The short version
SumDuel is run by Ansh Panchal, an individual based in the United Kingdom ("we", "us"). For the purposes of data-protection law (UK GDPR / EU GDPR), we are the "controller" of the personal data described here.
Questions, requests or complaints: communication@sumduel.site.
SumDuel is for people aged 13 or older. When you start, we ask you to confirm that you are 13 or older. We do not ask for or store your date of birth. If you live somewhere that requires a higher age to agree to this kind of service, you need a parent or guardian's permission. If we learn that someone under 13 has an account, we will delete it. If you believe a child under 13 is using SumDuel, tell us at the address above.
| Data | When | Why |
|---|---|---|
| Nickname and avatar that you choose | When you start playing | To identify you to other players and run the game. Please do not use your real name. |
| Email address | Only if you create an account or sign in by email | To send sign-in links and let you get back into your account. It is never shown to other players. |
| Password (optional) | Only if you choose to add one | To let you sign in with email + password. We store only a salted, one-way scrypt hash; we cannot read your password. |
| Gameplay data: answers and response times, scores, ratings, XP, streaks, quests, badges, match history, leagues, daily-challenge results | As you play | To run duels and leaderboards, keep your progress, and show your stats. |
| Question sets you create, and rooms you host (PIN, results, reports) | If you use the host tools | To run your class or game and show the host a report. |
| Social data: friends, blocks, and reports you send about other players | If you use those features | To let you play with friends, stay safe, and moderate abuse. |
| Settings: theme, frame, accessibility and notification preferences | When you change them | To remember your choices across devices. |
| Technical data: IP address, device type/name, app version, sign-in session records, request logs | Automatically | To keep you signed in, secure the service, rate-limit abuse and fix problems. |
| Camera (iOS only, optional) | When you tap "scan QR code" to join a room | To read the room QR code on your device. Images are not stored or sent to us. |
We do not collect your precise or approximate location, contacts, photos, microphone, health data, advertising identifier, or payment information. SumDuel has no in-game chat, so we do not hold private messages between players.
Under UK/EU law we need a "legal basis" for using personal data. Ours are:
We do not use your data for advertising, we do not build advertising profiles, and we do not make decisions about you that have legal or similarly significant effects. Matchmaking and ratings are automated, but only affect who you play against.
Choose a nickname that does not reveal who you are. If another player bothers you, use Block or Report in the app.
We do not sell or rent personal data. We use a small number of service providers ("processors") who handle data only on our instructions to run SumDuel:
| Provider | What they do | Data involved |
|---|---|---|
| Fly.io | Hosts the SumDuel servers and database | All data described above, plus IP addresses in server logs |
| Resend | Sends sign-in emails | Your email address and the email content |
| Cloudflare (R2 storage) | Stores encrypted-in-transit backups of the database | Backup copies of all data above |
| GoDaddy | Domain name registration and DNS | No gameplay or account data |
| Apple / Google | Distribute the apps and provide their app-store services (under their own privacy policies) | Whatever they collect when you download or use the stores |
We may also disclose data if the law requires it, to protect someone's safety, or to enforce our Terms. If SumDuel is ever sold or merged, your data may move to the new owner, who must honour this policy.
Our servers and providers may be located outside the UK and EEA, including in the United States. When personal data leaves the UK or EEA we rely on appropriate safeguards such as the UK/EU adequacy decisions, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, and the providers' own transfer commitments.
| Data | Kept for |
|---|---|
| Account, profile, progress, sets, friends | Until you delete your account |
| Guest accounts | Until you delete them. Guests have no email, so a guest account that you sign out of cannot be recovered. |
| Sign-in links | 15 minutes, single use |
| Sign-in sessions | Up to 60 days, or until you sign out or change your password |
| Server request logs | A short period for security and debugging, then they are overwritten |
| Backups | Rolling backups that expire automatically within about 7 days (and in any case within 30 days of deletion) |
| Reports about other players | While needed for moderation, then deleted |
When you delete your account, we delete your profile, email, password hash, progress, friends, question sets and rooms you hosted. Your past match records are kept only in anonymised form (shown as "Deleted player") so other players' histories stay intact.
Delete your account: in the app go to Profile → Delete account; on the website use Delete account in the sidebar. This is immediate and permanent.
Password: you can add, change or remove your password in your profile at any time. If you forget it, request an email sign-in link and set a new one.
Depending on where you live, you may also have the right to:
To use any right, email communication@sumduel.site from the address on your account. We may need to confirm it is you. We will reply within one month (UK/EU) or the period required by your local law, and we do not charge a fee.
California and other US states: we do not "sell" or "share" personal information as those terms are defined in US state privacy laws, and we do not use it for targeted advertising. You may ask us to access, correct or delete your information, and we will not discriminate against you for doing so.
A teacher or other host can run a live room that players join with a PIN, using only a nickname. SumDuel is intended for users aged 13 and over. A host who invites students must make sure that those students are old enough, that they have any permission their school or local law requires, and that they use nicknames that do not identify them. Hosts only see nicknames and game results; they cannot see anyone's email address. If a school needs a data-processing agreement, contact us.
No online service can be perfectly secure. If a breach affects your data in a way that creates a risk to you, we will notify you and the regulator where the law requires.
We do not use advertising or analytics cookies. The website stores your sign-in tokens in your browser's local storage, and the apps store them in the app's private storage on your device (the iOS app uses the system Keychain), only so you stay signed in. This is strictly necessary for the service, so no consent banner is needed. Clearing site data or signing out removes it.
If we change how we use personal data we will update this page and the "last updated" date, and for significant changes we will tell you in the app or by email before the change takes effect.
Email communication@sumduel.site. We hope to resolve any concern ourselves, but you also have the right to complain to your data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU you can contact your national authority.