Privacy Policy

This policy describes how MSO Games ("we", "us") collects, uses, and protects information when you use the MSO Games website (msogames.com) and the MSO Games applications, including MSO FreeCell Arena and MSO Minesweeper Arena on Windows, macOS, Linux, Android, and iOS (collectively, the "Services").

If you have questions about this policy or your data, contact us at [email protected].

1. Information we collect

Account information

When you create an MSO Games account, we collect:

• Email address — used to log in, recover your password, and send service-related notifications
• Password — stored only as a salted scrypt hash (a computationally expensive key derivation function); we never see or store your plaintext password
• Display name — a randomly-generated handle we assign (for example, "NimbleNewt2523") that you can change at any time. It contains no personal information. It's shown to other players in multiplayer modes (Arena Queue and Group Play) and, for subscribers, on public leaderboards and profile pages
• Leaderboard visibility — a setting subscribers control; if you opt out, your name doesn't appear on public rankings (it still appears in multiplayer modes)

Device identifier

Each device you use the apps on generates a random unique identifier (a UUID). This identifier is associated with your account if you're signed in, or used anonymously if you're not. We use it to:

• Link multiple devices to the same account
• Detect duplicate accounts or suspicious behavior (anti-cheat)
• Allow you to play as a guest before creating an account

This identifier is not the same as advertising IDs (IDFA on iOS, AAID on Android) and we do not collect those.

Network information

When your device or browser contacts our servers we record the IP address the request came from and the user agent string your app or browser sends. We use these only to keep the Services working and honest — rate-limiting, blocking automated signup abuse, detecting duplicate accounts, and telling real players apart from automated test traffic in our own usage counts. We do not use them to locate you, build a profile, or target anything at you. They are stripped from the records we keep if you delete your account.

Steam account identifier

If you play a version of our games installed through Steam — including the free demo — the app reports your SteamID, the public numeric ID of your Steam account. We use it for one purpose: so that your gameplay history belongs to you rather than to a particular computer — your results, badges, and progress are tagged with it so they can be reunited with you after a reinstall, a dead machine, or a move to the full game. This recovery is automatic: once a game on a machine has confirmed your SteamID with Steam, the history from every other machine that has done the same is brought together into one, and the merge is permanent — it is additive and never removes anything. If a merge ever combines histories that should not have been combined, contact us and we can separate them. Signing in to an MSO Games account links your devices the same way.

We confirm the SteamID with Steam the first time a game launches, so the history is attached to the right player. This confirmation does not tell us anything about what you own or have paid for, and it does not change what the game gives you. We don't collect your Steam profile name, friends list, or any other Steam data, and we never publish your SteamID.

Hardware and system information

The apps report basic device characteristics so we can diagnose performance issues and decide which features to enable on lower-end devices. This includes:

• CPU model, architecture, and core count
• Total system memory (RAM)
• GPU information
• Operating system and version
• Screen size and pixel density
• App version and platform

Gameplay data

When you play a game and submit a result, we collect details of that game:

• Game type, difficulty, and game seed (the random number that determines the deal)
• Your stats: moves, time, undos, hints used, outcome (win or loss), timestamps
• A replay of the game, when your app sends one — the sequence of moves you made and the cursor positions over time, used to let you and other players watch the game back. We keep every replay we receive; see Data retention below

User-submitted content

• Survey responses — short opinion polls shown after some games to improve the apps
• Feedback reports — when you tap the feedback button, the text you write, plus an optional screenshot of the app and an optional debug log are sent to us so we can fix bugs
• Notifications you read or dismiss — we track this to avoid showing you the same message twice

Information we do NOT collect

• We do not collect your real name (only a randomly-generated display name, which you can change)
• We do not collect your physical address
• We do not collect your phone number
• We do not collect your contact list, photo library, microphone audio, or precise location
• We do not use third-party analytics SDKs (no Google Analytics, no Firebase Analytics, no Mixpanel, etc.)
• We do not use third-party advertising SDKs (no AdMob, no banner ad networks)

2. How we use your information

We use the information described above to:

• Provide the core features of the games (accounts, gameplay, save state)
• Compute and display leaderboards, statistics, percentiles, and badges
• Run daily challenges, player-vs-player challenge links, and group lobbies
• Enable replay viewing for top results
• Detect and prevent cheating, abuse, and duplicate accounts
• Diagnose bugs and improve performance based on the bug reports and hardware data you submit
• Send account-related emails (verification, password reset)
• Improve the games based on your survey responses and feedback

We do not use your information for:

• Targeted advertising
• Selling or renting to third parties
• Building marketing profiles about you
• Anything outside what's needed to run the Services

3. Where your data is stored

All data is stored on infrastructure operated by DigitalOcean (a US-based cloud provider) in their data centers:

• Account data, gameplay results, and aggregated statistics live in a managed PostgreSQL database in a private network
• Replay files and feedback screenshots are stored in DigitalOcean Spaces (an S3-compatible object store)
• The web server runs as a Flask application on DigitalOcean App Platform, serving msogames.com

Your data is transmitted between your device and our servers over HTTPS (TLS).

4. Who we share data with

We do not sell your data. We share your data only with:

• DigitalOcean — our cloud hosting provider, as described above
• Other players — your display name, game results, and replay data become visible on public leaderboards and profile pages, unless you opt out of leaderboard visibility in settings
• Amazon Web Services (Amazon SES) — we send account email (address verification, password resets) through Amazon's email service, which necessarily receives your email address and the contents of that message. It is used for delivery only
• Discord — our public community server carries an automated feed that announces Arena race results. It posts the winner's display name and the result; it never posts your email address, and it honours the leaderboard-visibility setting described above, so opting out of public rankings also keeps your name out of the feed
• Google Play Store / Apple App Store — only for the purpose of distributing the apps to you. We don't share your account data with the stores beyond what's required for app delivery and crash reports
• Law enforcement — only if compelled by valid legal process, and only the minimum required to comply

5. Your rights and choices

You have control over your data. You can:

• Change your display name at any time in your account settings
• Opt out of public leaderboards via the privacy setting in your account — your gameplay still counts toward your personal stats but your name is hidden from rankings
• Request deletion of your account and all associated data either (a) directly from inside any MSO Games app via the Account → Delete Account option (which prompts for your password to confirm), (b) on the web at msogames.com/delete-account using the email and password on the account, or (c) by emailing [email protected] from the email address on the account. Deletion is permanent, takes effect immediately, and cannot be undone. It covers everything we hold for you, including gameplay you recorded before signing in or while playing the demo.
• Request deletion if you don't have an account — if you've only played the demo or as a guest, there's nothing to sign in to, so email [email protected] with your SteamID (the numeric ID on your Steam profile) and we'll delete the gameplay history held against it. We may ask you to confirm the account is yours before we act.
• Request a copy of your data by emailing the address above
• Correct inaccurate data by editing your settings or contacting us

If you're in the European Union, the United Kingdom, or another region with comprehensive privacy laws (such as GDPR), you have additional rights including the right to object to processing, the right to data portability, and the right to lodge a complaint with your local data protection authority. We honor all such requests; please contact us at the address above.

If you're a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of any "sale" of personal information. We don't sell personal information.

6. Data retention

We keep your data while your account is active. If you delete your account, we delete your personal information and associated gameplay data within 30 days, except where retention is required by law.

When you delete your account we remove your gameplay outright — results, replays, badges, and progress. The device records that remain behind for the aggregate statistics described below are stripped of everything that links them to you: the account connection, the device identifier itself, your SteamID, your display name, and the network information we hold for anti-abuse. What's left cannot be traced back to you or matched to your devices.

If you play without an account — as a guest or in the Steam demo — your gameplay is held against your device and, on Steam, your SteamID, rather than against an account. We keep it so that your history can be reunited with you after a reinstall or a move to a new machine, and so it carries over when you create an account (see the note on automatic Steam recovery above). You can ask us to delete demo or guest gameplay at any time using the method described above. We also intend to remove demo gameplay that has gone unused for a long period, but that scheduled clean-up is not running yet — we will update this policy when it is.

Aggregated, anonymized statistics (for example, "how many players completed Daily Challenge #42") may be retained indefinitely for the purpose of running the leaderboards and historical data, but they cannot be linked back to you after deletion.

Replay files are kept for as long as we hold the game they belong to. We used to say that a replay might be deleted automatically once a record was broken and it dropped out of the top entries; that is no longer how the system works, and we now keep replays — features like watching your own past games and racing a rival's ghost depend on them. They are deleted when you delete your account or the associated gameplay data.

7. Children's privacy

The Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you believe your child has provided us with information without your consent, please contact us at [email protected] and we will delete the information.

8. Security

We use industry-standard practices to protect your data:

• All network traffic is encrypted using HTTPS (TLS)
• Passwords are hashed using scrypt with per-user salts; we never store plaintext passwords
• The database is hosted in a private network not accessible from the public internet
• Authentication uses short-lived JWT access tokens with refresh tokens

No system is perfectly secure. If we learn of a breach affecting your data, we will notify you within the time required by applicable law.

9. Changes to this policy

We may update this policy from time to time as the Services evolve. When we do, we'll update the "Last updated" date at the top of this page. For material changes, we'll also notify you via email or an in-app message.

10. Contact us

For any questions about this policy, your data, or to exercise your rights, email us at [email protected].

For general support, see [email protected].