Legal
Privacy policy
What Cogore collects, why, how long we keep it, and what you can do about it.
In short
- Guests play with no account. We set no cookies for guests, and your progress stays in your browser.
- An account needs an email address, a GitHub account or a passkey. We use your data to sign you in, sync your progress and keep the service safe.
- We do not sell or share personal information. We show no ads and use no third-party trackers.
- You can export or delete your data at any time in Settings.
Who is responsible
The controller of your personal data is Internet Technology Services LLC, a company registered in the United States.
For any privacy question or request, write to contact@cogore.com.
What we collect and why
| Purpose | Data | Legal basis |
|---|---|---|
| Play as a guest | Progress, boards and settings stay in your browser. When the server checks a guest run, it does not store it. | None needed |
| Your account | Email address, handle, display name, language, country if you set it, the time you confirmed that you are 16 or older, sign-in methods (GitHub id, login and email if you use GitHub), passkeys, two-factor settings and sessions. | Contract (GDPR Art. 6(1)(b)) |
| Sync and game features | Progress, runs and scores, streaks, marks and ratings, duels, challenges, saved boards, settings, daily results, shares, friends, rooms and room messages. | Contract (GDPR Art. 6(1)(b)) |
| Public features | Your handle, display name, country, scores and marks on the ranks and on a public profile. Both are off until you turn them on. Shares that you make public. | Contract. You choose what is public. |
| Security and abuse prevention | A keyed hash of your IP address for rate limits, sign-in and security events, the device type of each session, and the result of the bot check. | Legitimate interest (GDPR Art. 6(1)(f)): keep accounts and the service safe |
| Server logs | Request id, method, page, result and duration, with no IP address and no account id. Our network provider sees your IP address when it delivers a page. | Legitimate interest: run, protect and fix the service |
| Required emails | Sign-in codes and links, security notices, recovery notices and the account deletion notice, sent to your email address. | Contract and legitimate interest |
| Optional emails | Daily reminders, friend record notices and a weekly friend digest. They are off until you turn them on, and each email has a one-click unsubscribe link. | Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time. |
| Moderation | Text that other players can see: handles, display names, room titles, room messages, share titles, feedback and reports. A local filter removes emails, phone numbers, links and long numbers first. | Legitimate interest: keep shared spaces safe |
| Backups | Encrypted copies of the database, so we can restore the service after a failure. | Legitimate interest: keep your data safe |
| Legal records | The time you confirmed your age, and the dates of your privacy requests. | Legal obligation (GDPR Art. 6(1)(c)) |
Who receives data
We use service providers (processors) that act only on our instructions:
- Server hosting: the servers that run the API, the database and the cache.
- Network and storage: Cloudflare runs DNS, network protection and delivery of the site, and stores board documents, shared images, data exports and encrypted backups. It sees your IP address.
- Bot check: Cloudflare Turnstile checks that a person, not a bot, signs in, recovers an account or shares a board. It loads only at those steps.
- Email delivery: Cloudflare sends sign-in codes and notices. It sees your email address and the text of each email.
- Mailbox: Zoho receives and keeps the email that you send to contact@cogore.com, for example a privacy request, and our replies. It sees your email address and the text of each email.
- GitHub: only if you choose GitHub sign-in. GitHub then gives us your user id, login and verified email address. We do not keep your GitHub access token.
- AI moderation: an AI gateway (OpenRouter) sends text under review to a model, after the local filter. We ask for providers that keep no data. No model gets your email address, IP address or account id.
- Authorities, only when the law requires it.
We do not sell or rent personal data, and we do not share it for advertising.
International transfers
Some providers process data outside the European Economic Area and the United Kingdom, for example in the United States. Where the law requires it, we protect these transfers with the standard contractual clauses of the European Commission or an adequacy decision.
How long we keep data
| Data | Kept for |
|---|---|
| Sign-in codes and email links | 10 minutes |
| Two-factor sign-in steps | 5 minutes |
| Sessions | 30 days with no use, 180 days at most. Signing out deletes it at once. |
| Rate-limit counters | 24 hours at most |
| Room invites, duel tickets and duel offers | Until they expire |
| IP address hashes in the security log | 90 days |
| Security log (sign-ins, two-factor changes) | 400 days |
| Rooms after they close | 30 days |
| Data export download link | 24 hours |
| Unsubscribe links in emails | 90 days, then deleted within 30 days |
| Account recovery requests | 10 days at most |
| Notices in your account | 90 days |
| Room messages | 365 days, or 30 days after the room closes |
| Feedback that you send | 365 days |
| Reports and moderation decisions | 400 days after the decision |
| Run upload receipts | 90 days |
| Finished background tasks | 30 days |
| Server logs | 14 days |
| Backups | 30 days |
| Account data | Until you delete the account. Deletion runs 7 days after you ask, so you can change your mind. |
| Runs and scores after you delete the account | Kept with no link to you, so score charts stay correct |
| Data in your browser | Until you clear it |
Cookies and storage on your device
Guests get no cookies.
| Name | Kind | Purpose | Kept for |
|---|---|---|---|
cg_session | Cookie, strictly necessary | Keeps you signed in. Scripts cannot read it, and it travels only over HTTPS. | Up to 180 days |
cg_oauth | Cookie, strictly necessary | Protects the GitHub sign-in step. Set only when you use GitHub sign-in. | 10 minutes |
cogore-local | Browser database | Your progress, boards, settings and a random guest id, so the game works offline. | Until you clear it |
cogore:board:* | Browser database | Each board that you build, so it stays on this device and opens offline. | Until you clear it |
cogore-sim-keyframes-v1 | Browser database | Saved simulation steps, so replays open fast. | Until you clear it |
cogore-challenges | Browser database | Your challenge progress on this device. | Until you clear it |
cogore:* | Local storage | Your theme and motion choices, the level list view, and a sign-in step in progress. | Until you clear it |
cogore-* | Browser cache | Game files and level packs, so the game opens offline. | Until you clear it |
These are strictly necessary for the service, or you asked for them, so we show no consent banner.
We use no analytics cookies, no ad cookies and no third-party trackers.
Your rights
Under the GDPR and similar laws you have these rights:
- Access: get a copy of your data.
- Rectification: correct data that is wrong.
- Erasure: have your data deleted.
- Restriction: ask us to limit how we use your data.
- Portability: get your data in a file that a machine can read.
- Objection: object to uses based on legitimate interest.
- Withdraw consent: turn optional emails off at any time.
In Settings you can export your data, delete your account, change your email address, and turn emails, your public profile and your place on the ranks on or off.
You can also write to contact@cogore.com. We answer within one month. For a complex request we can take two more months, and we tell you in the first month. We may ask you to prove that the account is yours.
You can complain to a data protection authority, for example in the country where you live or work.
Automated decisions
Moderation can be automated: a model can hide a room message or a share title at once, and a new handle can wait for review or be refused by a fixed list. These decisions have no legal or similar effect on you.
To ask a person to review a decision, write to contact@cogore.com.
Do you have to give data?
Guests give no personal data. An account needs an email address, a GitHub account or a passkey, because we use it to sign you in, and your answer that you are 16 or older. Everything else is optional.
California notice
This notice at collection is for residents of California under the CCPA and CPRA.
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Email address, handle, account id, a keyed hash of the IP address | Yes, for accounts only |
| Internet or other electronic network activity | Your activity in Cogore: runs, progress, sessions | Yes, for accounts only |
| Inferences | Profiles about your traits or preferences | No |
| Sensitive personal information | Account log-in: your email address with sign-in codes, passkeys and two-factor secrets | Only to sign you in |
Sources: you, your device, and GitHub if you use GitHub sign-in.
Business purposes: to provide the game and accounts, keep the service secure, and fix errors. Retention: see How long we keep data.
We do not sell or share personal information.
We do not use sensitive personal information to infer characteristics about you.
We do not collect precise location, biometric data, or commercial or financial data. We offer no financial incentive for personal information.
You have the right to know, delete and correct your personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated differently when you use these rights.
To make a request, use Settings or write to contact@cogore.com. An authorized agent can ask for you with your signed permission. We check each request through your signed-in account or a code sent to your email address.
We confirm a request within 10 business days and answer within 45 days. If we need 45 more days, we tell you why.
We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing. We do neither, so nothing else changes.
Children
Cogore is not directed to children under 13. You must be 16 or older to make an account. Guests play with no account, and we then keep no personal data about them on our servers.
If you think a child under 16 made an account, write to contact@cogore.com and we delete it.
Security
We use HTTPS everywhere. Sign-in uses one-time codes, passkeys or GitHub, never passwords, and you can turn on two-factor sign-in. We store session tokens and IP addresses only as keyed hashes and keep two-factor secrets encrypted.
If a breach puts your data at risk, we tell the authority and you without undue delay, and within 72 hours where the law requires it.
Changes to this policy
When this policy changes, we update the date at the top and add a line below. If a change affects account holders a lot, we also email them before it applies.
- 2026-10-15: first version.