Privacy Policy
This policy explains what information Baize Club (the online billiards game, "the service") stores about you, why, for how long, and how to have it deleted. The service is run by Gamquo ("we"). Contact: support@gamquo.com.
1. What we store
You can play as a guest without an account. A guest's name, avatar and settings stay on your device; the server only holds them in memory while you are connected.
If you create an account, the server stores:
- Username (public: other players see it).
- Password hash: your password is never stored. We keep a one-way scrypt hash with a random salt.
- Email address (optional): only if you add one, used to confirm it is yours and to send password-reset codes. Confirmation and reset codes are stored only as hashes and expire after 15 minutes.
- Game data: rating, league, wins, losses, streaks and other game statistics, coins, gems, the items you own and use, your avatar and title, daily mission progress, and when the account was created.
- Friends: your friends list and pending friend requests.
- Login sessions: random session tokens that keep you signed in; they expire after 60 days or when you sign out.
- Reports: if you report a player, or a player reports you, the report (both usernames, reason, optional text and time) is kept for moderators to review.
- Moderation records: if your account is banned or muted, the end time and the reason.
- Purchases: when you buy gems, we keep the payment provider's checkout session id so the same payment can never be credited twice. We never see or store your card details.
Chat: lobby, table and private messages are relayed live to the other players and are not stored by the server. Messages are checked by an automatic word filter before they are relayed. If you report someone, the text you type into the report is stored as part of the report.
Server logs and IP addresses: like any internet service, the server sees your IP address while you are connected. It is used in memory to limit abuse (for example password-reset attempts). Server and hosting logs may record IP addresses, connection times and errors; the admin action log records the administrator's IP address and the action taken. Our server deletes its logs after 30 days.
On your device: the game saves your settings (language, sound, camera and so on), your guest name and avatar, players you muted, and your session token in the device's local storage (browser storage on the web). We do not use advertising or tracking cookies.
2. Why we store it
- To run your account and the game: sign-in, matches, rankings, coins, items and friends (performance of our agreement with you).
- To recover your account when you forget your password (only if you add an email).
- To keep the game fair and friendly: reports, bans, mutes and the word filter (our legitimate interest in a safe community).
- To process purchases and prevent double crediting (performance of the purchase, legal record-keeping).
- To keep the service secure and working: logs and rate limits (legitimate interest).
We do not sell your information and do not use it for advertising.
3. Who else receives it
- Stripe processes gem purchases. When you buy gems you pay on Stripe's page, and Stripe receives your payment details and your username (to link the payment to your account). See stripe.com/privacy.
- Our email provider, Brevo, delivers confirmation and reset emails, so it receives your email address and the message. See brevo.com/legal/privacypolicy.
- Our hosting provider, LightNode, runs the server (located in Riyadh, Saudi Arabia) and may keep network logs.
- Cloudflare provides our domain name service and forwards emails you send to our support address to our inbox. See cloudflare.com/privacypolicy.
- Other players see your public profile: username, avatar, rating, league, title, game statistics and join date.
- Authorities, if the law requires it.
4. How long we keep it
- Account data: until you delete your account, or until we close it (for example after a permanent ban, or if the service shuts down).
- Session tokens: 60 days at most. Email and reset codes: 15 minutes at most.
- Reports: the newest 2000 reports are kept. When an account is deleted, reports by or about it are kept with the username replaced by "[deleted]", so moderators can still see patterns of abuse.
- Purchase session ids: kept permanently, even after the account is deleted, so a payment can never be credited twice. After deletion they are no longer linked to an account on our server. Stripe keeps its own payment records.
- Server logs: 30 days.
5. Deleting your account and your rights
You can delete your account at any time: in the game under Profile → Delete account, or on the web at /delete-account. Deletion removes your username, password hash, email, game data, coins, gems, items, friends list and sessions, and removes you from other players' friends lists. It can't be undone and purchases are not refunded. An account can't be deleted while it has coins in a running match or tournament.
Depending on where you live you may have the right to access, correct, export or delete your data, and to object to or restrict how it is used. Write to support@gamquo.com. You may also complain to your local data protection authority.
6. Children
The service is not meant for children under 13, and you must be at least 13 to create an account (or older where local law sets a higher age for agreeing to data processing without a parent's consent). If you believe a child under 13 has created an account, contact us and we will delete it.
7. Security
Passwords and codes are stored only as hashes, connections use HTTPS/WSS when the server has a certificate, and attempts to guess passwords or codes are rate-limited. No system is perfectly secure; please use a password you don't use elsewhere.
8. Changes
We may update this policy. The current version is always at this address. Last changed: 30 October 2026.