Privacy Policy
Last updated: 29 October 2026
Operator contact: [email protected].
Information used to run the game
Guest play stores your chosen nickname and session identity. Registered accounts also store your email and a protected password hash. We store rooms, game actions, chat, results, statistics, account roles and moderation records to provide multiplayer games, reconnect players and manage access. Connection information is used for security and rate limiting.
What other people can see
Players and observers in a room can see nicknames, chat and public game actions. Opponents’ private hands and unplayed development cards are hidden during play. Public games may appear on the homepage as anonymous board previews, with a Spectate link. Private rooms are excluded from that preview. Leaderboards show player names and results.
Account services
We use Resend to deliver verification and password reset emails. Google reCAPTCHA v3 assesses account forms for abuse. If you choose Google sign-in, we store your Google account identifier and verified email; we generate a nickname which you can change in your profile. Google’s privacy policy applies to its services.
Cookies and browser storage
Necessary cookies support sign-in, security and reconnection. Clearing them can prevent recovery of a guest account. Optional Google Analytics stays blocked until you choose Accept cookies or enable Analytics in Customize cookies. Reject cookies keeps necessary cookies working and does not prevent playing. You can withdraw or change your choice at any time using Cookie settings in the footer or on this page; withdrawal stops further Analytics collection and removes accessible Catanist Analytics cookies, but does not erase data already sent to Google.
Google Analytics measures website pages on catanist.online only after acceptance. Room pages, including waiting rooms, gameplay, spectating and results, are excluded from analytics collection. We do not send player names, email addresses, chat, hands or game actions to Analytics. Advertising personalization and Google signals are disabled. Google reCAPTCHA loads when you submit a protected action; the analytics choice does not control it. Google services may also access existing Google-domain cookies according to your browser and Google settings. See Google’s Privacy Policy and Google’s cookie information.
Hosting and payments
The hosting provider processes requests needed to deliver the service. If you donate, Stripe handles payment details on its hosted checkout. Catanist does not receive your full card number. The operator can access payment records in Stripe. Read Stripe’s Privacy Policy for its handling of payment data.
Retention and requests
Room data remains until the room is removed by its lifecycle rules or administration. Room chat and event lists are limited to their most recent 100 entries. Accounts, results and moderation records currently have no automatic age-based deletion; session access expires after 30 days. Hosting and payment providers may retain their own records.
Depending on applicable law, you may request access, correction, deletion or restriction of your personal information, object to certain processing, or complain to your local data protection authority.