Privacy Policy

1. Who we are

Carrom Clash is an online multiplayer carrom game developed and operated by Tanvir Mahin (“we”, “us”, “our”). We are responsible for the personal data processed through the service. You can reach us at tanvirmahin24@gmail.com.

2. Information we process

2.1 Nickname and avatar

You choose a nickname and an avatar emoji. We offer a random default nickname that you can keep or change. Your nickname and avatar are visible to other players in the same game room and appear in their match history.

2.2 Player ID and access token

When you sign up, our server assigns you a Player ID (a numeric account ID) and creates a secret access token that lets you use your account. The token is stored on your device, in the app’s or your browser’s local storage. Our server stores only a SHA-256 hash of the token, never the token itself.

You don’t need an email address, password or phone number to play.

2.3 Match records

For each match, we store the date, the participants’ nicknames and avatars, their scores and their placements. We use these records to show your stats (games played, wins and best score) and your recent match history.

2.4 Live gameplay data

While you play, our server processes room codes, your shots and aim, and emote reactions. Emotes are preset emojis only — there is no free-text chat. This data is processed in memory, in real time, and is discarded when the room closes.

2.5 Technical data

To deliver the service to your device, we have to process your IP address and connection metadata. This processing is transient. Our game server does not write IP addresses to its application logs. Our website and game traffic pass through Cloudflare, our network and security provider, and the game server runs on a rented virtual server; these providers may keep standard access and security logs for a limited period (typically up to 30 days).

2.6 Friends and invites

If you use friends, we store your friend connections: the Player IDs of your friends, friend requests you send or receive, and players you block. Your friends can see your nickname, avatar and online status (offline, online, in a lobby or in a game), and can invite you to a game room while you’re online. Invites are delivered in real time and are not stored. You can remove a friend, decline a request or block a player at any time; blocked players can’t send you requests or invites.

3. Information stored on your device

The app — or your browser, if you play at /play/ — stores:

• your access token, so you stay signed in to your account; and
• your preferences: sound on/off and vibration on/off.

Clearing the app’s data, uninstalling the app or clearing your browser’s site data removes this information from your device. It does not delete your account from our server — see section 9 for how to do that.

4. Information we don’t collect

We do not collect your:

• email address, phone number or real name;
• your phone’s contacts or address book (your in-game friends list is described in section 2.6);
• precise or approximate location;
• photos or files;
• advertising ID; or
• payment information.

Carrom Clash has no ads and no analytics or tracking SDKs, and we don’t use cookies for tracking.

5. How we use information

We use the information described above only to:

• create and maintain your account;
• match you with friends through room codes;
• run gameplay in real time;
• let you add friends, see when they’re online and invite them to games;
• show your stats and match history; and
• keep the service secure and prevent abuse.

6. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:

• Performance of a contract — to provide the game you asked to use: your account, matchmaking via room codes, gameplay, and your stats and match history (see our Terms of Service).
• Legitimate interests — to keep the service secure and prevent abuse. You can object to this processing (see section 9).

7. Sharing

We do not sell or share your personal data. We only disclose it:

• to service providers that deliver and host the service (Cloudflare for the website and network delivery, and our server hosting provider for the game server and database), acting on our behalf and under our instructions; or
• where we are required to do so by law.

Other players can see your nickname and avatar as described in section 2.1. Your friends can also see your online status (section 2.6).

8. How long we keep information

• Account and match history: until you delete your account.
• Friend connections, requests and blocks: until you or the other player remove them, or either account is deleted.
• Live gameplay data: deleted when the room closes.
• Infrastructure logs: kept by our hosting/infrastructure provider for a limited period, typically up to 30 days (see section 2.5).

9. Deleting your account and your rights

Delete in the app. Open Settings (⚙️), tap Delete account and confirm. Your account is deleted immediately and permanently.

Delete by email. Email tanvirmahin24@gmail.com with your Player ID (shown in Settings). We handle email requests within 30 days. Step-by-step instructions are on our Delete account page.

Deleting your account removes your nickname, avatar, Player ID, token hash, all your match records and stats, and your friend connections, requests and blocks. Your entries also disappear from other players’ match history and friends lists.

Your rights. Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct it — you can change your nickname in the app at any time;
• delete it; and
• object to processing based on our legitimate interests.

To exercise these rights, email tanvirmahin24@gmail.com and include your Player ID. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA). We do not sell or share your personal information, as those terms are defined under California law. You can use the rights above to access, correct or delete your information, and we will not discriminate against you for exercising them.

10. Android permissions

The Android app requests only these permissions:

• INTERNET — to connect to the game server.
• VIBRATE — for haptic feedback.

11. Security

We encrypt data in transit using HTTPS and secure WebSockets (WSS), and we store access tokens at rest only as SHA-256 hashes. No system is 100% secure, so we can’t guarantee absolute security, but we work to protect your information.

12. Children

Carrom Clash is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has used Carrom Clash, contact us at tanvirmahin24@gmail.com and we will delete the account.

13. International transfers

Your data may be processed in the country where our server is hosted, which may be different from the country where you live.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll post the new version on this page and update the effective date at the top. If the changes are significant, we’ll make reasonable efforts to let you know, for example with a notice in the game.

15. Contact us

Questions about this policy or your data? Contact Tanvir Mahin at tanvirmahin24@gmail.com.