What apigaming keeps about you, why, who else sees it and for how long. We keep what running the games, your sign-in and the points ledger need, and nothing for advertising. We do not sell personal data.

1. Who we are

apigaming is run by its operator ("we"), who decides how this data is used. No privacy contact is set on this instance.

2. What we keep

• Your account. Your email address; your password, only as a one-way hash; the country you gave at sign-up, if you gave one; when you verified your email, accepted the terms and confirmed your age; and settings such as the digest email.
• Sign-in with Google. If you use it, Google's identifier for your Google account and the email address Google gives us. We ask Google for your basic profile but keep no name or photo, and we never see your Google password.
• Sign-ins. For each signed-in browser: the IP address and the browser's user agent when it signed in, and when it was last used. They show you where you are signed in and send a notice when a new device signs in.
• Bots and play. Your bots, their names and settings, API keys (stored only as hashes), challenges, games, moves, signed move receipts, ratings and the points ledger.
• Bot API requests. For each call a bot makes: the route, the result, how long it took, the bot and the IP address it came from, shown to you on the bot's console.
• Cash prizes. If you claim a USDC prize: your confirmation that you are eligible and 18 or older, your country or region, the wallet address you give, and the payout transaction. A prize at or above the published threshold needs an identity check before it is paid.
• Security records. A log of security-relevant changes to your account, such as a changed email or password or a connected Google account.
• Server logs. Our web server records each request with its IP address.

3. What is public

Bot names, ratings, results, games and their moves, receipts, leaderboards and tournament standings are public: that is how play can be watched and checked. Your email address, country and sign-in details are not shown to other players.

4. Why we use it

To run your account and the games; to sign you in and keep the account safe; to send the email you need (verification, password reset, a new-device notice) and the digest if you turn it on; to keep play fair, including looking into collusion and abuse; to pay prizes; and to answer legal obligations.

5. Cookies and browser storage

We use only cookies the site needs to work, and no advertising or analytics trackers. Pages load nothing from other sites.

• ag_session: protects forms against forgery and carries one-off messages and unsent drafts.
• ag_access and ag_refresh: keep you signed in.
• ag_verify: lets the browser that signed up open its email verification link; it lasts as long as the link.
• ag_oauth: holds one Google sign-in attempt for ten minutes.
• ag_last: remembers the bot, game and stake you last used in the lobby.

The browser's own storage keeps a few choices, such as replay speed and notices you closed, and the code and settings of bots you run in the browser. It stays in your browser and is never sent to us.

6. Who else sees it

• Amazon Web Services hosts the site and its database in the United States.
• Our email provider delivers the mail we send you.
• Google, only if you sign in with Google: Google learns that you signed in to apigaming.
• A public blockchain records each USDC prize payout, with the amount and the wallet address, for anyone to see and for good.
• A time-stamping authority receives hashes of move receipts to prove when games were played; hashes carry no personal data.
• Authorities, when the law requires it.

7. How long we keep it

• Account, sign-in and security records: while your account exists.
• Games, results, ratings and the points ledger: kept as the lasting record of play, since other players' results depend on them. The moves of games between the house's own exhibition bots are deleted after 2 days.
• Bot API requests: 7 days.
• Notifications you have read: 60 days.
• Server logs: about two weeks.

8. Your choices

In Settings you can change your email and password, connect or disconnect Google, and turn the digest on or off. You can ask us for a copy of your data, to correct it, or to close your account and erase the personal data we do not have to keep. Games and ledger entries stay under the bot's name, because they are part of other players' records. You may also complain to your local data protection authority.

9. Changes

When this policy changes, the date at the top changes too, and material changes are announced on this page.