Privacy Policy

Last updated: September 2026

1. Who we are

SumoVolley.io is a free online multiplayer browser game operated by PlayBoxx Games. We do not ask for your real name, your email address, or any payment details to play.

The fastest way to reach us is the Support button on the login screen — it works even if you cannot get into your account. See section 14 for all contact routes.

2. What we collect

When you register an account:

• Username — chosen by you. It does not have to be your real name.
• Password — stored only as a one-way bcrypt hash. We cannot read it.
• Recovery phrase — four words, generated by us and shown to you once, so you can regain access without an email address. We store only a one-way hash of it, never the words themselves. There is no way for us to look it up or send it to you.
• The IP address you registered from — kept on your account. See section 3.

While you play:

• Game statistics: rating, wins, losses, draws, games played, highest jump, win streaks, time played
• Preferences: theme, language, avatar, and your privacy settings
• Account creation date and the date you last signed in

Devices you sign in from: when you sign in, your browser is given a device cookie and we record that device on your account. We store a one-way hash of that cookie, a coarse label such as “Android · Chrome” or “Windows · Edge”, and when it was last used. We deliberately do not store the full browser identification string, because that is detailed enough to act as a fingerprint. A device record grants no access by itself — it exists so an administrator can judge an account-recovery request, and so you can see and end other sessions yourself.

If you report a bug or another player:

• What you wrote, and your username
• Your operating system, browser family, and window size — the same coarse label as above, never the full browser string. Almost every fault we receive turns out to be specific to one browser or one screen width, so without this we have to ask you first.
• Only if you choose to attach one: a screenshot. You pick what it shows — the game field, the public or table chat, or (when reporting a player) your private conversation with that player. Nothing is captured without you selecting it.

If the game hits an error in your browser, it sends us the error message, the file and line it came from, the page address, your username if you are signed in, and the same coarse device label. This is how we find faults that players never report.

If you contact support from the login screen, we keep your message, the username you gave, and your IP address, so we can tell a genuine lock-out from an attempt to take over someone else's account.

If moderation action is taken, we keep a record of the ban or mute, the reason given, which moderator acted, and any appeal you submit.

If you ask an administrator to reset your password, we keep that request and, only if you choose to give one, an email address to reply to. Both are deleted once the request is resolved.

3. About IP addresses

This deserves its own section, because an IP address says both too much and too little.

• We keep the IP address you registered from on your account, and the IP attached to a support message.
• We use IP addresses while you are connected to limit how many connections and sign-in attempts can come from one place. That short-term use is not written to your account.
• A stored IP is only ever context for a human decision — typically “is this recovery request plausible?”. Nothing in the game grants access, refuses access, or bans anyone because two IP addresses match. One address can be a whole household, a school, or an entire mobile network, and the same phone changes address when it moves from wi-fi to mobile data.

4. What we do not collect

• Your real name, date of birth, or address
• Payment information — SumoVolley.io is entirely free
• Location data
• The full browser identification string (see section 2)
• Any advertising or cross-site tracking data

5. Chat messages

Public chat, table chat, and direct messages between players are not stored. They exist only in memory and are gone when the server restarts. We cannot go back and read what was said. There are exactly two exceptions, and both are visible to you:

• A message to or from a moderator or administrator is held on the account if the recipient is offline, so a question about a ban does not simply vanish. It is delivered the next time they sign in.
• A chat screenshot you attach to a report yourself is stored with that report.

Separately, the Timeline in Interactions keeps its last 10 lines in your own browser (section 9). Chat and private messages are kept there without their content, and who joined or left is not kept.

6. How we use your data

• To run your account and keep your progress
• To show the leaderboard (username, rating and avatar only)
• To enforce the game rules, and to let you appeal a decision
• To fix faults in the game
• To let you recover your account, and to let you end sessions on devices you no longer use

We do not use your data for advertising or marketing, and we do not profile you.

7. Who can see your data

• Other players see your username, rating, avatar, rank, highest jump and the statistics shown on your profile.
• Moderators can see reports, bans and appeals.
• Administrators can additionally see the account information described in section 2 — including your registration IP and your device labels — for account recovery and rule enforcement. They can never see your password, your recovery phrase, or your private messages: none of those are stored in a readable form.

We do not sell, share or trade your data with anyone.

8. How long we keep it

• Your account: for as long as it exists.
• When you delete your account: it disappears from the game immediately — out of the player list, the rankings and every public screen. A copy is then kept in an archive that only an administrator can reach, and your username stays reserved for you: nobody else can register it, ever.
  That archive is kept for as long as the game runs, and there are two reasons for it. It means a deletion made in anger, or by someone who got into your account, can still be undone. And it means nobody can come back later wearing your name.
  If you would rather have the copy erased outright, ask us (section 14) — an administrator can delete the archived copy permanently, which also frees the username again. We do that on request; it cannot be undone afterwards.
• Devices: a device record expires after 365 days without use, and you can clear them all at any time (section 10).
• Reports, screenshots, support messages and moderation records: kept until handled, then removed. Ban records are kept while the ban is relevant.
• Error reports: kept until dismissed; only the 200 most recent distinct faults are held.
• Aggregate counts (how many games were played on a given day, peak number of players): kept indefinitely. These contain no usernames.

9. Cookies and browser storage

We use two cookies. Both are strictly necessary, both are HttpOnly (JavaScript cannot read them), both are SameSite=Lax, and both are sent over HTTPS only in production.

• Session cookie — keeps you signed in. Lasts one day, or 30 days if you tick “remember me”.
• Device cookie — identifies this browser as one you have used before, as described in section 2. Lasts up to 365 days from its last use. It grants no access on its own: it can never sign you in, reset your password, or skip a password check.

The game also keeps a few small items in your browser’s local storage. They stay on your device and are never sent to us:

• Your theme and language, so the first screen already shows them
• Which announcements you have read, and which tips and help screens you have closed
• A few display preferences, such as graphics quality
• On the home page, your username and avatar, so it can greet you. They are removed when you log out.
• The last 10 lines of your Timeline in Interactions, per account. Chat and private messages appear there without their content, only as “yoyo sent you a message”. Who joined or left is not kept.

We use no advertising cookies, no analytics cookies, and no third-party tracking. Both cookies and this storage are needed for features you use, so no cookie banner is required under EU law. You can remove the local storage at any time by clearing this site’s data in your browser.

10. Your rights (GDPR)

If you are in the EU or EEA you have the rights below. Most are available directly in the game, without asking us:

• Access & portability — My Account → Export My Data
• Erasure — My Account → Delete Account (see section 8)
• Security of your account — My Account → Logout Everywhere ends every other session and clears your other device records; Change Password does the same
• Object to messages — My Account → Privacy Settings → Accept Messages
• Object to challenges — My Account → Privacy Settings → Accept Challenges
• Rectification — having information about you corrected if it is wrong. This, or any request not listed here — contact us (section 14)

Thirty days is the maximum allowed under EU law, not our target — in practice we answer far sooner.

Anything urgent jumps the queue. If someone else has taken over your account, or deleted it, contact us straight away using the Support button on the login screen. Two things are worth knowing: a deleted account can be restored by an administrator and your username stays reserved for you (section 8), and you can shut an intruder out yourself in seconds with Logout Everywhere and a password change — you do not have to wait for us to do that.

You also have the right to complain to your national data protection authority.

11. Third parties

Your browser loads nothing from anyone else: emoji graphics (Twemoji, © Twitter Inc., CC BY 4.0) and the Cascadia Code typeface are served from this site. There are no external scripts, fonts, or trackers.

Two companies do handle traffic on our behalf, and both necessarily see your IP address:

• Cloudflare — sits in front of the site to absorb attacks and serve files faster.
• Fly.io — hosts the game server and the disk your account is stored on.

Neither uses your data for their own purposes.

12. Age requirement

You can play without an account. Anyone can join as a guest — there is no age limit on playing the game, and we ask a guest for nothing at all.

To create an account you must be at least 16 years old.

This is not a number we picked. Under EU data protection law (GDPR, Article 8) sixteen is the default age at which a young person can agree to an online service using their data on their own; below that age a parent or guardian has to agree. Individual EU countries are allowed to lower it, but never below thirteen. We apply sixteen everywhere, because one clear rule beats twenty-seven different ones.

By registering you confirm that you meet this requirement. If we learn that an account belongs to someone under 16, we will delete it.

13. Security

• Passwords and recovery phrases are stored as one-way bcrypt hashes. We cannot read or recover either.
• Signing out everywhere, changing your password, or recovering your account immediately invalidates every other session — including any session belonging to someone who should not have been there.
• When your account is saved, the new version is written alongside the old one and only swapped in once it is complete. A crash or power cut halfway through therefore cannot leave your account half-written.
• No system is perfect. If you believe something is wrong with your account, use Logout Everywhere and change your password, then contact us.

14. Contact

For a privacy question, a data request, or anything else:

15. Changes to this policy

We may update this policy. The date at the top and bottom of this page shows when it last changed. Continuing to use the service after a change means you accept the updated policy.