed too). That picture, its caption and the date are stored in Firebase, reviewed by hand, and only then shown publicly. You can take it back from the same device at any time, or email us and we will remove it.

7. Children's Privacy

Our service is not directed to children under the age of 13. We do not knowingly collect or solicit personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can immediately delete such data.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect improvements to our application or changes in legal regulations. When we make updates, we will revise the “Last Updated” date at the top of this page.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact the developer: