Last updated: March 18, 2026
Diplicity is a mobile and web application for playing the classic Diplomacy board game online. This privacy policy explains what data we collect, how we use it, and your rights regarding that data.
Diplicity is developed and maintained by John McDowell (individual developer).
When you sign in with Google, we receive and store:
- Name — your Google account display name
- Email address — your Google account email
- Profile picture URL — a link to your Google profile photo
We do not access your Google password, contacts, or any other Google account data.
When you use the app, we store:
- Game state — games you create or join, game settings, and phase history
- Orders — the moves you submit during gameplay
- Chat messages — messages you send in game chat channels
- Channel membership — which chat channels you participate in
If you enable push notifications, we store your Firebase Cloud Messaging (FCM) device token to deliver notifications about game events (e.g., new phases, messages).
The app stores the following in your browser's local storage or device storage:
- JWT authentication tokens (access and refresh)
- Your name and email (for display purposes)
This data stays on your device and is cleared when you sign out.
We use your data to:
- Authenticate you and maintain your session
- Run the game — process orders, resolve phases, manage game membership
- Deliver notifications about game events you've opted into
- Monitor application health — detect errors and performance issues (see Third-Party Services below)
We do not use your data for advertising, analytics profiling, or cross-app tracking.
We use the following third-party services:
| Service | Purpose | Data Shared |
|---|---|---|
| Google OAuth | Authentication | Name, email, profile picture (received from Google) |
| Firebase Cloud Messaging | Push notifications | FCM device tokens |
| Sentry | Error tracking | Error reports with PII masked; no authentication headers or credentials are sent |
| Honeycomb (OpenTelemetry) | Performance monitoring | Request traces and timing data; no user-identifiable information |
We do not sell or share your personal data with any other third parties.
- All data is transmitted over HTTPS/TLS
- The backend runs on Railway's infrastructure with managed PostgreSQL
- Authentication uses industry-standard JWT tokens
- We follow security best practices but cannot guarantee absolute security — no system is 100% secure
- Account data is retained as long as your account exists
- Gameplay data (games, orders, messages) is retained indefinitely as part of the game record
- FCM device tokens are removed when you sign out or disable notifications
You can request deletion of your account and all associated personal data by opening an issue at github.com/johnpooch/diplicity-react/issues with the subject "Account Deletion Request." Include the email address associated with your account.
Upon deletion:
- Your account, profile information, and device tokens will be permanently removed
- Gameplay data (orders, messages) in completed games may be retained in anonymized form to preserve game history for other players
We will process deletion requests within 30 days.
Diplicity does not collect or access:
- Location data
- Contacts
- Camera or microphone
- Health or fitness data
- Payment or financial information
- Browsing history or cross-app tracking data
- Advertising identifiers
Diplicity is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us so we can remove it.
We may update this policy from time to time. Changes will be reflected by updating the "Last updated" date at the top. Continued use of the app after changes constitutes acceptance of the updated policy.
For privacy-related questions or concerns, open an issue at github.com/johnpooch/diplicity-react/issues or contact the developer directly through GitHub.