Privacy
What we collect and why
Upto36 is a free browser game. You can play without giving an email address. We use our own gameplay measurements to run the game, check scores, understand where players struggle, and fix problems. The game has no ads or third-party analytics scripts.
- Game activity: random device and visitor IDs, session and run IDs, timestamps, game version, moves, board layouts, scores, results, and server start and finish times. We also record tutorial and help use, screen time, prompt responses, errors, referral domain and campaign/source labels.
- Technical details: broad browser, operating-system and device categories, plus bot and browser-automation flags. The server reads your IP address to limit abuse and your browser's user-agent to produce these categories. Our normal gameplay records do not store the raw IP or user-agent; hosting and network providers may keep request logs.
- Optional identity: your chosen leaderboard name, email address, sign-in requests, hashed codes or links, verification attempts, and mail preferences. Email sign-in connects your name and results across devices. Names, scores, ranks and some game statistics are public on leaderboards; email addresses are not displayed there.
- Duel: game activity and results; for multiplayer, room codes, access tokens, game settings, moves, clocks and an optional host name. Your opponent receives game state. The host name may appear in a shared invitation's preview. If you choose to share a game link, your chosen messaging or sharing service receives that content.
Storage on your device
We use a first-party visitor cookie called v36, with a two-year lifetime, and browser storage for your device ID, saved games, results, preferences, tutorial progress, waitlist details and queued events. Queued events can be sent when you reconnect. Tab storage holds temporary tab, multiplayer and Telegram information. The main game also caches files for offline play. Clearing site data removes local saves and identifiers, but does not erase server records.
When moving from our old Replit address to upto36.com, the game can transfer its saved browser data through a one-use server ticket.
Email and the waitlist
If you enter your email, we send a sign-in code or link and may send one reminder if you have not confirmed it. Eligible players with a verified email and a leaderboard name can receive results, record and ranking updates, streak reminders, summaries and occasional game announcements. These game emails are enabled by default unless you turn them off. Use the game's mail setting or an email's unsubscribe link to stop them. Requested sign-in emails are separate.
The ranked-opening waitlist is separate: its address is used once to tell you the board is open, then deleted from that list. No marketing and no sharing for anyone else's use. The email provider processes the address to deliver that message. Removal before sending is available from the waitlist panel on the device used to join.
Who receives data
We do not sell your data or share it for other companies' marketing. Service providers process data to operate Upto36: Replit and Replit PostgreSQL for hosting and storage, Cloudflare for site delivery and protection, and Resend for email delivery. Email delivery includes your address and the message content. Authorized administrators can review stored activity and account records to operate the game.
If you use the Telegram game integration, Telegram supplies interaction and user/message identifiers. A signed game ticket contains your Telegram user ID and a chat/message or inline-message ID. We send these identifiers and your score back to Telegram to update its game scoreboard, which may be visible in the relevant chat. We also exchange commands needed to open and share the game. Our Telegram event records keep action or score, day and outcome, rather than the ticket's user/chat identifiers. Telegram handles its own data under its own policies.
Our play-only portal builds, such as PLiCy, still send gameplay data to Upto36. They use a random visitor ID in browser storage and the x-v36 request header instead of our visitor cookie. They do not offer our name, email, waitlist or account features. Portal providers have their own privacy practices.
How long data stays
Most server records, including gameplay, account history, mail delivery records and Duel rooms, currently have no automatic deletion deadline. Browser storage remains until cleared or replaced by the game or browser. Sign-in codes expire after 10 minutes; sign-in links and Telegram tickets after 24 hours. Expiry prevents use, but does not itself delete stored records.
Old-address transfer tickets expire after 30 seconds. Their saved-data payload is removed when claimed, or by cleanup that runs every 10 minutes while the server is running. Ticket metadata remains. Waitlist deletion after the opening email requires the operator to run the send-and-delete process; it is not a timed background task.
Your choices and requests
- Sign out on this device gives this browser a new visitor identity. It does not delete your email, old scores or server history, or unsubscribe you.
- Delete email in the game's identity panel unlinks a verified email across linked devices, removes email/name/sign-in-hash fields from the relevant account records, and deletes that address from the waitlist. Gameplay records and hashed mail history remain. For an unverified address, it only clears this visitor's pending sign-in details.
- Remove from waitlist deletes the matching email-and-device entry. If you no longer have that device's saved identity, contact us.
Contact upto36@etohum.com to request access, correction or deletion beyond these controls. There is no self-service button that erases all gameplay records. Depending on the law that applies to you, you may also have rights to object, restrict processing, receive a portable copy, withdraw consent where processing relies on it, or complain to your data protection authority.
Children
The game does not ask for age or verify it. Children should ask a parent or guardian before entering a name or email, and should avoid sharing personal details in names. A parent or guardian can contact upto36@etohum.com about a child's data.
Changes
We may update this notice as the game changes. The effective date above will identify the version.