Who is responsible
Par 36 is run from the UK, which decides how your information is used and is responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018).
The short version
- You can play the daily round without an account. Your round is then kept in your browser, not by us.
- With an account we keep your email address, your display name and what you play, so we can run the leaderboards, friends, leagues, matches and memberships.
- Your display name and your scores are public. Your email address never is.
- Payments are taken by Stripe. Your card details never reach this site.
- There is no advertising, no analytics and no tracking, and we do not sell or share your information for marketing.
If you play without an account
Your rounds, streak and settings are kept in your browser's storage on your device (listed below). Nothing about them is sent to us. Your browser still has to fetch the game from our host and the leaderboards from our database provider, and like any website they see your IP address and browser details when it does.
What we keep if you have an account
Your account
Your email address and your password, which is stored only in a scrambled form (a hash) that cannot be turned back into the password. We also keep how you sign in and when you created the account and last signed in.
If you sign in with Google or Microsoft, we receive the details they share, which can include your name, email address and a link to your profile picture. They are stored with your sign-in record and are not shown anywhere in the game. If you add a passkey, we keep its public key; the private part never leaves your device.
What you play
- Your display name, which you choose, and when you last changed it.
- Each ranked round: the day, every shot you played (club, aim and power) and the score worked out from them.
- Target range sessions: the flag, your shots and the score.
- For fair play: each posted round is checked automatically for signs that a program found it, and a round that stands out is noted for a person to look at before anything is done. We also count how often your account calls the game's server, to stop a script flooding it; the counts are deleted after two days.
- Your friend code, friend requests and friends, and the leagues you create or join.
- Live matches you play: the players, every shot, whose turn it was, results and when your browser last checked in. Your aim before a shot is sent live to the others in the match while you line up, and is not stored.
Guests in live matches
Joining a live match as a guest creates an account with no email address or password. It holds the display name you choose and the matches you play. A guest account that never plays a match is deleted a day after it was last used, and any other guest account 30 days after it was last used.
Memberships
When you start a membership we create a customer record for you at Stripe and give it your email address. We keep Stripe's reference for that customer and for your subscription, its price, its status, when the period you have paid for ends and whether you have cancelled. Stripe takes the payment on its own pages; we never see or store your card number.
What other people can see
- Anyone can see the leaderboards, which show display names, scores and holes in one, and each player's stats.
- The shots of a ranked round are private to you until that day is over. After that anyone can watch the round back.
- Your friends see your scores side by side with theirs, and can watch your live matches.
- League members see each other's names and scores in that league.
- Players in a live match see each other's names, shots and results.
Why we use it
- To provide what you signed up for (performing our contract with you): your account, the leaderboards, friends, leagues, live matches and your membership.
- To keep the game fair and working (our legitimate interests): checking every ranked round by replaying its shots, stopping abuse and keeping the service secure.
- To meet legal duties: keeping records of payments for tax and accounting.
We send email only for your account, such as confirming your address or resetting your password. We do not send marketing email.
Who handles it for us
- Supabase runs our database and sign-in, and sends sign-in emails.
- Vercel hosts the site and runs the parts of it that work on the server.
- Stripe takes membership payments and keeps the payment records.
- Google and Microsoft, only if you choose to sign in with them.
Each of these handles your information under its own terms and keeps short-lived technical logs, such as IP addresses, for security. Some of them store or access information outside the UK, mainly in the United States. Where that happens, the transfer is covered by the safeguards UK law requires, such as UK adequacy regulations or the UK's International Data Transfer Addendum.
On your device
Par 36 does not set cookies. It uses your browser's local storage for the items below, all of which the game needs to work as you would expect, so it does not ask for consent first. Clearing your browser's site data removes them, along with any rounds that have not been posted. Stripe's checkout and billing pages are on Stripe's own site and set their own cookies there.
| Name | What it holds |
|---|---|
| dcg:round:<day> | The shots of that day's round, so a reload carries on where you were. Deleted after 14 days. |
| dcg:history | The days you finished a round and your scores, for your streak. |
| dcg:practice:round:<course> | Practice rounds in progress. Deleted after 14 days. |
| dcg:practice:count | How many practice rounds this device has started today, for the daily allowance. |
| dcg:posted, dcg:replayed | Which account posted, or replayed, which day's round on this device, so a round is not sent twice. Holds account ids only. Days older than 14 days are dropped. |
| dcg:range-pending | A target range ball you have struck that the server has not yet confirmed, so it still counts after a reload. |
| dcg:settings | Whether sound is on. |
| dcg:seen-how-to | That the tutorial has been offered, so it is not offered again. |
| sb-… | Your sign-in session, kept by Supabase's sign-in library while you are signed in, including as a guest. Removed when you sign out. |
| dcg:social-sign-in | Kept for the current tab only, while you are away signing in with Google or Microsoft, so the game can tell you whether it worked. |
How long we keep it
Your account and everything linked to it is kept until the account is deleted. You can delete it yourself with Delete account in the account menu, which cancels any membership and removes your profile, rounds, range sessions, friends, league places and your own live match records. A league you run passes to its longest-standing other member, or is deleted if it has none. A finished match stays in the other players' history without your shots. Guest accounts are deleted as described above. Stripe keeps payment records for as long as the law requires, after your account has gone.
Your rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong (you can change your display name yourself);
- delete your account and its information (you can do this yourself from the account menu);
- stop or limit how we use it, or object to a use based on our legitimate interests;
- give you the information you provided in a form you can take elsewhere.
To ask, get in touch. We will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes, the new version will be posted here with a new date. If a change affects how we use information we already hold, we will say so in the game before it takes effect.