Online Nardy · Revision dated 22 October 2026
Privacy policy
This policy describes data processing in “Online Nardy” («Онлайн Нарды») and on its support pages. The responsible developer is Denis Klokov / Денис Клоков, Kazakhstan, operating under the name Not So Smart Studio. Questions and data requests: support@not-so-smart.com.
Data the game needs
- Account: an internal identifier, a permanent public player code, your chosen player name and an optional photo.
- Game information: virtual credits, rating, statistics, achievements, match results, room states, moves and dice rolls.
- Friends and invitations: confirmed friendships, incoming and outgoing friend requests, game invitations and reactions.
- Access and recovery: information used to verify an access token and a one-time recovery code. The app also stores the access token on your device.
- Push notifications: a device registration token, its platform, registration time and notification delivery information.
- Support and reports: the message, any materials you choose to attach and the sender’s email address; a profile report also includes the submitted details and a snapshot of the reported name or photo.
- Technical information: network addresses and information about connections, times, errors and service operation. The contents depend on the log type. An IP address is needed to establish a network connection; routine request logs for our domains are configured without IP addresses, URL parameters, authorization tokens or request bodies. Error and security logs may contain network addresses and technical details.
Registration in the game does not require an email address, phone number, passport details, access to contacts or precise location. If you contact support yourself, we receive your email address and message. Do not send passwords, access tokens, recovery codes or complete identity documents without a separate, justified need.
Why information is used
To save and recover accounts, run matches, record results and ratings, operate friendships and invitations, send notifications, review reports, answer support requests, prevent abuse and fix technical errors. Information used is limited to the purpose of each function.
What other players can see
Your player name, photo, public player code and game indicators available in your profile. Participants in a match see its state and reactions. This information can relate to a person even without their email or real name. You may use a nickname and choose not to upload a photo. Only upload an image you have the right to publish.
Recipients and service providers
- The game server uses Timeweb Cloud infrastructure.
- Google Firebase Cloud Messaging delivers push notifications. Using Firebase for notifications does not in itself mean that Google Analytics or Firebase Authentication is enabled.
- When notification delivery on iOS is enabled, Apple Push Notification service is also used.
- Zoho Mail is used for support email.
External providers may process information outside your country. Their own processing, deletion and technical recovery rules apply alongside our settings. More information: Firebase, Zoho, Zoho Mail data deletion, Apple.
Information may also be disclosed where required by law. We do not sell player profiles.
Retention periods
| Category | Retention |
|---|---|
| Profile, friends and game indicators | While the account exists, or until the relevant data is deleted. Opponents’ shared match history is handled separately as explained below. |
| Push device registrations | Up to 30 days without a registration update; invalid tokens may be removed earlier. |
| Completed game invitations | Up to 7 days after the status changes, for response delivery and diagnostics. |
| Friend-request push delivery queue | Up to 14 days from request creation. The requests themselves and confirmed friendships remain until handled, cancelled or the account is deleted. |
| Profile reports | Up to 180 days after submission, or until the related account data is deleted. |
| Diagnostic match records | Up to 14 days after the file was last modified; created only when diagnostics are enabled. |
| nginx logs | Daily rotation, up to 14 archives and a 14-day archive age limit. |
| System logs | A 30-day period and size limits are configured. |
| Developer’s local VPS backups | 30 days from the original backup date. Registering an old backup for rotation does not restart its retention period. |
| Deletion confirmation after a connection failure | A hash of the former token, without a user identifier, is retained for up to 30 days. |
| Protection against restoring a deleted account | A minimal record of the former numeric ID, creation time and deletion time remains for as long as needed to prevent the profile returning from existing backups. It is not visible to other players and contains no name, photo, email or recovery code. |
| Support correspondence | During handling of the request and necessary follow-up. Correspondence is deleted separately from the game account; you may ask support to delete it. After email deletion, Zoho’s Trash and technical recovery periods also apply. |
Cleanup runs on a schedule: service records are checked hourly and backups daily. Log archives are deleted during rotation, so the retention of an individual entry inside a file also depends on the next rotation cycle. If cleanup fails, it runs after the task is restored. Information needed for a specific legal obligation or dispute may be kept longer only for that purpose.
Account deletion
In the app, open “Settings → Support and data → Delete account” and confirm. If the app is unavailable, use the deletion request page. Support verifies ownership before acting on a request: a public player code alone is not enough.
The live database is cleared of your profile, name and photo, personal game indicators, friends, requests, invitations, device registrations and the ability to recover the account using its former code. Opponents retain completed match results labelled “Deleted player”, without the former name, photo or public code. An unfinished match ends under the resignation or cancellation rules. Local backups are deleted on the schedule above. If a backup is restored, prior deletions must be reapplied before the service resumes. Snapshots and copies made by the infrastructure provider are handled under its terms and need separate tracking; our local timer does not control the provider’s external systems.
Your choices and requests
You may edit your name, remove your photo, change notification permissions in the operating system, stop using the game and request access, correction or deletion of data relating to you. The specific scope of rights is determined by applicable law. Email support@not-so-smart.com; we may request proportionate proof of account ownership.
Age of the audience
The game is intended for teenagers aged 13 and over and adults, and is not directed at children under 13. Where the law requires a legal representative’s involvement for a minor’s use of the service or data processing, that involvement is necessary. Store age ratings may differ from the intended audience and depend on the store’s rules. Contact support about data of a child below the applicable age so it can be reviewed and deleted.
Advertising
The current version does not show advertisements. Google AdMob is planned. Before advertising-related processing is enabled, this policy will be updated to reflect the actual settings and applicable user consents. This version of the policy is not consent to future personalized advertising.
Security and changes
The app connects to the server using HTTPS/WSS. Infrastructure access is restricted. Do not share your recovery code or device access. No system can be guaranteed completely secure. When functions, providers or processing practices change, the policy and its revision date are updated; any necessary additional notices and consents are handled separately.