Effective date: 2 September 2026 Last updated: 2 September 2026
Thricebound ("the Game") is made and operated by No Crunch Games, LLC, trading as No Crunch Games ("we", "us", "our"). For data protection purposes we are the controller of the personal data described here.
Contact us about privacy at [email protected].
We are a small studio operating from the United States and do not target the Game at the EU or UK. We have not appointed a representative under GDPR Art. 27 / UK GDPR. If that changes, we will appoint one and name them here.
We have not appointed a Data Protection Officer. Our processing is not of a scale or kind that requires one.
We collect what we need to run a multiplayer game and nothing else.
There are exactly three purposes, and this is the whole list:
We do not build a profile of you. Nothing you do in the Game is fed into an advertising or resale profile, and there is no analytics or advertising code in the client to build one with. We do not sell your data, we do not share it for advertising, and we do not use it to target ads anywhere.
The one place your activity changes what we send you is the closed playtest interest list, and we would rather name it than let the paragraph above quietly overstate itself: that list records whether you registered and whether you have played, and uses those two facts to decide whether to send you a one-off nudge and a one-off check-in. That is the entire extent of it — no scoring, no segmentation, no third party. It is described in full in §4.8 and §13, and it only exists if you filled in the form yourself. The Reply-To on those emails is a mailbox a person reads: reply and ask to be taken off, and we will remove the record by hand. (There is no automatic unsubscribe link — saying otherwise would describe software that does not exist.)
The playtest interest form on our website asks for an email address and nothing else. The one age question in Thricebound is asked when you create an account, and it is a yes/no: are you 13 or over? No date of birth, birth year, birth month or age is ever asked for or stored. All that is written down is a timestamp meaning "the question was answered at this moment". If you answer under 13, we create a restricted child account rather than turning you away — see §13 for exactly what it can and cannot do.
We do not:
We do:
This policy covers the Thricebound game client, its servers, and the No Crunch Games website. It does not cover other websites or services we link to, which have their own policies.
We collect this directly from your use of the Game. We do not buy data about you from anyone.
| Data | Why we have it |
|---|---|
| Username (chosen by you) | Identifies your account and is shown to other players |
| Password, stored only as a bcrypt hash | Logging you in. We never store or see your plaintext password |
| Account ID (a random UUID) | Internal identifier that links your data together |
| Whether the account is provisional (a "Play Now" guest) | So guest accounts behave correctly and can be cleaned up |
| Account creation date | Account management and abuse handling |
| Email address — OPTIONAL, only if you choose to add one | Account recovery (email verification + password reset), and tying a future purchase/receipt to your account. You can verify it to enable recovery; it is never used to log in, and you can leave it blank. |
| Email verification & password-reset tokens (only if you use email verification or a password reset) | Single-use, time-limited codes we email you. Stored only as a hash, never in plaintext, and deleted as soon as they are used or expire. |
We do not collect a real name, date of birth, phone number, or postal address. Email is optional — there is a blank-able "Email (optional)" field when you save/claim an account, and you can add or change it later in Settings. If you provide one you can verify it, which enables account recovery: you can then reset a forgotten password by email. A verified email is also where a future purchase receipt would be sent. If you email us for support, we of course then have your email address and whatever you tell us in that email.
Please do not put personal information about yourself or anyone else into these free-text fields.
If you turn on notifications, your browser gives us a web push subscription: a push endpoint URL issued by your browser vendor's push service, plus the encryption keys needed to send you a notification. We also store your notification preferences. If you turn notifications off, or your browser tells us the subscription is dead, we delete it.
NO PAYMENTS ARE CURRENTLY TAKEN. The Game is free and no payment processor is connected to it. This section applies only from the point real-money purchases go live.
If purchases ever open, payment will be handled by a third party and we will never receive or store your card number. How much of the transaction record we hold ourselves depends on whether that processor is the seller of record — if it is, it collects your billing details under its own privacy policy and we receive only a confirmation that a purchase succeeded. We will name the processor here, and say which of those applies, before the first sale.
Either way we would keep a record of what you bought and when, because we have to — see §9.
The marketing site's "Want to playtest Thricebound?" form creates a standalone record that starts out separate from account data — it exists before you have an account, and the address you give it is never required to match the one (if any) you later add to an account. If you go on to register through the invite link, that record becomes linked to your account (see below), so it is no longer fully separate at that point.
| Data | Why we have it |
|---|---|
| Email address | Sending you the confirmation, playtest code and invite link you asked for, and the follow-up messages below |
| Confirmation token | A single unguessable link, so only whoever controls that inbox can confirm the address or redeem the invite |
| Which account (if any) you registered with the invite link | Recognising your account, so we know whether it has played (for the check-in below) and so this record can be found and deleted on request |
| Submission, confirmation, registration and first-play timestamps | Running the double opt-in described in §13, timing the follow-up messages below, and the retention schedule in §9 |
| When we last sent you a confirmation email | Collapsing repeated form submissions so we do not resend the confirmation faster than roughly once every 15 minutes, and counting as a sign of life for the 30-day retention rule in §9 |
| Which of the follow-up messages (a 3-day nudge, a 7-day check-in) have been sent to you | Not sending the same message twice |
| When you told us you'd given feedback (if you replied and we noted it) | Stopping the automatic follow-ups once we know you're already in touch, and counting as a sign of life for the retention rules in §9 |
| (No age data at all — this form does not ask, and the field for it is left empty) | Until 2026-09-20 this form ran its own 13+ screen and recorded that it had. It no longer asks, so there is nothing to record; the age question is asked once, in the Game, and is described in §13 |
Purpose: running the closed playtest and asking people who signed up for it for feedback. See §13 for how the messaging itself works, and §9 for how long these records are kept.
To be explicit, because a lot of games do collect these and we do not:
For players in the EU, UK, and other places with similar law, these are our lawful bases under GDPR Art. 6:
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account; save your progress; match you with other players; run ranking, quests, and seasons | We cannot provide the Game without it | Performance of a contract (Art. 6(1)(b)) |
| Verify your email, reset your password, recover your account (only if you add an email) | Keeping your account accessible and secure | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Log matches and moves | Ranking and rewards must be verifiable; also used in aggregate to balance the game | Contract; legitimate interests (Art. 6(1)(f)) |
| Rate limiting, abuse and cheat handling, moderating reported content, keeping the service secure | Protecting players and the service | Legitimate interests (Art. 6(1)(f)) |
| Send push notifications | You asked us to | Consent (Art. 6(1)(a)) — withdraw any time by turning notifications off |
| Process purchases; keep tax and accounting records | Completing your purchase; complying with tax law | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Respond to your support email | Answering you | Legitimate interests (Art. 6(1)(f)) |
We do not use your data for automated decision-making that produces legal or similarly significant effects. Matchmaking and skill rating are automated, but they only decide who you play against.
The Game does not use tracking or advertising cookies. It uses your browser's local storage for:
These are necessary for the Game to function. Clearing your browser storage logs you out.
The marketing website at nocrunchgames.com uses no analytics and sets no advertising or tracking cookies. It is served through a content delivery network, which may set a strictly necessary cookie to protect the site from abuse. If we ever add analytics, we will add a cookie notice and a cookie section to this policy before doing so.
We do not sell your data and we do not share it for advertising. We share it only with the service providers we need to run the Game, and only for that purpose:
| Who | What they get | Why |
|---|---|---|
| DigitalOcean (application hosting and database) | Everything stored by the Game, because they host it | Running the servers and database |
| Your browser vendor's push service (for example Google, Mozilla, or Apple, depending on your browser) | The push endpoint and the encrypted notification payload | Delivering a notification you asked for |
| Resend (transactional email) | Your email address and the account-verification, password-reset, or playtest confirmation/code/follow-up email we send you | Delivering verification, password-reset, and playtest interest-list emails. Not active until email sending is turned on. |
| A payment processor — none is engaged today, as the Game takes no payments | Your payment details, which would go to them and never to us | Taking payment, if and when purchases open |
| Other players | Your username, in-match actions, ranking, clan, and any custom board you publish | It is a multiplayer game |
We may also disclose data if we are legally required to, or where it is necessary to establish or defend legal claims, or to protect someone's safety.
If the Game or the business is ever sold or transferred, your data may transfer with it. We would tell you before that happened, and the new operator would be bound by a policy at least as protective as this one.
This section exists partly because it is required. The 2025 amendments to the US COPPA Rule require operators to publicly post a written data retention policy and prohibit retaining personal data indefinitely. It is also required by GDPR Art. 5(1)(e) (storage limitation).
This table describes what the Game actually does today. Where deletion is automatic we say so; where it happens because you asked, we say that instead. We would rather publish a short accurate schedule than a long aspirational one.
| Data | How long we keep it | Then |
|---|---|---|
| Your account and its progress | For as long as you keep the account | Deleted when you delete it — see below |
| Guest ("Play Now") account, before you convert it | Until you convert it to a full account, or delete it | On conversion it is merged into your account, not deleted — your progress comes with you |
| Age-screening result | A single timestamp recording that a screen was passed | Deleted with the account |
| Your email address | Until you remove it, or delete the account | Deleted with the account |
| Match logs and per-move records | For as long as the match record exists | Deleted with the account where they identify you |
| Push subscriptions | Until you turn notifications off, the subscription expires, or the account is deleted | Deleted immediately |
| Email verification & password-reset tokens | Single-use; expire automatically (verification ~24 hours, reset ~30 minutes) | Deleted on use or expiry |
| Playtest interest record, never confirmed | 30 days from the last sign of life on the record — submission, a resent confirmation email, or a logged reply, whichever is most recent | Deleted automatically |
| Playtest interest record, no activity | 12 months from the most recent of: submission, confirmation, registration, first play, or feedback | Deleted automatically |
| Backups | Set by our hosting provider, DigitalOcean, on their standard backup cycle | Overwritten on the normal backup cycle |
| Server and hosting access logs | Set by our hosting provider, DigitalOcean | Deleted on their cycle |
We do not collect payment data at all. The Game is free, no money changes hands, and no payment processor is connected to it. There are therefore no purchase records, no card details and no tax records to retain. If that ever changes, this policy will change with it, and we will tell you before it does.
Your date of birth is never stored, and is never asked for. The age screen is a single yes/no question — are you 13 or over? — and all that remains afterwards is a timestamp recording that it was answered. There is no birth date in our database to delete, disclose, or lose, because we never collected one.
When you delete your account using Start Fresh in Settings, your account and its progress are deleted from our live database immediately. One exception, which we are being explicit about: backups are not edited, so deleted data disappears from backups when those backups expire on the normal cycle above.
Deletion on request is the primary mechanism. Apart from the automatic rows marked above, we do not currently run scheduled deletion jobs — an account that is never deleted is retained. You can delete yours at any time from Settings, or by writing to us at the address in section 1, and we will act on that request.
Depending on where you live, you have some or all of these rights:
How to use them:
California residents (CCPA/CPRA). You have the rights to know, delete, correct, and to non-discrimination for exercising them. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" mechanism to offer. We do not use or disclose sensitive personal information beyond what is needed to provide the Game. The categories we collect, and why, are set out in §4 and §6; the sources are you and your use of the Game.
Other US states. Virginia, Colorado, Connecticut, Texas and others have comparable privacy laws, each with its own thresholds. Rather than work out which of them apply to a studio our size, we offer the access, correction, export and deletion rights described above to anyone who asks, wherever they live.
Our servers and database are hosted by DigitalOcean, in the United States.
Our servers are in the United States. If you are in the EU or UK and use the Game, your data is transferred to the United States. Where such a transfer requires a safeguard, we rely on the standard contractual clauses in our hosting provider's data processing agreement.
No system is perfectly secure. If you find a security problem, please tell us at [email protected] before disclosing it publicly.
Our policy, in plain language:
Thricebound's full experience is for players 13 and over, and younger players get a restricted account rather than a closed door.
You are asked once, when you create an account: are you 13 or over? That is the whole question. We never ask your birth date, your birth year, your birth month or your age, and the marketing site's playtest form does not ask about age at all — it asks for an email address and nothing else.
If you already had an account before this check existed, the Game asks you the same question once, the next time you open it, and does not let you carry on until you answer.
Nothing about the answer is stored except that it was given. All that is kept is a timestamp recording that the question was answered. There is no date of birth here to be lost in a breach, handed to anyone, or deleted on request, because we never collected one.
If you answer under 13, we make a child account rather than refusing you. It plays the Game normally — every mode, all progress, all items. What changes is what can be known about you and who can reach you:
- No email address is stored on it. Any address typed into the registration form is discarded rather than saved.
- No friends and no direct contact, refused in both directions, so nobody can add you either.
- Custom boards stay private — you can build and play them, but not publish them.
- The name you chose is never displayed. An automatically generated handle is shown in its place, including on the leaderboard.
- Clans can be joined under that generated handle; clan invites sent to you are refused.
Notifications are entirely opt-in: they stay off until you choose to turn them on, and you can turn them off again at any time in Settings. If you never turn them on, we never send you any.
Email is a separate channel from push notifications, used only if you submit the playtest interest form yourself. It is double opt-in: submitting the form sends you a confirmation email (resubmitting the same still-unconfirmed address again shortly after does not send a second one, but resubmitting well after that does), and nothing else is ever sent unless you click the link in that confirmation. After that, you get the playtest code. If you go on to register with the invite link, you may later get a one-time nudge asking whether you've had a chance to play; if you also go on to play, you may later still get a one-time check-in asking how it's going. Neither follow-up is sent if you never register, and only the nudge is possible if you never play — and either is skipped once you've told us you gave feedback. The Reply-To on every playtest email is a real inbox we read, not an automated system — reply to ask to be removed (see below) or to give feedback, and a person will act on it.
If you are a parent or guardian and want your child's account and data deleted, write to [email protected] and we will delete it. The same goes for the playtest interest list: reply to any playtest email, or write to [email protected], and we will remove the address.
What the Game actually does (verified against the code 2026-09-20):
ageCheckedAt: null, because no check ran.ageCheckedAt — a timestamp meaning "the question was answered at this moment". There is no
birth-year, birth-month or date-of-birth field anywhere, and adding one is ruled out in the code.ageCheckedAt: null. It is the operator vouching for someone they know, and
there is nobody at a keyboard to answer a prompt. The holder is still asked at registration.The known imprecision, stated plainly: a yes/no question is answered by the person in front of it, and nothing verifies it. That is true of every age screen that does not demand identity documents, and demanding those from a child to play a board game would be worse than the problem. What the design does instead is remove the incentive to lie: answering "under 13" is not a closed door, it is a restricted account that still plays the whole Game, so the honest answer costs a player very little.
The screen also deliberately does not tell you which answer is which — see the Terms (§4) for where the 13+ line is stated, and note it is not printed beside the question itself.
The superseded reasoning, kept for review: the posture until 2026-08-24 was that COPPA's consent obligation for a general-audience service (one not directed to children) is triggered by actual knowledge that a specific user is under 13, so by never asking, the Game never gained that knowledge and the obligation was never triggered. That reasoning is sound as far as it goes, and the trade-off it makes is real: an age screen means we do now learn that a particular submission claimed to be under 13. What it did not address is that the interest form was already collecting an email address from that person before anyone had asked anything — which is the collection COPPA is about.
Residual questions for counsel (do not remove until reviewed):
The Terms of Service (§4) and this section are consistent with each other and with the code as implemented. What remains is legal confirmation.
We may update this policy. If a change is material we will give notice in the Game before it takes effect, and we will always update the "Last updated" date above. Where the law requires your consent for a change, we will ask for it.
No Crunch Games, LLC (No Crunch Games) Privacy: [email protected] Security: [email protected]