Cobblewit privacy policy

The short version

1. Who we are

Cobblewit is run by Cobblewit LLC, an Oregon limited liability company, in the United States ("we", "us"). This policy covers the game website at cobblewit.games, our app and bot inside Discord, the doors that let programs and AI assistants play, and this website. For anything about your information, write to support@cobblewit.games.

2. What we collect, and why

If you play as a guest on the web

You can play our bot games without an account. When you sit at a table, your browser is given a seat token for that table. It is kept in that browser tab only, and we keep only a scrambled form of it, so that the moves you send are known to be yours.

After your first finished game, we set one cookie of our own, holding a random number (section 3). We record which games that number played, when, and how they ended, so that we can count how many people play and come back, and so that your games can be kept if you later make an account. No guest is named on any public board. A guest only ever sits at tables that no program can join.

If you sign in

Your sign-in. You sign in with Google or with Discord. Google's basic sign-in sends us your name and picture along with your ID; we drop them unread and read only the ID. We don't ask Google for your email. From Discord we read only your Discord ID, and we cancel the access Discord gave us straight away. We keep your Google or Discord ID only as a scrambled code made with a secret key of ours (a keyed hash), so that our files alone don't name your Google or Discord account. With Discord, we also keep the day your Discord account was made, which can be read from its ID. You may link one Google and one Discord sign-in to the same login.

Your age. The first time you sign in, we ask your month and year of birth, and the day if it is needed to tell. We don't keep the answer. If you are 18 or over, we keep only the fact that you are an adult and when you said so. If the answer is under 18, no login is made and your Google or Discord ID is dropped; we keep only a count of how many such answers there were that day, with nothing about who gave them. Your browser is given a cookie for 30 days that stops the question being asked again (section 3). If the answer is under 13, we also delete that browser's guest games and remove its counting cookie.

Your country. We ask which country you live in, and keep the answer with your login. If it is a place where Cobblewit is not offered, no login is made.

Your accounts. A login holds up to three accounts. For each we keep its username, when it was made, the adult and country facts it was made under, and whether it is closed. Your username is shown to other players, to anyone watching your table, and on the public board.

Your sign-in sessions. When you sign in, your browser is given a session cookie (section 3). We keep only a scrambled form of it, and it lasts 90 days, renewed as you use it. To play, the page asks for a short play token, good for 10 minutes, which is held in the page's memory and never stored in your browser.

Keys and connected AI assistants

If you make a key for a program to play one of your accounts, we show it once and keep only a scrambled form of it. If you connect an AI assistant, we keep the connection (which account, which assistant, when) and only scrambled forms of its tokens. An assistant's access lasts an hour at a time and is renewed as it is used; a connection not used for 30 days ends by itself, and you can end it at any time from your account page.

We never ask for, and never store, your own key to any AI service. When your own assistant plays, it runs on your own subscription with its maker, and we call no model for it.

When you play

Game records. For each table we keep its record: the game, the deal and the random number it was dealt from, every move, when it arrived, the result, and what held each seat. A seat held by an account is recorded by a random number that stands for the account, not by its username; the username is looked up when the record is shown. A model's seat is recorded by the model's name and settings. We use records to run the games, to settle results, to replay a game, to keep the board, to find cheating and faults, and to improve the games.

Your history. For each login we keep a short private history: for each game finished, the table number, the game, the kind of table, when it ended, and whether you won, lost or shared it. Nobody else's name or moves are in it. Only you see it, when signed in. When you make your first account, the games your browser played as a guest are moved into it.

Free model games. For each free game with an AI model, we record which login used it and when, so that the daily number holds. This record names the login only by its random number.

Counting. We count visits and play, so that we know how many people come, from where, and whether they come back (section 4).

Inside Discord

Our bot in a Discord server. When someone in a server starts a table with our bot, we read the server, the channel and the user who asked. The user's Discord ID is held in memory for 30 seconds only, to limit how often a table can be started, and is never written down. For each server we keep a small record of its tables: the channel and message our bot posted in, the game, the table number, the times, each seat (as a username, a guest or a house bot) and the winners. No Discord ID or Discord name is in it. Finished tables are kept in that record for 90 days, and at most 200 per server.

Our app inside Discord (the Activity). Before you play, we ask once whether you are in one of the places where Cobblewit is not offered. If you answer yes, we collect nothing and keep nothing. (If you first answered no and later change it to yes, the change is held in our server's memory for up to 12 hours, so the question isn't asked again at once, and is never written down.) If you answer no, Discord asks your consent to let us read your Discord ID; we read the ID only, never your name, and cancel Discord's access straight away. We keep only a scrambled form of your Discord ID, marked "no", so that we don't ask again. If you later say you are in one of those places, that line is removed and play ends. Your device also keeps one flag saying it has answered, with nothing that identifies you. If you have a login made on the web, you can play as your account. Otherwise you play as a guest at the room's bot table, and that play is on no board and in no count of players.

Technical information and logs

Your internet address. Every request reaches us with your internet address. We use it to work out your country, from a country list held on our own machine (no outside lookup), and to keep limits on how often one address may call us. Those limits are held in memory, for about a minute, or an hour for a few of them, and are never written to disk. We do not write your internet address into our records, our counting or our logs, and our web server keeps no access log.

Logs. Our server writes a log of what it does: for each call, the kind of call, a table number, the outcome and its size, and an account by its random number, not its username. Our ordinary log lines hold no internet address, username, Discord ID, token or key; a rare error report may name an account. Logs are kept on our machine for up to 30 days.

The AI models' turns. For each turn an AI model plays, we keep what the model was shown and what it answered, beside the table number. It names no person. These are kept for about 14 days, to find faults, and then deleted (backups age out as section 8 says).

When you write to us

If you email us, we receive your email address and what you write. Our mailbox is kept with Fastmail. We use your message only to answer you and to look after the service, and keep it as long as it is needed for that.

What we don't collect

We don't collect your email address (unless you write to us), your name, your photo, your contacts, your precise location, payment details, or anything from other websites. There is no chat, so we hold no messages between players. We use no outside analytics, no advertising identifiers, and no tracking pixels.

3. Cookies and storage on your device

We set only our own cookies, and only these:

The page also keeps a few things in your browser's own storage, which never leave your device by themselves: your light or dark choice, the username you last played as (removed when you sign out), which lessons you have been offered, and, for the tab you are in, your seat at a table, how you chose to sit at a game, and your place in a lesson. Inside Discord, the device keeps the one flag described above.

We set no cookie from anyone else, and the game loads no script, font or image from any other company.

4. Counting visits and play

To know whether Cobblewit is working, we count. For each day we keep a file of events: a visit's arrival, with the site it came from, a link tag if the link had one, and the country; each game started and finished, with the game, the kind of table, what kind of seat each was, the results and how many moves were made. A person's seat in these files is named by the counting number of their browser or their login, never by a username, and a program's seat by its account's random number. Nothing in them is free text, and nothing is an internet address. A visit from a place where Cobblewit is not offered is counted only as a number for that country and day.

These daily files are kept for 180 days. After that we keep only the weekly totals made from them, which name nobody.

5. AI models, and what we send them

When an AI model we run plays a seat, we send OpenRouter, and through it the company that makes and runs that model, the game's rules, the position as that seat is allowed to see it, and the list of legal moves. The position can include the moves other seats have made, such as a word guessed in a word game. We send nothing about you: not your username, not your account, not your internet address. On every one of these calls we ask OpenRouter to send it only to providers that, by OpenRouter's own listing of their policies, do not keep it or use it to train their models. Those companies still handle what we send under their own terms and policies.

6. Who handles information for us

We use a few companies to run Cobblewit. Each gets only what its job needs.

We don't sell your information, and we don't share it for advertising. We show no ads. We may disclose information if the law requires it, to protect people from harm, or to defend our rights. If Cobblewit or its company is sold or merged, what we hold may pass to the new owner, under this policy, and we will say so here.

7. What other players and the public can see

8. How long we keep things

9. Deleting your login, and what stays

You can delete your login from your account page. You type your username to confirm, and sign in again with Google or Discord to show it is you. Then, at once:

What stays:

10. Your choices and rights

You can see your own history when signed in, sign out everywhere, disconnect assistants, revoke keys, and delete your login, all from your account page. You can clear our cookies from your browser at any time; clearing mcg-count breaks the link between you and your guest games.

You can also write to support@cobblewit.games to ask what we hold about you, to correct it, or to delete it. Because we keep no email address or name, we will need you to show that a login is yours, usually by signing in. We will answer within 45 days. We can't find a guest's games on request, because we know a guest only by the random number in a cookie that our page itself cannot read; that is part of why we hold so little.

Depending on where you live in the United States, the law may give you further rights over your information. Write to us and we will honour them as the law requires. We will not treat you differently for asking.

11. Children and teenagers

Our accounts, and everything beyond the bot games, are for adults. Bot games are open to anyone, as a guest on the web and inside Discord, and a guest gives us no name, no email and no account; we keep only the random counting number and the games it played.

We don't knowingly collect personal information from children under 13. If the age question is answered as under 13, we delete that browser's guest games and remove its counting cookie. If you are a parent or guardian and think a child has given us information, write to support@cobblewit.games and we will delete what we can find. If we learn that a login belongs to someone under 18, we will close its accounts at once and remove what it holds.

12. Where Cobblewit is offered, and where your information is kept

Cobblewit is offered from the United States, and everything we hold is kept in the United States, in AWS's Ohio region. It is not offered in the European Union (including Åland, French Guiana, Guadeloupe, Martinique, Mayotte, Réunion and Saint-Martin), Norway, Iceland, Liechtenstein, the United Kingdom or Switzerland: a visitor on the web placed there, or one we can't place, sees a page saying so, and we keep nothing of them beyond a count of visits by country and day and our ordinary server logs. Our open guide for programs can still be read from there. The one exception is someone there who runs a program and has been given an account for it by invitation; we keep that account as section 2 says.

13. Security

We keep sessions, tokens and keys only in scrambled form, and your Google or Discord ID only as a keyed hash. Our server's disks and our backup storage at AWS are encrypted, and the backup storage is not public. Only the people who run Cobblewit can reach the server. No system is perfectly secure; if something goes wrong that affects your information, we will tell you as the law requires.

14. Changes to this policy

We will post any change here with a new date. If a change matters to you, we will also say so on the site at least 14 days before it takes effect, except where it has to take effect sooner for legal or safety reasons. We won't use information we already hold in a new way that matters to you without telling you first.

15. Contact

Cobblewit LLC, an Oregon limited liability company. Email: support@cobblewit.games.