Privacy policy

Document revision

Version: privacy-v13-2026-10-09. Public accounts are currently disabled; before enabling them, the operator completes the information specified in this document.

Operator and scope

This document covers DUEL at duel64.com, the closed cloud account test and the separately described local test. The developer is Ruslan Ukrainskyi, the independent No Limits brand, Ukraine; ФОП Український Руслан Валентинович. DUEL and No Limits are product and brand names, not the name of a registered company. This sole proprietor has been selected for future payments. Data and support contact: support@duel64.com. Registered address: Україна, 85711, Донецька обл., Волноваський р-н, селище Андріївка, вул. Польова, будинок 32. This document remains a draft.

Review date: 7 October 2026. When new data processing is enabled, we will update its description before it starts. The existence of this page does not mean that accounts or payments are ready or that store requirements have been met.

Support requests

Guests and account holders can use the support form. It stores the subject, type and message, reply email and optional phone number; signed-in requests also include the account identifier. Contacts are used to handle and answer the request, not to subscribe you to news. Do not send passwords, sign-in codes or sensitive data. Tickets are available only to the authorised project owner and retained for up to 30 days from submission. Status changes do not extend retention.

The owner can explicitly reply through the panel to the account’s verified email when it matches the ticket contact. Resend processes the recipient address and service reply text. The reply text, technical sending state and replay receipt are retained in the main database until the ticket’s original expiry and included in the account’s own export; deleting the ticket or account erases these records. Provider acceptance does not confirm delivery. Deleting a ticket cannot recall a sent email; recipient and provider copies follow their respective policies. The owner’s tab temporarily keeps an unfinished reply for safe retry until the same expiry. Replies do not subscribe players to advertising.

The current browser tab keeps a bounded unfinished submission and a receipt with a private deletion key so that reloads or lost replies do not create another ticket. It is scoped to the same account or guest, and retries require your action. Closing the tab or clearing site data removes this record. After confirmation, you can delete your ticket using the receipt. Account tickets are included in your own export and erased when the account is deleted. Replay protection after deletion keeps only a request checksum for up to 30 days, without message text or contacts. Backups require separate cleanup.

Profile photo

In the closed test, you can choose a regular JPEG, PNG or WebP photo of up to 10 MB and 13 megapixels. The browser crops a square from the centre and sends only a 256 × 256 image. The original photo, filename and EXIF are not sent. The server checks the pixels and creates a new PNG without metadata.

The photo is currently available only to the account owner: other players see a built-in symbol. One current photo is stored until it is replaced, the photo is deleted or the account is deleted. The file is included in your personal data export. Technical change acknowledgements without pixels are stored for up to 30 days and deleted in bounded cleanup passes. Previous images are not stored separately. Database backups may contain photos; the public backup retention period has not been approved yet.

Playing without an account

The guest profile and current local game exist only in the open application session. Without an account, XP, coins, statistics, levels, medals and lesson completions do not accumulate. You can view the moves of the current game. The guest session is not restored after leaving or reloading. Appearance settings are saved separately. Playing with a friend via a link uses a separate server room, described below.

Data from old guest and local profiles in earlier versions is not deleted automatically and is not resumed by a new guest sign-in. Manual transfer of game progress has been removed from the interface. Clearing site data removes old records and settings only in the selected browser. Nickname and country are user-selected data; exact location, phone contacts, camera and microphone are not requested for play.

Closed cloud account test

Email sign-in is available only to invited addresses. Cloudflare Workers and D1 process email, nickname, country, avatar, consents and a private copy of progress. Resend sends service sign-in codes to the specified email; open and click tracking is disabled. A code is valid for 15 minutes, and a session for up to 7 days. Public registration, promotional mailings and purchases are currently closed.

Email registration includes a DUEL password. Sign-in can use a one-time email code or a password with email or nickname. The server stores a protected password hash with an individual salt, not a plaintext password. The password is not written to progress or browser storage. Setting, changing and recovering a password require a fresh service email code; a change ends previous sessions. An account created through Google or a code can add a password in settings.

Google sign-in verifies the Google identifier and verified email, links them to the DUEL account and stores an encrypted grant for subsequent revocation. Your Google name and photo do not automatically replace your DUEL profile. Different accounts are not automatically merged. The link is retained until disconnected or the DUEL account is deleted; Google manages its own data under its own policies.

Account settings and profile are saved automatically. Older private copies are retained for compatibility. The server verifies the results of account games against bots and online games, records statistics and awards XP and learning coins under the current rules. An early resignation without enough moves remains in statistics without a reward. Local games and old copies do not verify server rewards, competitive ratings or paid access.

When a signed-in player solves a lesson in the account Academy, the application sends the answer to the server for verification regardless of the private backup setting. The server stores the successfully verified solution, lesson and account identifiers, catalogue and reward versions, the free Plus preview marker and completion time. A separate ledger records awarded XP and learning coins; repeating a lesson does not create a new reward. These rewards do not provide purchases or public ratings.

When offline, answers wait in the browser for submission separately for each account; no new reward is awarded before server confirmation. The browser also stores the last confirmed copy of Academy progress. Server solutions and the reward ledger are retained until account deletion. The server account export includes this data; account deletion erases it from the primary database and clears that account’s Academy queue and cache on the current device. Clearing the browser alone does not delete server records and may erase answers that have not yet been sent.

Completed online games are retained for up to 90 days: moves, result, game type and time. Participant links are stored separately; account history is available to its owner. Chat is not included in the archive. When an account is deleted, its history link is removed from the primary database; de-identified moves remain until their cleanup deadline. If result delivery fails, the working room is temporarily retained until the write is confirmed, so technical deletion may be delayed.

Matchmaking and competitive ratings

In the closed test, matchmaking connects two verified accounts with the same game type and time control. The server stores the request identifier, settings, waiting deadline, assigned room and repeated-request acknowledgements for up to 30 days. The opponent sees nickname, country and built-in avatar; email and personal photo are not disclosed. A block between accounts prevents them from being matched together. If no human is found within 12 seconds, quick matchmaking automatically starts a game with a virtual opponent. Opening the opponent profile reveals that it is computer-controlled and shows its level. These games do not change players’ competitive ratings.

Competitive ratings count only completed, verified human games from matchmaking and their rematches. Ratings are separate for chess and checkers and for time categories: bullet, blitz, rapid, long games and games without shared clocks. Bot games, private invitations and old local results do not change these ratings. Short games and the fourth or later rated game of the same pair in a day do not change them. Statistics and the rating change ledger are retained until account deletion.

The leaderboard is available to invited players and shows only real accounts with played rated games: a random public identifier, nickname, country, built-in avatar, rating and statistics for the selected category. Server export includes your own rating and change ledger. Account deletion removes its public identifier, rating, matchmaking requests and private ledger; the link to a shared game is cleared, while the other participant’s data is retained.

Guest game with a friend

When a room is created or an invitation accepted, the Cloudflare server receives the selected nickname, country and avatar. They are visible to the other participant. The server stores a random guest identifier, moves, clock time, connection state and result to validate moves and restore the game. A guest game does not create a public account and does not affect ratings or XP.

A protected __Host-duel_guest cookie, valid for up to 7 days, is used to return to your room. The browser also stores the last room identifier. Do not share the cookie: it confirms guest access. Clearing browser data may remove access to the game; the link alone does not restore an occupied player seat.

Chat is available only to participants: at most the 50 most recent messages of 240 characters each and 10 types of quick reactions. Messages and reactions in the room’s working state are cleared when the game ends. A waiting room is deleted after 15 minutes; an active room is limited to 24 hours, and a finished room is retained for up to 24 hours to restore the result. Cleanup is performed by the server and may be technically delayed. This does not promise immediate deletion from Cloudflare infrastructure backups: their retention periods still need to be checked.

Rate-limit counters use HMAC identifiers for the guest and IP address rather than plain addresses in the counter table. Their window is one minute; expired records are deleted in bounded batches during subsequent requests. This does not replace infrastructure technical-log retention rules.

To observe service operation, a separate protected database briefly stores room and guest identifiers, game and connection state, update time and deletion deadline. This information is available to the owner through a protected Cloudflare Access dashboard, is not used for advertising and is deleted in the next cleanup batches after the room expires. Passwords and chat content are not included in the summary. Statistics may lag and are not the total number of site visitors.

Do not send passwords, personal contacts or sensitive data in chat. A server block disables chat, reactions and new rematch requests; moves and clocks continue. For a guest, the restriction applies in that room. If both participants are signed into accounts, a contact restriction between their identifiers is also stored and prevents joint matchmaking.

A participant can report the opponent: a reason, optional comment of up to 500 characters, room identifier and server receipt. When a message is selected, the server itself copies it and up to two neighbouring messages from the current buffer; the client cannot substitute the evidence text. This copy is stored separately from chat and is available to the owner through the existing protected Cloudflare Access dashboard. Acknowledgement means storage, not review; the owner’s decision does not impose an automatic sanction.

In the closed pilot, the technical retention period for receipts and evidence is currently set to 30 days; the value is configurable on the server. This is a test setting, not an approved public retention policy. After expiry, records are hidden and deleted in bounded cleanup batches. You can delete your own report: the comment, evidence and review note are erased from the primary database, while a minimal receipt remains until its deadline to prevent recreation by a repeated request. Account export includes your own reports and contact restrictions; other people’s review notes are not exported. Account deletion erases its own reports and restrictions, and clears text and the target link in reports against that account. Backups require a separate cleanup procedure. Automatic moderation is not operating yet; account direct messages are described separately.

Account friends and direct messages

In the closed test, a player searches for another verified account by nickname and sends a request. Friendship begins after separate acceptance. Other players can access a random public identifier, nickname, selected country and built-in avatar; email, personal photo, consents and learning progress are not disclosed.

Direct messages are available only between mutual friends and contain up to 500 characters. The server stores text, participants, order, time and read marker for no more than 90 days. Pages are limited to 20 records. A block in either direction prevents contact, messages, new gifts and joint matchmaking; moves and clocks of a game already started continue. Removing a friendship ends access to the conversation in the interface, but your own messages remain in the export until their retention deadline. Do not send sensitive data.

A report of a received direct message stores its canonical text and the participants’ public profiles, reason and optional comment. This information is available to the owner through a protected dashboard. Retention is up to 30 days and no longer than the original message’s retention period. You can erase your own report; review notes are not included in your own export. Deletion of either participant erases the shared conversation and related reports from the primary database. Friendship records and read markers are retained until account deletion; command receipts for up to 90 days. Friends and Gold rate-limit counters last up to one minute and are then cleared in bounded batches.

Gold and gifts

Gold is a separate server balance for the gift catalogue. Learning points, XP and old local copies do not become Gold. Purchases, paid grants, automatic lesson awards and subscriptions are currently disabled. The server stores confirmed grants and spending, balance and policy versions, unique event, gift, quantity, cost, sender, recipient and time. These records are retained until the relevant account is deleted; a commercial retention period has not been approved yet.

You can send from 1 to 1000 identical gifts only to a mutual friend who has receiving enabled. They are stored as one stack. By default, the shelf shows designs and quantities to invited players; sender identity and the message are not published. The recipient can disable gifts, hide the shelf or individual designs, choose up to three favourites and separately enable sender display. A private message of up to 140 characters is available to owners of their own history for no more than 90 days; action receipts are retained for up to 90 days. You can export your own balance, settings, history and stacks.

When the sender is deleted, the recipient keeps the gift and quantity, and the sender identity is cleared. The gift text remains in the recipient’s own history until its deadline. Recipient deletion erases their gifts and stacks. The deleted account’s balance, Gold ledger, settings, entitlements and receipts are erased; other players’ private ledgers are retained. Gifts do not verify identity, fair play, competitive ratings or Premium.

Technical site requests

When duel64.com is opened, requests pass through Cloudflare. To deliver and protect the site, the infrastructure processes IP address, requested page address, request time and technical connection and browser information. This also happens when playing without registration.

This processing is needed for site operation and security, not an advertising profile. The exact logs available to the operator, their retention periods, processing regions and applicable transfer terms still need to be confirmed in hosting settings. We do not promise that infrastructure logs are absent or fully anonymous.

Support enquiries

Email to support@duel64.com is forwarded through Cloudflare Email Routing to the operator’s Google (Gmail) mailbox. These providers process the sender address, content and technical email information. Emails are used to respond to and resolve the enquiry; contacting support does not subscribe you to advertising. Do not send passwords, codes or unnecessary personal data.

The operator still needs to establish correspondence retention and deletion procedures. To request deletion of an email, you can contact the same address. Forwarding enquiries is not a registration-code sending service.

Separate local account test

The local service on the developer’s computer accepts email, password, nickname, selected country and avatar. It stores email, password hash, account identifier, verification status, dates and news subscription choice. The password is used to verify access; its hash is stored in the primary database.

Verification and recovery codes are provided in the DEV test mailbox. Real emails are not sent. This test does not prove ownership of a real email address and is not intended for public registration.

Through the separate “Save a copy” action, the local service receives private game progress and settings. The copy is private: it does not create a public rating or a right to purchase. The SQLite database and its file backups are located in a closed local directory.

To prevent frequent requests, the local service also stores counters with email, IP address or account identifier. Old protection records are cleared during subsequent service requests; cleanup runs periodically and deletes records older than an hour. The public Cloudflare backend is being prepared; this does not mean that test accounts or data have already been transferred.

Purposes, legal bases and recipients

Processing purposes are to provide the requested game and progress saving, verify access to an account in the test, restore access, carry out selected backup saving and protect the service from abuse. For public processing, the operator must establish applicable legal bases: performance of the requested service, legitimate interest in security and separate consent for optional mailings where applicable.

Cloudflare provides site delivery and protection, server accounts and progress. Resend sends closed-test service emails. Google provides optional Google sign-in in the closed test: it receives the sign-in request and processes it under its own policies. DUEL requests only openid, email and profile; it does not receive your Google password, mail, contacts or access to Google Drive. Sign in with Apple, advertising and analytics services are not connected.

Cloudflare may process technical data outside the visitor’s country, including outside the EEA. The operator must confirm applicable contracts, transfer safeguards and available regions. Data is not sold within the pilot’s current functions.

Retention and deletion

Local progress is retained until the user deletes site data; it has no automatic expiry period. In the local test, a session is designed for 7 days and a code for 15 minutes. Expiry of access to a code does not mean its record is automatically deleted from all copies.

Deleting a test account removes the user record and related sessions, codes, mailing-choice history, progress copy, current photo and its change receipts, verified Academy solutions, its reward ledger, own reports and contact restrictions, and protection counters linked to its email and identifier from the primary database. Network request counters are cleared separately. Database file snapshots require their own cleanup procedure; their retention period has not been approved yet. Complete deletion from all copies at once cannot be promised.

Before public accounts are enabled, retention periods must be established for incomplete registrations, security logs, consents and backups, along with procedures for executing deletion at providers. Details are available on the “Delete account” page.

Account settings and consent choices

In the closed test, a verified account separately saves theme, board, sound, effects and music volume, animation, coordinates and interface language. Automatic language is resolved on each device; a manual choice transfers between devices. Nickname, selected country and built-in avatar index are saved as profile data. This is not a transfer of XP or paid entitlements.

The browser stores the last confirmed settings version and a separate account change draft for that tab. Guest settings remain separate. In a conflict between devices, the player explicitly chooses a version. Drafts have no automatic deletion deadline; clearing site data removes them, and account deletion clears accessible drafts for that account on the current device.

The server stores current settings and the history of separate news and analytics choices, their versions, source and time. Acceptance of the terms and acknowledgement of the privacy policy are recorded separately. The historical shared checkbox is marked as a previous combined acknowledgement. News and analytics are voluntary and off by default; withdrawal is available in the account. Choosing analytics currently does not enable tracking or third-party scripts.

For safe retries after connection loss, the server stores a technical change receipt with action identifier, checksum and confirmed response for up to 30 days. Expired receipts are deleted in bounded batches; current settings and the consent ledger remain until account deletion. This is a technical period for the closed test; the public retention policy still needs approval. Export includes settings, the choice ledger and active receipts; account deletion erases this data and receipts from the primary database. Backups require a separate procedure.

Separate family learning profile

The closed family pilot uses a separate permanent learning profile with a UUID, without a child’s email or a regular game account record. New entry is restricted to a verified pilot sponsor; this is not public child registration. Available countries come from reviewed server policy. Legal readiness for a public or worldwide launch has not been confirmed.

The neutral admission form asks for country of residence and completed years before collecting a parent contact. Completed years are used to decide admission; the server stores country, age band, known-minor status, self-declaration source, policy versions and admission history. Date of birth and exact age are not stored in the permanent profile. Self-declaration cannot remove an established known-minor status.

For verification of the designated adult, their email, language, country and request identifier are sent to Epic Kids Web Services (KWS). DUEL stores a keyed digest of the email, the profile relationship, request and transaction identifiers, evidence source, and available original request, verification and consumption timestamps. KWS verifies that the designated representative is an adult; it does not prove parenthood. Separately, the adult declares authority as a parent or legal guardian and explicitly permits private learning; the server records the original Terms, Privacy Policy and direct-notice versions, the choice time and revocation history. Expiry of provider evidence does not cancel recorded consent.

The learning profile stores a chosen nickname, built-in avatar index, language, appearance and sound settings, verified lessons, learning progress, practice results, the current server game and technical action receipts. This is private chess and checkers with a computer opponent. Public profiles, player search, online games, chat, gifts, purchases, marketing emails and optional analytics are closed for this profile.

The permanent profile, verified lessons and learning summaries, settings, parent relationship and consent history remain until profile deletion from the primary database. They are independent of the temporary admission window of up to 7 days and code or session expiry. Raw practice records are limited to 30 days from creation; technical change receipts to 30 days, with receipts for still-retained practice kept until its expiry. Expired records are removed in bounded cleanup passes; an unfinished game does not become an invented result.

The verified representative can recover access using their email, explicitly select a child, review and export that profile’s own data, revoke learning or delete the profile. A recovery code lasts 10 minutes, recovery proof and a single-use device pairing code up to 5 minutes; a child session up to 7 days. Recovery and pairing do not create new consent or extend the original permission. Revocation closes learning without automatically deleting data; own export and deletion remain available even when the pilot is disabled.

Cloudflare Workers and D1 provide storage and access; Resend sends service recovery emails, and KWS processes adult verification under its own rules. DUEL does not receive documents or payment details supplied directly to the verification provider. Provider retention periods, international-transfer arrangements and backup cleanup require separate operator confirmation; deleting the primary record does not promise immediate removal of all copies or recall sent email. Learning data and codes in the browser remain only in tab memory; access uses an HttpOnly cookie, and a separate non-secret family-entry marker contains no UUID, email or code.

Your choices and rights

Advertising and optional analytics are disabled. Consent to news is separate from registration and service messages, is not selected by default and can be withdrawn in the test account profile. Mailings are not currently sent. Declining does not restrict play.

Depending on applicable law, you can request data access, correction, deletion, restriction of processing and portability, and object to certain processing; consent can be withdrawn. If GDPR applies, you can contact the competent supervisory authority. Write to support@duel64.com and specify “DUEL — personal data”. Do not send passwords or verification codes. Proportionate information may be required to verify the owner.

The described family flow is restricted to the closed pilot. Public child registration, reviewed geography and real KWS integration verification remain separate launch conditions. Do not enter someone else’s email or sensitive data in ordinary test forms.