Privacy Policy
Tesserra is a small independent browser game. This page explains, in plain language, what the game collects, why, who else handles it, and how to remove it.
Last updated: October 10, 2026
Who runs Tesserra: Areg Abrahamians, an independent developer. There is no company behind the game. Mailing address: 2108 N St, Ste N, Sacramento, CA 95816. Copyright notices go to the designated agent listed in the Terms.
Contact for anything on this page: help@tesserra-game.com
1. Playing without an account
You can play without signing up. Without an account, the game keeps your settings and progress in your own browser (see section 7). Our hosting provider still sees the technical details every website receives, such as your IP address and browser type, when your browser loads the game.
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address and password (stored hashed) | You sign up with email | Log you in and send account emails such as confirmation and password reset |
| Google or Discord account details (such as email, name, and profile picture link) | You sign in with Google or Discord | Log you in. Your provider name is not shown to other players. |
| Username | You create an account | Shown on leaderboards and in multiplayer instead of your email or real name |
| Birth year | You create an account | Confirm you are 13 or older. It is stored privately with your login record, not on your public profile. |
| Date you agreed to the Terms and this policy | You create an account | Record that you agreed |
| Scores, level completions, levels you publish, and game preferences synced to your account | You play while signed in | Leaderboards, progress across devices, and published levels |
| Gameplay analytics events, such as game started, level completed, and screen size | Only after you choose Accept on the analytics banner | Understand which parts of the game work and which don’t |
We do not run ads, sell data, record your screen or sessions, or offer paid plans.
3. Analytics and your choice
Analytics is off until you choose. The first time you open the game, a banner asks whether we may count gameplay events. Accept and Reject are equal choices. Nothing is sent to our analytics provider unless you accept.
- If you accept and you are signed in, events are linked to a random account ID, never to your email or name.
- You can change your mind at any time using Privacy choices on the game start screen or in Settings.
- If your browser sends a Global Privacy Control signal, we treat it as Reject and don’t show the banner.
- Session recording is turned off in the game code.
4. Multiplayer
Duel rooms connect two players’ browsers directly to each other (peer to peer). To find each other, browsers exchange connection details through public relay networks (BitTorrent trackers, MQTT brokers, and Nostr relays) and Google’s public STUN servers. Because the connection is direct, the other player’s browser can see your IP address, the same as in most peer-to-peer games. Your username and moves are shared with the other player. We do not store multiplayer matches.
5. Who else handles your data
- Supabase: login, account database, scores, and the account deletion service.
- Amazon Web Services (CloudFront and S3): hosts and delivers the website. Keeps standard request logs, including IP address, for up to 90 days.
- PostHog: gameplay analytics, only after you accept. Requests go through our own domain. PostHog may estimate a rough location from your IP address.
- Google and Discord: only if you choose to sign in with them.
- Public multiplayer relays and Google STUN servers: only when you use duel rooms (see section 4).
Fonts and icons are served from our own site, so loading a page does not contact Google Fonts or other font hosts.
These providers may process data in the United States and other countries.
6. How long we keep it
- Account data (login, username, birth year, scores, completions): until you delete your account.
- Analytics events: up to 12 months after they are collected.
- Hosting logs: up to 90 days.
- Levels you published: stay playable after you delete your account, with your account link removed.
7. What is stored in your browser
| Item | Purpose | When |
|---|---|---|
| Supabase session (local storage) | Keeps you signed in | While signed in |
| Analytics choice (local storage) | Remembers Accept or Reject | After you choose |
| Game settings and progress (local storage) | Sound, display, controls, and Learn to Play progress | Always, on your device only |
| Signup details in progress (session storage) | Carries your username and birth year through a Google or Discord sign-in | During signup, cleared when the tab closes |
| PostHog identifiers (local storage) | Groups analytics events from the same browser | Only after you accept |
We do not use advertising cookies.
8. Your rights
- Delete your account: open Settings in the game and choose Delete account. This removes your login, profile, scores, and level completions right away.
- Get a copy, correct something, or ask a question: email help@tesserra-game.com. We may ask you to confirm the request from the email on the account.
- Turn analytics off: use Privacy choices, or turn on Global Privacy Control in your browser.
Depending on where you live, you may also have the right to object to or restrict processing, and to complain to your local data protection authority.
9. Children
You must be 13 or older to create an account. Signup asks for your birth year and stops if you are under 13; no account is created. Anyone can play without an account. If you believe a child under 13 has an account, email help@tesserra-game.com and we will delete it.
10. Security
Connections use HTTPS, database tables use row-level access rules, and passwords are stored hashed by Supabase. No system is perfectly secure. Report security issues to security@tesserra-game.com.
11. Changes
If we make a material change to this policy, we will post it here at least 30 days before it applies and, where we have your email, let you know by email. The date at the top shows the latest version.
See also the Terms of Service and the Accessibility statement.