TRON 2048 Duel Privacy Policy

What the extension collects

The extension creates a random guest identifier and opaque session token. It stores those values in chrome.storage.local so an anonymous session can continue between popup openings. The server stores a SHA-256 hash of the token rather than the token itself.

When you use online matches, the extension sends matchmaking tickets, match identifiers, provisional sequence, score, maximum tile, move count and board hash, and a compact final move journal. The server uses the journal to replay and verify a match result. Match records also contain random player/session identifiers, match timing, game seed, opponent type, and verified final board and score.

Requests can include your IP address through normal network delivery, an optional or generated request identifier, and standard HTTP metadata. IP-derived keys are used for unauthenticated rate limiting. The game does not ask for your name, email address, Chrome identity, browsing history, tabs, page content, contacts, payment information, or precise location.

Why the data is used

Data is used only to maintain anonymous sessions, authenticate API requests, pair players or provide a bot opponent, operate and reconcile live matches, verify submitted results, prevent duplicate requests, enforce rate limits, diagnose service failures, and keep the service secure.

There is currently no public leaderboard. The project does not include advertising or analytics SDKs, and it does not sell personal data.

Processors and data locations

The public Next.js site and API run on Vercel. Production game state, token hashes, idempotency records, matchmaking records, and rate-limit counters are stored in Upstash Redis. These providers process data as necessary to host, route, secure, and store the service under their own terms and configured service regions. No other analytics or advertising processor is present in the project.

Retention and deletion

• Anonymous server sessions expire after 30 days.
• Matchmaking tickets, match records, and active-match pointers expire after 48 hours.
• Completed idempotency responses expire after 24 hours; incomplete claims use a short lease.
• Rate-limit counters expire at the end of their configured window.
• The local guest identifier and token remain in extension storage until replaced, cleared, or the extension is removed.

Vercel and Upstash may retain operational or security logs according to the account configuration and their policies. The application does not define a separate analytics-log store.

You can remove local data by uninstalling the extension or clearing its extension storage. There is no in-product account page or deletion endpoint. You may request help with server-side deletion through the contact option on the extension's Chrome Web Store listing; the operator may need the anonymous identifiers available to you to locate records. Automatic expiry still applies when a record cannot be linked reliably.

Security and your controls

The API uses HTTPS in production, exact-origin CORS, opaque bearer tokens, hashed server-side token lookup, payload limits, idempotency checks, rate limits, and server replay verification. Production fails closed when its Upstash configuration is missing, invalid, or unavailable. No system can guarantee absolute security.

You can choose not to start an online match, stop using the extension, clear its local storage, or uninstall it. Removing local credentials prevents that installation from resuming the same anonymous session.

Children

TRON 2048 Duel is not directed to children under 13, and the service does not knowingly collect a child's name or contact details. If you believe a child has provided data, use the contact option on the Chrome Web Store listing.

Changes and contact

This policy may change when the extension's actual data practices or service providers change. The updated policy will be posted at this URL with a revised date. Questions, privacy requests, and deletion requests can be sent through the contact option on the extension's Chrome Web Store listing. No separate privacy email address is claimed by this project.