Privacy policy — Card games

Card games: Briscola and Scopa · Last updated: 29 September 2026

This Policy covers all One Boat Games card games: today Briscola and Scopa. They handle the same data, in the same way and with the same providers; where one game does something different, it says so.

1. Data controller

2. In short

Playing against the computer and with friends requires no sign-up. To take on players from around the world, the online match with the rankings, you sign in with your Google or Apple account: no password to make up, and no email address that we keep. The same account saves your progress and lets you find it on every device. What it involves is described in Section 4.

If you play against the computer, the whole match happens on your device. The games can only be used online, though: before and during the match they ask our server whether it can be reached, with a request that carries none of your data (see Section 6).

If you play online, with friends or with players from around the world, something has to tell the server who is coming back to the table: a profile. If you have no account, at your first match with friends the game opens an anonymous one, tied to that game and that device, with an automatic name (for example “Giocatore 4K7Q”). Signing in with Google or Apple links it to your account, and you find it on your other devices. What it holds is in Section 4.

A profile linked to Google or Apple is one for all the card games. The same account opens your profile in Briscola and in Scopa: name, avatar, table colour, experience and level are shared by all the games, while matches, points and Elo rating are kept separately, game by game.

3. What stays on your device

Each game saves locally:

• Your profile identifier and this device’s access token (and, for profiles opened before 28 September 2026, the recovery code)
• Your name (the automatic one, or the username you chose), your avatar, the table colour, your level and your Elo rating in that game
• Your settings (deck, language, animations, sounds)
• Statistics for the matches played on this device, practice against the computer included

Each game is a separate app and keeps this data on its own. In the Android app it lives in the application’s private storage and is removed when you uninstall it. In the browser version it lives in the local storage of the game’s site (IndexedDB) and is removed when you clear the site’s data from your browser settings.

4. What lives on our server

Only if you play online, with friends or with players from around the world. The profile holds:

• Your name (the automatic one, or the username you chose), your avatar and your table colour
• For each game: experience and level
• For each game you have played online: matches played, won, lost and drawn, total points scored and conceded, Elo rating

For each device linked to the profile we keep only the cryptographic fingerprint (SHA-256) of its access token, its creation date and the date it was last used. A profile can have at most ten linked devices, counting all the games; past that, the least recently used one is dropped.

Profiles opened before 28 September 2026 also have a recovery code: we keep only a salted cryptographic fingerprint of it (SHA-256), never the code itself.

Your Google or Apple account, only if you link it. We keep the identifier that Google or Apple assign to your account for our games (an anonymous code that on its own does not say who you are) and which of the two you linked. To sign you in, Google or Apple send us a signed token that may also contain your email address and your name: we do not read or keep them. The sign-in request, with its outcome, stays on the server for at most fifteen minutes and is then deleted.

Our server holds no email addresses, passwords, phone numbers, contact lists, advertising identifiers or information about your device model.

5. The name you choose

Without an account you don’t choose a name: the game sets an automatic one, which your friends see at the table. With an account you choose your username: it is the one field you fill in yourself, it is unique among all players, and other players see it during online matches, in every game. Pick whatever suits you: it does not have to be your real name, and we suggest not using your full name if you would rather other people did not see it.

6. IP address

To stop a script from opening connections over and over, each game’s server keeps a count of connections per IP address. The count covers the last minute and is deleted automatically within two minutes.

To know whether you are online, during practice against the computer the game sends its server an empty request about every thirty seconds. The server only answers “I’m here”: the request contains none of your data and is not kept, except in Cloudflare’s technical logs described in Section 8.

That number is not linked to your profile, is not used for anything else and is not disclosed to anyone. The legal basis is our legitimate interest in keeping the service reachable (Art. 6(1)(f) GDPR).

7. Matches

The state of an online match (the cards, the points, whose turn it is) lives on the server for the duration of the match and for twenty minutes afterwards, so that someone who disconnects can come back. After that it is deleted. The final result stays in your profile as a number, along with the others for that game.

8. Providers

The infrastructure belongs to Cloudflare, Inc., acting as processor: it hosts the game pages and the match servers (briscola.oneboatgames.com and scopa.oneboatgames.com), stores the profile, and produces technical traffic logs under its own policies.

The games use no analytics or profiling tools and show no advertising. In the browser version on a computer, the empty column to the right of the game is a space left in the page design: it loads nothing, contacts no one and collects nothing. Should it ever carry real advertising, this Policy will be updated first.

Sign in with Google or Apple. When you sign in, or link your profile, with Google or Apple, one of our pages opens and loads the sign-in tools of Google (Google Identity Services, by Google Ireland Limited) or Apple (Sign in with Apple, by Apple Distribution International). They ask you to sign in to your account and process your data as independent controllers, under their own privacy policies; we only receive what is described in Section 4. If you don’t sign in with Google or Apple, nothing of theirs is loaded.

9. Legal bases

• Performance of the service (Art. 6(1)(b) GDPR) for the profile and for running online matches: without that data online play cannot work. This also covers signing in with Google or Apple, which is needed to take on players from around the world and to find your profile on other devices.
• Legitimate interest (Art. 6(1)(f) GDPR) for the per-IP connection count and for the connection check, limited to the security and operation of the service.

10. Your rights

You have the right to request access to your data, its correction or erasure, restriction of processing, portability, and to object to processing based on legitimate interest.

You can delete the profile yourself, from the game: on the profile page choose “Delete profile” (in the “Your accounts” section if you linked Google or Apple, at the bottom of the page otherwise) and confirm. This deletes from the server the profile with its level, experience, stats and Elo for every game, the linked devices and, if there is one, the fingerprint of the recovery code; the username and the link to your Google or Apple account become free again. It cannot be undone. A linked profile is one for all the games, so it disappears from all of them. If you have an online match in progress, you need to finish it first.

To exercise them write to info@prgspace.com quoting your username (or, for an anonymous profile, the automatic name and the game): that is what lets us find the profile, because we hold no other data connecting you to it. To be sure the request comes from you, we will ask you to confirm it from the game (for instance by briefly changing your username to one we give you). There is one profile for all the games, so the request covers all of them. We reply within one month.

If you believe the processing breaches the Regulation, you may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with your own country’s supervisory authority.

11. Retention

The profile stays on the server until you delete it from the game or ask us to delete it (Section 10), and so does its link to Google or Apple. An anonymous profile you haven’t deleted stays on the server even if you clear the site’s data or uninstall the app, but from then on no device can open it. Local statistics stay on your device until you uninstall the app or clear the site’s data.

12. Children

The games collect no data that would establish a player’s age and are not specifically directed at children under fourteen. If you believe a child has given us personal data — for instance by typing their own name into the name field — write to us and we will take care of it.

13. Changes

If this Policy changes, the date at the top is updated. Earlier versions remain available on request. When a new card game arrives, this Policy is updated to name it before it is published.

14. Language

This Policy is a translation of the Italian original, which is also published on oneboatgames.com. If the two versions differ, or if anything here is unclear, the Italian version prevails.