Privacy policy

Last updated: October 23, 2026

RuneBags is a free game with no advertising, created by Piero Barrette. This page explains what information the game uses, why, where it is kept, and how to have it deleted. In short: you can play without an account, the site uses no cookies, and your information is never sold or shared for advertising.

What stays on your device

Without an account, nearly everything stays in your browser: your preferences (language, theme, sound, music, animations), the game in progress against the AI, your statistics, the name and avatar you chose for online play, and a randomly drawn guest identifier. None of it is sent to the server unless you play online. Clearing the site's data in your browser removes all of it.

Online games

When you play online, the server receives your guest identifier, your player name and your avatar. The guest identifier is never shown to other players. The server keeps:

• a player record: name, avatar, number of games, wins, losses, streaks and rating;
• the history of your games (moves played, result, dates), so they can be replayed;
• the messages of a game's chat, kept with the room and deleted with it: at the latest 48 hours after the game ends, or 30 days after the last activity of a game left unfinished. They are never part of the history or of replays.

The world ranking and the profiles of players who have an account are public: they show the handle, the rating and the game history, never an email address or a chat message.

Account (optional)

An account lets you be ranked and find your games on several devices. It only needs an email address. There is no password: you receive a single-use sign-in link, valid for 20 minutes.

• Your address is encrypted in the database and is only used to send you those links. It is never displayed or given to other players.
• Sign-in links and sessions are only stored as hashes. A session expires after 180 days.
• Your handle is public.

Notifications (optional)

If you turn them on, the server keeps the subscription your browser gives it (a technical address from the browser's notification service, and encryption keys), along with your language. Notifications travel through your browser's service: Google for Chrome, Mozilla for Firefox, Apple for Safari. Turning them off in the game's settings deletes the subscription.

Anonymous audience counts

To know whether the site is useful and to improve the game, RuneBags counts, day by day, events that carry no identifier:

• visits, with the name of the site they came from (for example "google.com") and the language;
• the number of first visits;
• games started and finished, with the AI level or the result;
• opening the rules, online play and a game's review, and sharing.

Only daily totals are kept: nothing can tell two visitors apart. A marker kept in the open tab, and cleared with it, avoids counting the same visit twice. Your IP address is held in memory for at most a minute, to stop a robot from skewing the totals, then forgotten. If your browser sends the Global Privacy Control or Do Not Track signal, nothing is counted.

IP address

As with any website, your device's IP address reaches the server and the host so that traffic can be routed. RuneBags does not record it in its database. It is only used, in memory and for at most an hour, to limit abuse such as repeated requests for sign-in links.

Service providers

RuneBags relies on a few services that may process information outside Quebec, notably in the United States:

• Render, which hosts the site, the game server and the database;
• Cloudflare, through which the site's traffic passes;
• Resend, which sends the sign-in emails;
• ImprovMX, which relays the messages sent to the contact address;
• Google Fonts, which provides the typefaces: your browser downloads them directly from Google, which then receives your IP address;
• your browser's notification service, if you turn notifications on.

Retention

• Sign-in links: 20 minutes, then deleted.
• Sessions: 180 days at most.
• Account, player record and game history: as long as they serve the game (ranking, replays), or until you ask for their deletion.
• A game's chat: deleted with the room, as described above.
• Notification subscription: until you turn notifications off, or as soon as the browser reports it invalid.
• Audience counts: anonymous totals only.

Your rights

You can ask to see the information about you, to have it corrected or deleted (including your account and your email address), and withdraw your consent, for example by turning notifications off. Write to info@hexaequo.com; you will get an answer within 30 days. If the answer does not satisfy you, you can contact Quebec's Commission d'accès à l'information.

Person in charge

Piero Barrette is the person in charge of the protection of personal information for RuneBags. Any question: info@hexaequo.com, the address RuneBags shares with Hexaequo.

Children

RuneBags suits all ages. An account needs an email address: if you are under 14, ask a parent's permission before creating one.

Changes

If this policy changes, the date at the top of the page is updated.