Privacy Policy

DD Games (games.duodev.in) is run by Duo Dev Technologies, 2/45, JJ Colony, Near Common Service Centre, Mettupattithathanur, Salem, Tamil Nadu 636103, India ("we", "us"). We decide why and how your personal data is used, so we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the EU and UK GDPR.

Questions about this policy or your data: privacy@duodev.in. Our Grievance Officer is listed in section 13.

• You can play most games as a guest without giving us any personal data.
• An account needs an email address. We use it to sign you in, verify you and send account emails, never for marketing without asking.
• We keep what is needed to run games, rewards, leaderboards, friends and chat, and to keep the community safe.
• Analytics and personalised ads only run if you allow them in Cookie settings.
• We don't sell your personal data.
• You can download your data or delete your account at any time in Settings → Your data.

When you play as a guest

• The guest name you choose and a random player ID, kept in your browser (not on our servers).
• A random device ID kept in your browser, which we turn into a one-way coded value (a keyed hash) on our servers.
• Your IP address and browser type while you are connected. We use them for security, rate limits and moderation, and store only keyed hashes of them, not the raw values (except in short-lived error logs, see section 8).
• Room chat messages you send. They are passed live to the other players in the room and are not stored, unless someone reports a message.
• Daily puzzle progress, best scores and settings such as theme and sound, kept in your browser.

When you create an account

• Account details: email address, password (stored only as a one-way bcrypt hash), display name, @username, avatar, bio, privacy choices and game preferences.
• Sign-in with Google, Discord or Microsoft: the provider's ID for your account, your name, your email address and whether the provider has verified it. We don't receive your password or contacts.
• Agreement records: which version of the Terms and this policy you accepted, and when, including your confirmation that you are 13 or older (and, if under 18, that a parent or guardian agrees).
• Play and progress: match results (game, mode, outcome, duration and the accounts you played against), XP and level, Gems and the record of every Gem earned or spent, shop items, badges, login streak, weekly quests, daily puzzle results (including your Wordle guesses and times) and leaderboard positions.
• Social features: friends and friend requests, room invites (they expire), notifications and your online status (which you can hide).
• Global chat: messages you post in global chat, with the name you used at the time.
• Invites: who invited you (if you joined from an invite link), whom you invited, and keyed hashes of the network and device used to sign up, so we can spot people inviting themselves.
• Sessions and security: a record of each signed-in session (keyed hashes of your IP address and device, and your browser type), failed sign-in attempts, and verification or password-reset tokens (stored as hashes, and they expire).

Safety and moderation

• Reports you make or that are made about you, including the reported message.
• A moderation record per player or device: a points score, warnings, chat mutes and bans, with keyed hashes of IP address, browser and device so bans can't be dodged easily.
• Chat messages may be checked automatically for abuse when they are sent. If the automated service is switched on, the message text (without your name or email) is sent to OpenAI's moderation service for that check.

With your permission (cookies)

• Analytics: pages viewed and events such as a game started or finished, sign-ups and shares, plus broad properties (signed in or not, level range, favourite game) through Google Analytics. We never send your name, email, username or account ID to Google Analytics.
• Personalised ads: Google AdSense may use cookies to choose ads based on your interests. Without your permission, only non-personalised ads are shown.

See the Cookie Policy for every cookie and browser storage item we use.

Sites that embed our games

When a game is embedded on another website, we count loads and plays per website address (for example example.com). We don't record anything about the person playing.

• To provide the service you asked for (performance of a contract, and your consent under the DPDP Act): accounts, sign-in, multiplayer games, rooms, chat, friends, rewards, the shop, daily puzzles, leaderboards and account emails.
• To keep players safe and the service secure (legitimate interests, and legal obligations): moderation, bans, abuse and cheating prevention, rate limits, invite fraud checks, security logs and error logs.
• To improve the games (your consent, for analytics cookies): understanding which games and features are used.
• To show ads that keep the games free (your consent, for personalised ads; legitimate interests, for non-personalised ads).
• To meet legal duties (legal obligation): responding to lawful requests, keeping records required by Indian law, and handling grievances.

We don't use your data for automated decisions that have legal or similarly significant effects on you. Automated chat checks can add moderation points or mute a player for a short time; you can ask for a person to review any moderation action (see Community Guidelines).

• Your display name, @username, avatar, frame, title and level, in games, chat, rooms and leaderboards.
• Your public profile (bio, badges, stats) at /u/your-username. You can make it friends-only in Settings.
• Whether you are online and what you are playing, unless you turn this off in Settings.
• Messages you send in room or global chat, and emotes in matches.

We don't sell personal data. We share it only with:

• Our hosting provider, which runs our servers and database for us.
• Our email delivery provider, which sends verification, password-reset and account emails.
• Google, Discord and Microsoft, only if you choose to sign in with them; they see that you signed in to DD Games.
• Google (Analytics, Tag Manager and AdSense), as described above and only as far as your cookie choices allow. Google's use is described at How Google uses information from sites that use its services.
• OpenAI, for automated checks of chat text when that check is switched on.
• Authorities, when Indian or other applicable law requires it, or to protect players from serious harm.
• A buyer or successor, if Duo Dev Technologies is reorganised or sold. This policy would continue to apply.

These providers process data only on our instructions, except where they act as independent controllers (for example Google and the sign-in providers under their own privacy policies).

We are based in India and our service is used worldwide. Your data may be processed in India and in other countries where our providers operate, such as the United States. Where the GDPR or UK GDPR applies, we rely on adequacy decisions or standard contractual clauses for such transfers. We don't transfer data to any country the Government of India has restricted under the DPDP Act.

• Account and progress: while your account exists. When you delete it, see Delete your data for what is removed and what is kept.
• Sessions: up to 30 days after you last used them. Verification links: 24 hours. Password-reset links: 60 minutes.
• Moderation events: 90 days. Bans and the moderation score: for as long as they are needed to enforce the ban or rules.
• Security (audit) logs: 365 days. Error logs, which can include an IP address and browser type: 30 days.
• Weekly quest records: 120 days. Room invites: until they expire.
• Global chat messages and chat reports: kept so reports can be reviewed, until removed by a moderator or on request.
• Match results, Gem records, daily puzzle results and invites: while the account exists, because they make up your stats, balance and leaderboard history.
• Browser storage stays on your device until you clear it.

Passwords are stored as bcrypt hashes, sign-in uses secure, HTTP-only cookies and short-lived tokens, and IP addresses and device IDs are stored as keyed hashes. Our database is not reachable from the internet, admin access is limited by role, and admin actions are logged. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Wherever you live, you can:

• Access and download your data: Settings → Your data → Download my data.
• Correct it: edit your profile in Settings, or email us.
• Delete it: Settings → Your data → Delete my account, or see Delete your data.
• Withdraw consent for analytics and personalised ads at any time: Cookie settings.
• Disconnect Google, Discord or Microsoft sign-in in Settings → Sign-in methods.
• Make a complaint to our Grievance Officer (section 13).

India (DPDP Act)

You may access, correct, complete, update and erase your data, have grievances addressed, and nominate a person to exercise your rights if you die or become unable to. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

EU, EEA and UK (GDPR)

You also have the rights to restrict or object to processing based on legitimate interests, to data portability, and to complain to your local data protection authority.

California (CCPA/CPRA) and other US states

You may know, access, correct and delete your personal information, and opt out of its sale or sharing. We don't sell personal information. If you allow personalised ads, Google may use cookies for cross-context behavioural advertising, which some US laws call "sharing"; you can opt out at any time in Cookie settings by turning off personalised ads. We won't treat you differently for using these rights.

To use any right, email privacy@duodev.in from your account's email address. We may need to confirm it's you. We reply within 30 days (and acknowledge grievances within 24 hours).

Accounts, global chat, online play and invites are for people aged 13 and over. Players under 13 may only play as guests, which needs no personal data from them; please don't let them use room chat.

Under the DPDP Act, anyone under 18 is a child. When an account holder under 18 signs up, they confirm that a parent or guardian agrees. For accounts, we don't knowingly track children's behaviour or target ads at them, and personalised ads should not be enabled on a child's device. If you are a parent and believe your child has given us personal data without your consent, email privacy@duodev.in and we will delete it.

We will update this page when our practices change and change the "Last updated" date. If a change matters to how your data is used, signed-in players are asked to read and accept the new version before continuing.

Under the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, our Grievance Officer is:

We acknowledge complaints within 24 hours and resolve them within 15 days. For general help, email support@duodev.in or see Contact.