← Back to Home

Privacy Policy

Last updated: July 12, 2026

1. Who We Are and Scope

Alibi is an online noir detective game. This Privacy Policy explains how we collect, use, and protect your personal data when you play at https://the-alibi.com. For game mode details, see our Game Modes page.

We are the data controller for the information you provide (username and password) and the gameplay data we automatically collect while you play.

2. Data We Collect

When you create an account:

  • Username: 1–16 alphanumeric characters you choose
  • Password: 4–24 characters, hashed securely

We do not collect: email, real name, date of birth, phone number, or any location data.

When you play:

  • Game moves and decisions: Every action you take in a match
  • Role and outcome: Whether you were assigned inspector/murderer/observer and if you won
  • Chat messages: Text you type in room chat (limited to 100 characters each)
  • IP address: Used only for rate limiting and DDoS protection

3. Why We Use Data and Legal Bases

Your username and password are used to authenticate you and link your gameplay to your account.

Your gameplay data is used to:

  • Enable match replay
  • Prevent cheating and fraud
  • Improve our AI opponent (if you play against AI)

Your IP address is used to rate-limit requests (max 100 per 60 seconds) and to protect against DDoS attacks via Cloudflare.

Browser storage (tokens and language preference) is used to keep you logged in and remember your preferred language.

4. Data Retention

Your account expires automatically after 72 hours of inactivity. When this happens, these are deleted:

  • ✅ Username and password hash
  • ✅ Session tokens
  • ✅ Room chat messages (when room closes)

Important exception: If you play against our AI opponent, your gameplay data (including moves, role, and outcome) is stored separately to improve the AI. This data is not automatically deleted when your account expires and persists indefinitely. You can contact us to request deletion of this AI training data.

5. Service Providers

We use the following third-party services:

Cloudflare provides DDoS protection and caching. Cloudflare may set cookies and process your IP address. See Cloudflare's Privacy Policy.

Google Analytics (optional) may be enabled to track page views and in-game actions. It is only active if we have explicitly enabled this feature. If enabled, you can opt out by disabling JavaScript in your browser or using a privacy extension. See Google's Privacy Policy.

6. Cookies and Browser Storage

We store the following on your device:

  • alibi_token - Your session token (deleted when you log out)
  • alibi_name - Your username (deleted when you log out)
  • alibi.lang - Your language preference (en or ru)

Cloudflare may set cookies (e.g., cf_clearance). Google Analytics may set cookies if enabled (e.g., _ga, _gid).

7. Data Security

Your password is hashed using bcrypt and is never stored in plain text. All communication uses HTTPS/TLS encryption. Session tokens are stored on your device and are valid for up to 72 hours of active use.

We maintain server logs for debugging and security incident investigation. Logs are not used for tracking or profiling.

8. Your Rights and Account Deletion

You have the right to:

  • Access your data: Contact us to request what data we hold about you
  • Delete your account: Automatically after 72 hours of inactivity, or request manual deletion by email
  • Request deletion of AI training data: Contact us to request deletion of gameplay data stored for AI training
  • Lodge a complaint: Contact your local data protection authority

9. Children's Privacy

This game is intended for players who are legally permitted to use online services in their jurisdiction. We do not knowingly collect data from children. We do not collect age or birthdate information, nor do we target children with marketing.

10. Changes and Contact

We may update this Privacy Policy to reflect changes in the game or applicable law. We will update the "Last updated" date above when changes are made.

For privacy questions or to exercise your rights, contact us at [email protected].

If you are in the EU, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic.