Privacy Policy
Last updated October 17, 2026
What we collect
Account and authentication: email, password verifier (stored by Supabase Auth, never by onemore), email-verification state, OAuth provider identities you link (Google), and session tokens stored in this browser only (see Storage, cookies and local data below). Profile: username (generated), display name, bio, avatar object path, onboarding state. Gameplay: play sessions (game, seed, start/end times) and scores (session, game, value, duration). Social, when you use it: follows, blocked-user relationships, notification rows (kind, payload, read time) and your privacy/notification preferences. Operational: rate-limit counters, request ids and error logs needed to run and protect the API.
What we do not collect
No payment data (no payments feature exists), no push subscriptions (no push delivery exists), no email campaign data (no email delivery beyond Supabase auth mails), no device fingerprint inventory beyond what the browser necessarily sends, and no analytics events beyond the append-only table the backend validates — the app does not run third-party analytics or advertising trackers.
How we use it
To create and secure accounts, verify email, run play sessions and leaderboards, render profiles and follow graphs, deliver in-app notifications for genuine events (such as new followers), enforce blocks and privacy choices, moderate reported content, and keep the platform safe within rate limits.
Who can see it
Profiles (username, display name, bio, avatar), published games, scores on visible games, follows and visible comments are public by default. Private-account and visibility toggles in Settings → Privacy limit discovery where implemented. Notifications and preferences are visible only to their owner; roles are visible only to their owner and to staff. Administrators and moderators see moderation queues and audit trails through the staff-gated admin API.
Storage, cookies and local data
Your session tokens (access and refresh) are saved in this browser's localStorage under one namespaced onemore key so a reload keeps you signed in; the app re-checks them with the server on load and removes them on sign-out or when the server refuses the session. Appearance, language and accessibility choices persist in this browser's localStorage. Recent searches persist in this browser's localStorage. OAuth PKCE verifiers live in sessionStorage for the duration of one sign-in attempt. Avatar images live in the public `avatars` Supabase Storage bucket under your account folder.
Infrastructure
Hosting and API: Vercel (web app, Go gateway and Go services on one domain). Identity, database and storage: Supabase (Auth, Postgres with Row Level Security, Storage). OAuth, when enabled: Google. No other processors are used by this deployment.
Retention and deletion
Data is kept while your account is active. Self-service deletion is not available in this build; request deletion through the project issue tracker. The deletion target is removal of profile, preferences, follows, blocks and notifications within 30 days; scores on public leaderboards may be retained without attribution for integrity. Backups, if any, age out on the provider's schedule.
Your choices and rights
Edit profile, privacy, notification, language, appearance, accessibility and blocked-user settings in Settings; each supported control persists and takes effect as described on its screen. Unsupported controls (push, email delivery, MFA, per-device session lists) are labelled unavailable rather than simulated. To request access, correction or deletion, open an issue on the project tracker from your signed-in account until a dedicated privacy contact is published.
Contact
Privacy contact: TO BE SUPPLIED BY THE OWNER before public launch (operator name and email). Until then, use the project issue tracker linked in Settings → Help. This policy is product-accurate documentation, not legal advice; have counsel review it before public launch.