Privacy Policy

2. On-Device Local Storage (Offline & LocalStorage)

To deliver responsive performance and full offline support, settings such as theme preferences (light/dark), sound effects, language selection, scores, achievements, and game progression are stored strictly on your local device or browser storage (via localStorage, IndexedDB, and Service Workers).

This data stays on your device and is not uploaded to our servers, with one optional exception: the records that join the Mesa Codex global ranking (section 4). You can clear local data at any time by clearing your browser/app storage or uninstalling the app.

3. Multiplayer Connectivity (Peer-to-Peer & LAN)

In multiplayer game modes (card games, board games, and group puzzles):

• Direct P2P Connection: Moves and in-game communication flow directly between players' devices using WebRTC or local area network (LAN), without intermediate servers inspecting game moves.
• Transient Signaling: We maintain a lightweight signaling server (Cloudflare Workers) solely to facilitate the initial handshake between devices via room codes or QR codes. No messages, game boards, or personal data are stored in permanent databases.
• Players on the same network ("Nearby"): while Mesa Codex is open, people on the same network (same public IP address) can see your room name, what you are playing, the room number and a summary of your stats (wins, time played and best record in a few games). The IP is only used to group the network and is turned into a code (hash) before use. None of this is written to a database: it stays in server memory only while the page is open. You can turn it off in My profile › Profile › Privacy.

4. Global Ranking and Linked Devices (Mesa Codex)

To compare records between players, Mesa Codex keeps a global ranking with no account, password or email. The public name is drawn at random from a fixed list (for example, "Coruja Astuta #0042"): nobody types their own name or free text. Participation is on by default and can be turned off at any time in My profile › Profile › Privacy. Once off, nothing else is sent.

What is stored in our database (Cloudflare D1):

• Player: a random identifier, the drawn name (stored as positions in the fixed list), the creation date and the date of the last name change.
• Records: the best value for each game and mode (points, time or attempts) and the date it was reached.
• Linked devices: a random identifier per device, the device and browser type (for example, "Android · Chrome", picked from a fixed list based on the browser), the link date and the last-use date (updated at most once a day).
• Link requests: while a new device waits for confirmation, we store the code, the device type and a code (hash) of the IP to limit abuse. The request expires in 10 minutes and is deleted once used or expired.

We do not store email, phone, password, location, the name you type in rooms or your IP address in clear text. Your device keeps a signed token that identifies your player, and linking another device requires confirmation on a device already on the ranking. The data is kept until you erase it (section 7).

5. Developer Utilities and Calculators

All utilities and tools (such as JWT decoders, data converters, PDF tools, cryptographic hashes, and validators) execute 100% client-side inside your browser. None of the text, keys, or files you process are ever transmitted to our backend.

6. Third-Party Advertising (Google AdSense)

Some of our pages and games may display subtle banner advertisements provided by Google AdSense to support domain and server maintenance costs.

• Google may use cookies, mobile advertising identifiers, and tracking technologies to serve relevant ads and measure traffic in accordance with Google's privacy policies. Learn more about how Google handles this data at How Google uses information from sites or apps that use our services.
• User Controls: In our games, ad banners feature clear controls to collapse or hide ads for the current day, ensuring gameplay controls remain unobstructed.

7. Your Rights (LGPD, GDPR & CCPA)

In compliance with international data protection frameworks (including LGPD, GDPR, and CCPA): we do not operate user accounts, and the only data we keep on a server is the pseudonymous global ranking data (section 4). You exercise your rights right away, on your own device: see what is stored in My profile (drawn name, positions and devices), correct it by drawing another name, stop sending by turning the ranking off, and erase everything from the server in My profile › Devices › "Erase my ranking data". Local data is erased by clearing your browser data. If you lose access to the device, write to the contact below.