Privacy Policy

1. Who we are

Пасьянс.укр (the Service) is a website at пасьянс.укр, formerly 9online.cards, where you can play free card games in a web browser: Klondike solitaire and the multiplayer card game Nine Online.

The Service is a non-commercial project. It is operated by Roman Zaiats in Austria (“we”, “us”), who is the data controller for the personal data described in this policy.

Privacy questions and requests: [email protected].

2. The short version

• The games are free. There are no adverts inside them, and nothing in them can be bought with real money.
• We do not sell or rent personal data, and we do not share it with data brokers.
• We advertise the Service with Google Ads. Its tag sets cookies in your browser and tells Google about your visit, so we can see which of our ads bring players in. See sections 3.6, 6 and 7.
• Apart from those cookies, the data the Service keeps in your browser is held in localStorage and listed in section 7.
• You can play as a guest without giving us an email address at all.
• The most sensitive thing we hold is your email address, and it is used only to sign you in and to send you the notifications you asked for.

3. What we collect

3.1 Account data

When you first play Nine Online we create a guest account so you can play immediately. It holds a randomly generated display name, an avatar, a coin balance and a player ID — no email address and no name of yours. Solitaire can be played without any account.

If you sign in, we additionally hold:

Signing in while playing as a guest merges the guest account’s progress into your signed-in account.

3.2 Social data

• Friendships and friend requests — who you sent a request to, who sent one to you, and who you are friends with.
• Push subscriptions — if you allow browser notifications, we store the push endpoint URL and encryption keys your browser gives us, so we can send friend requests and table invites to your device.
• Presence — whether you currently have an open connection to the game, kept only while you are connected.

3.3 Game history

We record the events of the tables you sit at: rooms created, rounds dealt, cards played, results, and which players took part. This is what powers the in-game history screens.

For solitaire, we record each game you win: the deal, the draw mode, the time, the number of moves and the score. The win is linked to your account if you have one in this browser; if not, it is stored with a random code kept in your browser, so that it can be added to your account if you sign in later. This is what marks the deals you have solved and compares your time with other players’.

3.4 Usage analytics

We record a small set of product events — for example landing on the site, creating a guest account, playing a first card, copying an invite link, signing in, leaving a table, and starting, winning or giving up a solitaire hand with its time, moves, hints and undos — together with how long a visit lasted, how much of it was spent at a table, how many rounds you played before leaving it, and whether you left in the middle of a round. If you arrived from one of our ads, we also record which campaign and search keyword it was.

These events are tagged with a random identifier (nine_anon_id) stored in your browser, and with your account ID if you are signed in. They are sent to our own server, not to a third-party analytics service, and are stored in our database. We use them only to understand how the game is used and where new players get stuck.

3.5 Technical and diagnostic data

• Server logs — for each request, metadata such as the URL, HTTP method, status code and timing. Request bodies, response bodies and Authorization headers are deliberately excluded from logging.
• Error reports — when something breaks in your browser or on our server, we receive the error message, a stack trace and the build version. The error tracker is configured not to attach IP addresses, cookies or request bodies, and URLs are stripped of anything that could carry a token before they are sent.
• IP address — as with any internet service, your IP address is visible to our hosting provider and appears in its infrastructure logs. We do not use it to profile you.

3.6 Advertising measurement

We run ads for the Service on Google. To measure whether they work, every page of the Service loads the Google Ads tag (gtag.js). When it loads, Google receives your IP address, browser and device details, the page you are on, the page you came from, and — if you arrived by clicking one of our ads — the ad click identifier. The tag also sets cookies (section 7).

Google processes this data as described in How Google uses information from sites or apps that use its services, and may use it for its own purposes, including to show you ads. You can manage ad personalisation at myadcenter.google.com, and you can block or delete the cookies in your browser settings without affecting the game.

3.7 What we never collect

We do not ask for and do not store: passwords (sign-in is by one-time code), payment or card details, your real name, your address, your phone number, precise location, or any special-category data. There is no chat in the game, so there are no private messages for us to hold.

4. Why we use it, and on what legal basis

5. What other players can see

Other players can see your display name, avatar, level, XP, coin balance and whether you are online. These appear on the leaderboard, in player search, at tables and in friend lists. Your player ID is visible to anyone you share it with, so that they can add you.

Your email address is never shown to other players.

The game includes automated opponents (“bots”) alongside human players.

6. Who we share data with

We do not sell personal data. We share it only with the providers that make the service run, and with Google Ads to measure our advertising:

We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims.

7. Storage in your browser

The only cookies on the Service are set by the Google Ads tag (section 3.6):

The games themselves use no cookies. The following values are kept in your browser’s localStorage and are never used for advertising:

Clearing your browser storage signs you out and, for a guest account with no email attached, makes that account unreachable.

8. International transfers

Our servers are in the European Union (Frankfurt). Some providers listed in section 6 may process data outside the EEA. Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.

9. How long we keep data

• Account data — for as long as your account exists.
• Inactive accounts — an account with no sign-in for 24 months may be deleted, along with the data attached to it.
• Guest accounts — kept while they remain reachable; a guest account whose browser storage has been cleared is unreachable and is deleted on the same schedule as an inactive account.
• Game history — kept so that you and the players at your tables can review past games.
• One-time sign-in codes and magic links — minutes; they expire and are removed automatically.
• Push subscriptions — until you turn notifications off or the subscription stops working.
• Server logs and error reports — kept according to our log provider’s retention settings, typically a matter of days to a few weeks.
• Analytics events — 13 months, after which they are deleted automatically.
• Google Ads cookies — for the lifetimes listed in section 7; what Google itself retains is governed by Google’s policies.

10. Your rights

If you are in the EEA or the UK, you have the right to access your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. Similar rights exist under other privacy laws, including the right not to be discriminated against for exercising them.

Some of these you can exercise directly in the game: your display name, avatar, theme, language, notification preferences and friend list are all editable in your profile.

Deleting your account is not yet self-service. Email [email protected] from the address on your account and we will delete it, along with the personal data attached to it, without undue delay and within 30 days. Game-history rows that also record other players’ games may be retained in a form that no longer identifies you.

You can complain to a supervisory authority — for us, the Austrian Data Protection Authority (Datenschutzbehörde) — though we would appreciate the chance to put it right first.

11. Children

The Service is not intended for children under 13. We do not knowingly collect personal data from them. If you believe a child under that age has given us personal data, contact [email protected] and we will delete it.

12. Security

Sign-in uses one-time codes rather than passwords, so there is no password of yours for us to lose. Traffic is encrypted in transit. Sign-in codes expire and are limited in the number of attempts allowed. Secrets are held in encrypted configuration, not in our source code, and sensitive fields are excluded from logs and error reports by design. No system is perfectly secure, and we cannot guarantee absolute security.

13. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects for you.

14. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you in the game or by email before it takes effect.

15. Contact

Roman Zaiats
Austria
[email protected]

See also our Terms of Service.