Privacy Policy
Viaduct is an educational online card game. This policy explains what information the service handles, why it is needed, and the choices available to players. “Viaduct,” “we,” and “the service” refer to the Viaduct Club online game at viaduct.club. Viaduct is currently operated by Zhimin Lin in a personal capacity.
Information we handle
Guests
A Guest supplies a temporary display name. The service also creates a random reconnect token and temporarily records the Guest’s table, seat, connection status, and reconnect deadline. The database stores only a hash of the reconnect token, not the token itself.
Guest play does not add personal game statistics to a permanent account.
Registered members
Registration requires:
- a username;
- an email address;
- a password; and
- confirmation that the player is at least 13 years old.
Passwords are stored as salted, computationally expensive hashes. We do not store readable passwords. Account-session, email-verification, password-reset, and email-change tokens are stored only as hashes.
Registered accounts also contain account status, verification dates, board counts, positive and negative point totals, net points, and identifiers used to prevent duplicate score credit. Rated four-member games also update the member's Viaduct Performance Rating (VPR), rank, rated-board count, and rank progress. A member’s completed-board count, total positive points, VPR, and rank may be visible to other players. Email addresses, negative points, net points, account-security data, and private report details are not public.
Game and table information
The service handles usernames, seats, table ownership, board numbers, deals, auctions, card play, contracts, results, and scores so that it can run games, recover interrupted play, avoid assigning a previously seen deal to a player, and maintain member reports.
Completed registered-member games retain the deal, contract, result, participants, and score credit. Detailed auction and card-play history is retained for one year only when a player with detailed-history eligibility participated. Guest-only play does not create permanent member statistics.
Table chat
Table chat is available to everyone seated at the same table while waiting and during completed-board review. It is hidden during bidding and card play and is unavailable when one person practices with three robots. Messages include the displayed username, seat, text, and send time. They are held only in server memory, limited to the latest 80 messages for a table, and removed when the table closes or the server restarts. They are not written to MongoDB or included in application statistics. Other players may still record what they see, so do not post sensitive personal information.
Technical and security information
The service processes connection information such as IP address, browser origin, request timing, and operational error information to prevent abuse, enforce request limits, diagnose failures, and keep the service secure. Operational reports are designed to exclude passwords, tokens, cookies, email addresses, account identities, connection strings, private hands, and complete deals.
How we use information
We use information to:
- create and secure accounts;
- verify email addresses and deliver account messages;
- let Guests and members enter, reconnect to, and complete games;
- enforce game rules and calculate results;
- maintain reports and public game totals;
- calculate VPR, rank, and rank progress for eligible four-member games;
- prevent duplicate credit, abuse, and unauthorized access;
- operate, diagnose, back up, restore, and improve the service; and
- respond to support, safety, and privacy requests.
We do not sell personal information. The current prerelease does not use personal information for targeted advertising and does not use third-party advertising trackers.
Viaduct also stores privacy-limited daily and weekly operational aggregates, such as active-user counts, tables, board completion, reconnect outcomes, and error totals. Unique-user markers use keyed hashes and are not stored with usernames, display names, email addresses, IP addresses, chat, bids, cards, or board contents.
Cookies and browser storage
Registered sign-in uses a secure, HttpOnly cookie that normally expires after 30 days. The cookie cannot be read by page scripts. A successful password reset or confirmed email change ends existing account sessions.
Guest recovery uses browser storage containing a random reconnect credential. It lets the same browser attempt to recover a Guest identity and reserved seat. Clearing cookies or site storage can prevent automatic recovery and may require the player to identify again.
Viaduct does not currently respond differently to browser “Do Not Track” signals because it does not track players across unrelated websites. Service providers may process technical data needed to deliver their services, as described below.
Service providers
We use service providers to operate Viaduct:
- Render hosts and runs the web service and operational logs.
- MongoDB Atlas stores account, board, game, and recovery information and
provides database backups.
- Resend sends verification, password-reset, email-change, and operational
alert messages.
- Pwned Passwords by Have I Been Pwned checks whether a proposed password
is known from a breach. Viaduct sends only the first five characters of the password’s SHA-1 hash and requests a padded range response; it does not send the password, email address, username, or complete password hash.
These providers process information for service delivery, security, or operations. Viaduct does not authorize them to use player information for Viaduct advertising.
Retention
- Unverified accounts are automatically scheduled for deletion after seven
days if verification is not completed.
- Registered login sessions expire after 30 days.
- Password-reset links expire after one hour. Email-verification and
email-change links expire after 24 hours.
- A disconnected player’s seat is normally reserved for three minutes.
- A disconnected Guest identity normally remains recoverable in the same
Regular Play browser for 24 hours, even after its seat reservation expires.
- Recovery records that are no longer needed are cleaned up after a limited
operational period, normally 24 hours for stale recovery state.
- Eligible detailed auction and card-play history expires after one year.
- In-memory table chat is removed when its table closes or the server restarts.
- Operational unique-user markers expire after nine days and event
idempotency markers expire after 35 days; aggregate daily and weekly reports may be retained for long-term operating trends.
- Account identity, totals, completed registered-member game results, and
board exposure records are kept while needed to operate the account and prevent repeated deals or duplicate credit.
- Provider logs and backups follow operational retention settings and backup
cycles. Deleted information may remain in a protected backup until that backup expires or is replaced.
After a verified account-deletion request, Viaduct will promptly disable the account and complete the active-data deletion and anonymization process within 30 days. Protected backup copies expire or are replaced through the normal backup cycle and are not restored as active accounts.
Player choices and requests
A member can review the account information shown in Profile and My Report, change a verified email address using the authenticated confirmation process, reset a password, and sign out.
A registered member may request account deletion at privacy@viaduct.club using the email address registered with the account. The request should identify the username and must not include a password, session token, verification link, or other security credential. Viaduct will verify account ownership before acting.
After verification, Viaduct will promptly disable sign-in, revoke active sessions and account-action tokens, and remove the public profile. Within 30 days, Viaduct will delete or permanently disconnect the email address, password hash, account credentials, preferences, VPR and rank information, personal score totals, and other account-specific security and recovery data.
Deleting one member must not corrupt the records of the other players who completed a board. Viaduct may therefore retain the board, auction, card-play, contract, result, score, anonymous duplicate-credit evidence, and operational statistics. The deleted member's username and account link will be removed or replaced with Deleted Player so the retained record no longer identifies the former member in ordinary use.
Viaduct may retain limited protected information when reasonably needed for security, fraud or abuse prevention, dispute handling, legal obligations, backup integrity, or accurate game records. Such information will not remain part of an ordinary public profile, ranking, or marketing record. Viaduct will send a completion notice after the active deletion and anonymization steps are finished. Protected backup copies may remain until the normal backup cycle expires or replaces them.
Players under 13
The initial prerelease is limited to players age 13 or older. Both a Guest and a person registering an account must confirm that they are at least 13. The service does not knowingly collect account or Guest play information from a child under 13. If we learn that a participant is under 13, contact us so that we can review and remove the information as appropriate.
Future supervised educational programs for younger players would require a separate design, parental notice and consent process, and updated policy.
Security
Viaduct uses HTTPS, hashed passwords and tokens, restricted database access, same-origin checks, request limits, private-hand access controls, backups, and operational monitoring. No internet service can guarantee absolute security. Players should use a unique password and keep account links and devices private.
Changes to this policy
The effective date at the top will show when this policy takes effect. If a material change affects how player information is collected, used, or shared, we will provide a clear notice in the service or by email when appropriate.