What Janggi collects
You can play without signing in. In that case your current game, progress, bot record, preferences, onboarding state and custom styles stay in your browser. Janggi does not send them to the account service.
If you choose Google sign-in, Janggi asks Google only for the openid scope. Google supplies a stable Google account identifier so the same account can be recognised later. Janggi never receives your Google email address, real name, profile or contacts.
The account service keeps that identifier, an internal account identifier, when the account was created, a generated or user-chosen display name, hashed session records and the data you choose to sync: XP and unlocks, bot ratings and game history, preferences, custom board and piece styles, and markers for styles you deleted. A game still in progress is not synced.
If you turn on Tell me when it is my turn in Settings, your browser gives Janggi an address at its own push service, and the keys needed to send to it, for that device. The account service keeps them with your account so it can send a notification when your friend has moved. Each notification carries your friend's display name, encrypted so that only your device can read it; the push service that delivers it (Google, Mozilla or Apple, depending on your browser) sees the address and that a message was sent, but not what it says. Turning the setting off, signing out or deleting the account removes the address.
Cloudflare also processes connection information such as your IP address to deliver requests, limit sign-in attempts and writes, protect the service from abuse and produce operational logs when something fails.
How Janggi uses information
Account information is used only to sign you in, show your chosen display name, merge your saved data and keep it in step across your devices. It is not used for advertising, marketing, profiling or automated decisions with legal or similarly significant effects, and it is never sold.
The lawful basis for account and sync processing is performing the service you ask for when you sign in. Security, rate limiting and fault diagnosis rely on the legitimate interests of operating a safe and reliable service. Information may also be processed where necessary to meet a legal obligation.
Cookies and local storage
Janggi uses local storage so the game can reopen where you left it and work offline. It also caches the application files through a service worker. These are functional parts of the game, not advertising or analytics tools.
Starting Google sign-in creates a secure, HTTP-only attempt cookie lasting up to ten minutes. A successful sign-in creates a secure, HTTP-only session cookie lasting up to thirty days. Both use SameSite=Lax. There are no advertising, analytics or marketing cookies.
Who handles information
Neil Armstrong is the data controller. Google handles the sign-in screen and confirms the stable account identifier. Cloudflare hosts the account API, database, security controls and operational logs. GitHub Pages serves the public game files. These providers process information under their own terms and privacy notices.
Those providers operate internationally and may process information outside the United Kingdom using the legal safeguards applicable to their services. Information is not shared with other organisations except where required to run Janggi, protect it from abuse, or comply with law.
How long information is kept
Browser data remains on your device until you clear it. Account and synced data remain until you choose Delete my account in Settings or ask for deletion. That action deletes the live account, synced data, its sessions and the notification addresses of its devices. It does not erase the copies already held on your own devices.
The sign-in attempt cookie expires after ten minutes and the browser session cookie after thirty days. Expired hashed session records can remain with the account until it is deleted, but cannot be used to sign in. Infrastructure logs and backups may remain for the limited periods set by the hosting providers.
Your choices and rights
Sign-in is optional. You can change your display name, sign out without deleting local progress, or delete the server account from Settings. You may also ask to access, correct, erase, restrict or receive your personal information, and object where processing relies on legitimate interests. These rights can vary where an exemption applies.
Contact janggi@neilarmstrong.dev to exercise a right. You may also complain to the Information Commissioner’s Office through its official website at ico.org.uk.
Children
Janggi is a general-audience board game and does not ask for a date of birth. If you are not legally able to make these choices yourself, a parent or guardian should decide whether you use Google sign-in. A parent or guardian can contact Janggi about an account in their care.
Changes to this policy
This page will be updated before Janggi materially changes the Google data it requests, the information it stores, why it uses it, or who handles it. The effective date above shows when this version began to apply.
Contact
Janggi is operated by Neil Armstrong in Northern Ireland. Privacy questions and requests can be sent to janggi@neilarmstrong.dev.