CastellarPrivacy
Last updated 5 October 2026. Castellar is a small game made by one person. We keep as little about you as the game needs to work, we don't sell it, and we don't use it for advertising.
What we store, and why
| What | Why |
|---|---|
| Your display name, and the avatar and frame you pick | So your opponent and the games list can show who you are. |
| Your email address and a hash of your password (only if you make an email account; a guest has neither) | So you can sign in on another device. We never store the password itself. |
| Your match records: the games you played, the moves in them, who won, and your wins and losses | To run the matches, let you resume one, and show records next to names. |
| A hash of each sign-in session's token, and when it was last used | To keep you signed in. |
| The suggestions you send from the game: what you wrote and its kind, your player id, the game's version and your platform (such as Windows or Android), the match you sent it from, and an email address only if you tick "You can contact me for additional details" | So we can read them, fix what you found and track what we did about each one. |
Nothing else: no real name, no address, no payment details, no contacts, no location, no advertising or tracking ids. This site sets no cookies and loads nothing from other companies.
Balancing the game
We use anonymous match data to balance the game: what was played in each match (the cards, the moves, the points, the result, and whether it was against a person or the computer), with no names, emails or player ids. Only we, and the tools we use to analyse it, can read it; no other player can.
Suggestions
Only we read the suggestions you send, with the tools we use to manage them; no other player can. We keep an email address with a suggestion only when you tick "You can contact me for additional details": with the box unticked, no email is kept even if you typed one. With it ticked and the field empty, we use your account's email (a guest has to type one). We write only to people who ticked the box, and only about what they sent. The tools we use to analyse the game can count and read suggestions without any email or player id.
Playing in your browser
The browser version of the game, at /play/, keeps your sign-in and your settings in your browser's storage for this site, the way the downloaded game keeps them in a file on your computer. It is not a cookie, only the game reads it, and the page loads nothing from other companies. Clearing this site's data in your browser signs you out and resets your settings; for a guest, it also loses that guest, because a guest has no email or password to sign back in with.
Rate limiting
To stop password guessing and floods of sign-ups, the server counts sign-in, sign-up, name-check and suggestion requests per IP address for a few minutes (at most a day, for suggestions). The counts expire on their own; your IP address is not stored with your account.
Server logs
Like any web server, ours logs each request with the IP address it came from, for troubleshooting. Those logs stay on our server and are discarded when the server software is updated.
Crash reports
When the game or our server hits an error, a report can be sent to Sentry, the service we use to find and fix bugs. A report carries ids (your player id and the game's id), the game's version, what went wrong, and basic system details such as your operating system. It never carries your email, display name, password or session token. Sentry deletes reports after at most 90 days.
The game's reports can be turned off in Settings → Privacy → Send error reports. It takes effect the next time the game starts.
How long we keep it
Your account and its match records are kept for as long as the account exists. Guest accounts are kept the same way, so a guest can come back on the same device.
Deleting your account
In the game, open your profile (the profile tile on the title screen; for a guest, the Create account panel it opens), choose Delete account and type DELETE to confirm. A match you are playing is resigned and a lobby you host closes. We remove your email, password hash and sessions and rename the player to "Deleted player". The match records stay, without your name, so your past opponents' records stay right. Your suggestions stay too, but we remove the contact email from them, so we can no longer write to you about them.
If you can't reach the game, email us from the address on the account (or, for a guest, tell us your display name) and we will do the same for you.
You can also ask us for a copy of what we hold about you, or to correct it, the same way.
Contact
Questions or requests: [email protected].
When this page changes, the date at the top changes too.