Privacy policy

Who is responsible for your data

BridgeArena is run by an individual sole trader, trading as BridgeArena, in Singapore. That person is the data controller for everything described below and can be reached at privacy@bridgearena.net .

BridgeArena is operated from Singapore, and Singapore's Personal Data Protection Act governs what we do with your data. We are not established anywhere else, and we do not direct the service at any particular country — the site is in English, prices are in US dollars, and we do not advertise regionally.

Wherever you live, we apply the standard set out on this page to your data. Some of the rights below — a portable copy, withdrawing consent, objecting to a particular use — come from data protection law elsewhere rather than from Singapore's. We extend them to everyone rather than working out who is entitled to what.

What we store

Everything here is stored in one PostgreSQL database on our own server. The list is exhaustive at the date above.

Your account

• Your email address, username and display name. A password is stored only as a hash; we never hold the password itself.
• When you confirmed your email, and when you last authenticated. Session tokens for each device you are logged in on.
• Whether your profile is public, and your presence status — online, idle, do not disturb or invisible.
• If you sign in with Google, GitHub, Discord or Facebook: one record per connected provider, holding that provider's name, its own identifier for your account there, and the address it last reported. The next section is what that means.

Your settings

• Notification preferences: whether follow requests, accepted follows, new followers, game invites and new messages reach you by push, email, both or neither.
• Privacy preferences: who may message you, who may invite you to a game, and who can see your online status and your statistics.
• Appearance and gameplay preferences: theme, reduced motion, card size, default scoring format and board count, kibitzer visibility, card-play confirmation, trump position, sound effects, turn notifications and your auto-idle timeout.

Your play

• Every game you sit at and the seat you took, every board dealt, every call in the auction, every card played, every contract and every result.
• Team matches you created or played in, and the aggregate statistics and rating derived from your results.
• Where AI coaching is enabled for your account: the mistakes detected on your boards, the coaching notes written about them, and which coached boards you have viewed.

Your social activity

• Table chat, direct messages and the conversations they belong to, and comments you post on boards.
• Who you follow, who follows you, and who you have blocked.
• Game invites you send or receive, and the notifications generated from all of the above.

Your subscription

• If you subscribe: which tier, its status, when the current period ends, and the identifiers Paddle uses for your subscription and for you as their customer.
• The raw billing events Paddle sends us, stored as received so a mis-processed event can be replayed. These payloads contain Paddle's customer and transaction identifiers, and may contain your billing country and the last four digits of a card — they never contain a full card number.
• Which ranked games you have used your weekly allowance on.

When you write to us

• The emails you send to our published addresses and our replies to them, held in the mailbox they arrive in. If you write to us about your data, that correspondence necessarily contains whatever you told us in it.

Technical records

• Server logs, kept short-term for debugging, and aggregate performance metrics that contain no personal data. Our own log lines identify a request by a generated request id, not by who made it.
• Your IP address, in passing. A request cannot reach a server without one, so every request you make carries your address to Cloudflare, who sit in front of this site, and on to the machine the application runs on. We keep no record of our own: no table here has a column for an address and no log line carries one, it is stripped out of our error reports before they are sent, and it is deliberately never given to the connection a live table runs on. Cloudflare and Hetzner keep their own logs of the traffic they carry, under their own retention rather than ours.

Signing in with Google, GitHub, Discord or Facebook

You can create a BridgeArena account with an email address and a password, or by signing in with an account you already hold somewhere else. Connecting one is optional, signing you in is the only thing it is ever used for, and you can disconnect it again.

What the provider tells us

• Their own identifier for your account there — a string they issue and do not reuse. It is the only thing we recognise you by when you come back, because an email address can change hands and is the wrong thing to be known by.
• Your email address, and whether they say they have verified it. If you are signing up rather than signing in, that address becomes the address on your BridgeArena account. We keep a copy beside the connection, refreshed each time you sign in, so that Settings can tell you which account is connected.
• Your name or username there, where the provider supplies one — read once, to fill in your BridgeArena display name as the account is created. It is yours to change afterwards, and we never refresh it from the provider again.

What we ask them for, and what we cannot do

• We ask for sign-in and nothing else: who you are, and your email address. From Google that is the email and profile scopes, and no others.
• We never receive your password at any provider — the whole point of signing in this way is that you do not give it to us.
• We ask for no access to anything you keep there: no contacts, mail, calendar, files, photos, friends or followers. We cannot read, post, send or change anything in your account at that provider, because we never asked for permission to.

What we do with it

• We use it to sign you in, and to create or find the BridgeArena account it belongs to. That is the whole of it; there is no second use.
• We do not sell it, we do not use it for advertising, and we do not pass it to any of the processors listed below. In particular it never reaches the coaching engines, which receive the bridge content of a board and nothing about who you are, and it is not used to train any model.
• None of it is shown to other players. Your BridgeArena username and display name are public; the address your provider reported is not.

Google user data. BridgeArena's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

• Settings → Account lists every provider you have connected and disconnects any of them. We ask you to sign in again first, because it changes how you get into your account. Disconnecting deletes the record described above.
• You can revoke our access from the provider's side instead, in its own account settings — for Google, under the third-party access section of your Google Account.
• Deleting your BridgeArena account deletes these connections with it, as part of the deletion described further down this page.

What we do not store

• No card or bank details, ever. Paddle is the merchant of record and takes payment on their own pages; card details are entered with Paddle and are never sent to, seen by, or stored on our servers.
• No advertising, and no tracking across sites. There is no advertising network and no advertising pixel on any page of this site, and nothing here follows you to another one. There is one analytics script — see below — and it sets no cookie and builds no profile of you.
• No stored IP addresses, and no location beyond a country. We keep no log of the addresses that visited, and there is no geolocation of any kind here — nothing tries to place you more precisely than the country a request arrived from, which is the most either the analytics or a billing address ever says. See the note above for what happens to your address on the way in.
• We do not sell your data, and we do not share it with anyone except the processors listed below.

Why we store it, and on what basis

• To provide the service — your account, your games, your results and your messages exist because running a bridge site requires them. This is processing necessary to perform our contract with you.
• To take payment — subscription and billing records exist to know what you are entitled to and to resolve billing disputes. Contract, and our legal obligation to keep transaction records.
• To keep the site working and safe — logs, metrics, blocks and rate limits. Our legitimate interest in a service that stays up and is not abused.
• To send you email you asked for — confirmations, sign-in links and the notifications you switched on. Contract, and your consent for anything optional. Every notification category can be switched off in Settings.

Who else processes your data

These are the only third parties that receive any of it.

• Paddle — our merchant of record. Paddle sells the subscription, takes the payment, handles tax, and holds the payment details. Their own privacy notice governs what they do with the data you give them at checkout. We receive from Paddle only the subscription state and identifiers described above.
• Brevo — delivers our transactional email. Receives your email address and the contents of the message being sent to you.
• Google (the Gemini API) — writes AI coaching notes and board reviews, for accounts where coaching is enabled, and reads a picture of a bridge diagram when you paste one into the endgame form. Receives the bridge content of the board being analysed — the deal, the auction and the play — or the picture you pasted, which is not stored. It does not receive your email address, your username or your account identifier.
• DeepSeek — the fallback for those same notes and reviews, asked only when Google cannot answer. When it is asked it receives the same bridge content and nothing more; like Google, it never receives your email address, your username or your account identifier.
• Grafana Cloud — receives aggregate performance metrics from our server. These are counters and timings; they contain no personal data.
• Hetzner — hosts the server the application and database run on, in Germany. The machine necessarily handles the address each request arrives from, in the same way the post office handles an envelope.
• Cloudflare — sits in front of the site, so every request you make reaches us through them, and they protect it from attack and abuse. Cloudflare also stores our encrypted database backups in R2 object storage, and routes the email you send to our published addresses: a message to us passes through Cloudflare on its way to the mailbox.
• Cloudflare Web Analytics — counts page views and measures how quickly pages load. It receives the address of the page, the site you arrived from, and the browser, device type and country the request came with. It sets no cookie, stores nothing on your device, and has no way to recognise you on a later visit or on anyone else's site, so it cannot build a profile of you or follow you around. There is no advertising attached to it and the figures are only ever read in aggregate.
• Google — hosts the mailbox those addresses deliver into. Anything you write to us, and our reply to it, is held in Gmail.

Where your data is held, and where it travels

• The database lives in Germany, on our server at Hetzner. That is where your account, your games and your messages actually sit.
• We administer it from Singapore. The person who runs BridgeArena is in Singapore and reaches the server from there, so your data is accessed from outside the country it is stored in.
• The processors listed above operate in various countries, most of them outside Singapore. Sending a coaching board to Google (or, when Google cannot answer, to DeepSeek), an email to Brevo or a payment to Paddle means the relevant data leaves the server in Germany.
• We only use a processor that is bound to protect your data to a standard comparable to the one described in this policy, and we send each of them the least we can — the coaching engine, for instance, gets the bridge content of a board and none of your identity.

What is public, and what a shared link exposes

• Your username, and your statistics if you have made them public, appear on the leaderboard and on your profile. The visibility of your statistics and your online status is yours to set in Settings.
• Share links bypass sign-in by design. When you share a board or a game, we mint a link containing an unguessable token. Anyone who has that link can read that board or game — including the deal, the auction, the play and the comments on it — without an account and without logging in. Treat a share link as public.

How long we keep it, and how to delete it

You can delete your account yourself: Settings → Account → delete account. You will be logged out immediately and the deletion runs as a background job shortly afterwards.

• Deleted outright: your session tokens, statistics and rating, follows, blocks, game invites, notifications, board comments, and your membership of any conversation.
• Kept, but detached from you: games and team matches you created, seats you occupied, chat messages and direct messages you sent. The link to your account is removed, so these records no longer identify you, but they are not erased — deleting them would corrupt the game history of everyone else who played those boards.
• Kept for as long as the law requires: billing and transaction records, which we and Paddle are obliged to retain.
• Encrypted backups are retained on a rolling schedule and expire on their own; a deletion is not applied retroactively inside an existing backup.

Your rights

You can ask us to:

• give you a copy of your data, or correct it if it is wrong;
• delete it, which you can also do yourself in Settings → Account;
• restrict or stop a particular use of it;
• object to processing we do on the basis of legitimate interests;
• send it on in a portable form — a machine-readable copy of the data you gave us and the records of your play, either to you or, where technically feasible, to another service. Your games already export as PBN, the standard bridge interchange format.

Where we rely on your consent — the optional notification emails — you can withdraw it at any time in Settings, without affecting anything we did while it was in force.

Most of this you can do yourself in Settings; for anything else, write to privacy@bridgearena.net and we will respond within 30 days.

If you think we have handled your data badly, you can complain to a regulator — the Personal Data Protection Commission in Singapore, or the data protection authority for the country you live in. You can complain without asking us first, though we would rather have the chance to put it right.

Cookies and local storage

We set one cookie: the session cookie that keeps you logged in. It is strictly necessary and there is no consent banner because there is nothing optional to consent to — the analytics described above sets no cookie either, which is the reason there is nothing to ask you about. Your browser also stores your chosen theme, and the column layout of the board history table, locally on your device — neither is sent to us as a cookie. Paddle sets its own cookies on its checkout, governed by their policy.

Children

BridgeArena is not intended for children under 16. We do not knowingly collect data from anyone under that age; if you believe a child has created an account, write to privacy@bridgearena.net and we will remove it.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects what we do with your data, we will email registered accounts before it takes effect.

Contact

Data protection: privacy@bridgearena.net . Anything else: support@bridgearena.net . See also the contact page.