Privacy

Anonymous play

You can play without an account. We store a random session identifier in your browser's local storage so the server can recognise you between matches on the same device. We don't store a profile, an email address, or a real name for anonymous players.

Each match you play is recorded so leaderboards and statistics work, keyed to that anonymous identifier rather than to you personally. If you register later, the results of your recent matches are replayed onto your new account so your record carries over.

Registered accounts

When you create an account we store the details needed to sign you in and show your record:

• Your email address and chosen display name. Your display name is public; everything else is not.
• A securely hashed password — we never store the plain text. If you sign in with Google or Discord instead, we store no password at all.
• Your gameplay data: match history, rating, attribute progression, and any cosmetics you own.

You can review or change most of this at any time on your profile page.

Information we collect automatically

Like any website, we process your IP address and basic technical details to deliver the game to your browser. We use this to route matches, keep play fair, prevent abuse, and rate-limit attacks. Most of this is handled by our network provider (see Who we share with below) and is not stored against your identity long-term.

We do not use Google Analytics, behavioural ad trackers, or any third-party analytics service. The ads we show are contextual — see Ads below.

We use the data above only to run the game and keep it healthy:

• To start matches, pair you with opponents, and simulate play.
• To maintain your account, statistics, and leaderboard standing.
• To keep matches fair — detecting cheating, bots, and abuse.
• To send essential account email, such as verifying your address or resetting your password. These go through our own mail server, not a third-party marketing platform.

If you are in the European Economic Area or the UK, our legal bases for this are: performance of a contract (providing the game and your account), our legitimate interests (security, anti-cheat, preventing abuse, and improving the game), your consent where the law requires it, and compliance with legal obligations where they apply.

We don't sell your data. We share the minimum necessary with the service providers that help us run the game, each acting as a processor on our behalf:

• Cloudflare — sits in front of the game as our network and security layer (content delivery, reverse proxy, and bot protection). It processes connection details such as your IP address to deliver pages and block abuse.
• Hetzner — hosts our servers. Your data is stored on machines located in Germany, within the EU.
• Google and Discord — only involved if you choose "Continue with Google" or "Continue with Discord". We then receive basic profile information and your email address from that provider to create or sign in to your account. Their own privacy policies govern what they do on their side.

We may also disclose information if we are required to by law, or where we genuinely need to in order to protect the safety, rights, or property of our players or of Glish Studio BV.

Ads

0-0.io is supported by ads. They are contextual: chosen by what's happening in the game, such as the mode you're playing, never by who you are. We don't profile you, build an advertising identity, or share personal data with advertisers, and there is no cross-site tracking. Where an ad is served by a third-party provider, we choose contextual providers that work without behavioural tracking.

We keep this to a small, functional set. None of it is for advertising or cross-site tracking:

• A sign-in token that keeps you logged in to your account.
• The anonymous session identifier described above, stored in local storage.
• A short-lived state cookie used only during Google or Discord sign-in to keep that flow secure.

We do not set advertising or cross-site tracking cookies, and the contextual ads we show don't rely on them.

We keep your account data for as long as your account is active. When you delete your account, we remove your personal data within a reasonable period, except anything we are required to keep for legal or security reasons. Anonymous match data is not tied to a person, and short-term operational logs are kept only as long as we need them for security and reliability.

We protect your data with industry-standard measures: encryption in transit (TLS), hashed passwords, short-lived sign-in tokens, EU-based hosting, and active anti-abuse protection. No system is ever completely secure, but we take reasonable steps to keep your information safe.

If you are in the EEA or the UK, you have the right to access your data, correct it, delete it, export it, restrict or object to how we use it, and withdraw consent where we relied on it. People in other regions have similar rights under their local laws.

You can already do much of this yourself from your profile page — change your name or email, reset your password, or delete your account. For anything else, email us at [email protected] and we'll help.

If you believe we've handled your data improperly, you can lodge a complaint with your data protection authority. In the Netherlands, where we are based, that is the Autoriteit Persoonsgegevens.

0-0.io is family-friendly, but it is not directed at young children. You must be at least 13 years old to use it. If you are under the age of digital consent in your country — 16 in the Netherlands — you need a parent or guardian's consent before creating an account. Anonymous play collects no personal profile either way, and any ads shown to younger players are contextual and never based on profiling.

If we learn that we have collected a registered account from a child below these ages without the required consent, we will delete it. Parents or guardians who believe their child has registered without permission can contact us at [email protected].

We may update this policy as the game grows. When we make a material change we'll make it noticeable, and the "last updated" date at the top will always reflect the current version.

The data controller for 0-0.io is Glish Studio BV, a company registered in the Netherlands.

Registered office: Keurenplein 4, 1069 CD Amsterdam, Netherlands.