Egret & Reed is a sole proprietorship established in California, United States, and is the controller of the personal information described here. If you require the name of the individual behind that business — for example in order to exercise a right under the UK or EU GDPR — write to us and we will give it to you. This policy explains what we collect, why, who else handles it, how long we keep it, and the rights you have over it. Contact for any of it is letsplay@egretandreed.com.
Personal information means any information relating to an identified or identifiable individual. It does not include information that has been anonymised so that it can no longer be linked to a person.
From visitors to our website and from Users who create an account and play on our Platform. We do not buy personal information from data brokers, and we do not collect it from anyone other than you.
| What | Why |
|---|---|
| Email address | It identifies your account, allows you to sign in, and allows us to contact you about it. |
| Name or display name | It appears on your seat so other players at your table know who they are playing. |
| Password | To secure your account. It is stored only as a cryptographic hash by our authentication provider; we never see or hold the password itself. |
| Correspondence you send us | To answer you. |
| What | Why |
|---|---|
| Lessons completed, points, wins, games played, streak, chips, tile set and preferences | So the Platform remembers your progress between visits and across devices. |
| The moves made at a shared table | To play the hand. They pass between the players at that table and are not retained afterwards. |
Our hosting and database providers record standard server logs when your browser makes a request, including your IP address, browser and device characteristics, the pages requested, and the time of the request. These logs exist for security, diagnosis, and keeping the service running. We do not use them to build a profile of you and we do not combine them with your account to track your behaviour.
If you sign in with Google, Google provides us with your name, email address, and profile picture. Nothing further. We never receive your Google password and we request no permission to read anything else in your Google account. Google retains its own record of the sign-in, governed by Google's privacy policy.
We do not ask for your postal address, telephone number, or date of birth. We do not receive or store payment card details. We do not use advertising identifiers, web beacons, or tracking pixels, and we run no analytics product of any kind.
Video exists only at a private table you open or join by invitation, and only after you choose to switch your camera on. When it is on, the picture and sound travel directly between the browsers of the players at that table over a peer-to-peer connection. They do not pass through our servers, we cannot view or record them, and we do not store them.
To establish that direct connection, each browser queries a public STUN server operated by Google to discover how its own network address appears externally. That server observes the network addresses involved in setting up a call and nothing of its content.
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have never done either. We disclose personal information only to the service providers below, who process it on our instructions and for no purpose of their own.
| Provider | Purpose | What it handles |
|---|---|---|
| Supabase | Authentication and database | Your account and progress; server logs |
| Netlify | Website hosting | Server logs, including IP address |
| Sign-in, if chosen; typefaces; STUN for video | Sign-in identity; request metadata | |
| jsDelivr | Delivery of one software library | Request metadata |
Where we introduce a payment provider, it will process the details of your purchase directly, and this policy will be updated to name it before that happens. We may also disclose personal information where required by law, to enforce our terms, or to protect the rights, property, or safety of any person.
If you are in the United Kingdom or the European Economic Area, we rely on the following bases under the UK GDPR and EU GDPR:
Account and progress information is kept for as long as your account exists. When you delete your account it is deleted with it. Server logs held by our providers are retained for their standard periods, which are measured in days rather than years. The moves at a shared table exist only for the duration of the hand, and only in the browsers playing it.
Our providers store and process information in the United States. If you are located in the United Kingdom, the European Economic Area, or elsewhere outside the United States, your information is transferred there. Where such a transfer occurs we rely on the Standard Contractual Clauses offered by those providers, together with the UK Addendum where applicable, as the safeguard for it.
Connections to the site are encrypted in transit. Passwords are stored only as hashes by our authentication provider. Access to the database is restricted by row-level security so that an account can read only its own record, and the record of what an account has purchased cannot be written from a browser at all. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Platform is intended for Users aged sixteen (16) or over. We do not knowingly collect personal information from anyone below that age. If you believe a person under sixteen has created an account, write to us and we will delete it.
You have the right to request access to the personal information we hold about you; to have inaccurate information corrected; to have it erased; to restrict or object to our processing of it; and to receive it in a portable form. Where we rely on consent you may withdraw it at any time, without affecting processing carried out beforehand. You also have the right to lodge a complaint with your national supervisory authority.
You have the right to know what personal information we collect, use, and disclose; to request its deletion; to request correction of inaccurate information; and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we do not process sensitive personal information for any purpose that would give rise to a right to limit. Under California Civil Code Section 1798.83 you may also request information about disclosures to third parties for their direct marketing purposes; we make no such disclosures.
Residents of states with comprehensive privacy laws — among them Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia — have comparable rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and profiling. We carry out no targeted advertising, sale, or profiling.
Write to letsplay@egretandreed.com from the address on your account. We will respond within the period required by the applicable law. We will not discriminate against you for exercising any of these rights.
We use only what is strictly necessary to keep you signed in and to remember your preferences, and we set no advertising or analytics cookies. Our Cookie Policy explains this in full.
We update this policy as the Platform changes, and the revised date at the top will always show when. Where a change is material — where we begin collecting something new, or a new provider begins handling your information — we will give notice in the app before it takes effect.
Write to letsplay@egretandreed.com.
← Back to Egret & Reed