Effective: 2026-10-30
This policy covers the Duel game. It says what data the game keeps, what it sends to us, and what you can do about it.
The short version: Duel sends us nothing unless you turn it on. There are three switches, and all of them start off. You can change them at any time in Settings. Playing online is the one exception: connecting to another player goes through Cloudflare (see "Playing online").
Duel is made by Drew Williams, a sole developer in the United States ("we"), who decides what happens to the data described here. For anything about your data, write to [email protected].
The game keeps these files in its settings folder. None of them is sent anywhere unless a switch below says so.
You can delete any of these files. The game recreates what it needs.
Off until you turn it on. With it on, the game sends each new crash report to us the next time it starts. A crash report contains:
Before sending, the game removes folder paths that contain your user name. A crash report does not include your name, an account or Steam ID, or other files from your computer. A minidump holds the game's own memory. In rare cases that can include text you typed into the game.
The same switch sends each new desync report: the match record, which also holds the last 2 seconds of game state your computer saw and the other player's state where the two first differed, the game version and which parts of the game state differed. It holds nothing else from your computer.
Why: to find and fix crashes and desyncs. A match record lets us replay the exact match that crashed.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by turning the switch off. Reports already sent stay until they expire (see "How long we keep it").
Who handles it: crash reports are stored with Sentry (Functional Software, Inc.), which processes them for us under a data processing agreement. Sentry stores them in the United States. Transfers from the EU and UK rely on the EU-US Data Privacy Framework and its UK extension, and on standard contractual clauses. Sending a report means your computer connects to Sentry, so Sentry sees your IP address. We set Sentry not to store it.
Off until you turn it on. With it on, the game writes a short summary of each session when you quit, and sends it to us the next time it starts. A summary contains:
A summary does not include your name, user or computer name, an account or Steam ID, or any folder path. The game keeps summaries in its settings folder; with the switch off, it writes none and sends none.
Why: to find setups where the game runs badly, and fix them.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by turning the switch off. Summaries already sent stay until they expire (see "How long we keep it").
Who handles it: summaries are stored with Sentry, as crash reports are (see above), under the same agreement and transfer safeguards. Sentry sees your IP address when the game connects, and we set Sentry not to store it.
Off until you turn it on. Duel has no public stats page yet, so nothing is published. When it does, this switch lets your match stats appear on the Duel website. We will update this policy first, and say exactly what is shown.
Connecting to another player: when you play online, the game connects through Cloudflare. Unless you turn on Allow direct connections, your game traffic goes through Cloudflare's relay, and the other player's computer never sees your IP address. If you turn it on, the other player's computer can see your IP address. Cloudflare sees your IP address, port and connection times to relay the match, and keeps them as our processor under its data processing agreement. Its public documentation gives no retention period, and we never receive them. The signalling server we run keeps no IP address, and its logs are deleted after at most 7 days.
The signalling server also counts requests from your IP address for a minute at a time, to stop invite-code guessing and abuse.
Playing online needs you signed in to your Duel account (see "Your Duel account"). The game shows the signalling server the key our accounts server gave it, which holds only your player ID. When the server pairs you with the other player, it tells our accounts server which match key is yours (see "Your Duel account"), and keeps neither.
Legal basis: connecting you to the player you chose to play is needed to provide online play (GDPR Article 6(1)(b)). The signalling server's request counting is in our legitimate interest in stopping abuse and keeping online play's cost bounded (Article 6(1)(f)).
Who handles it: Cloudflare, Inc. is based in the United States and relays traffic through its data centres around the world. Transfers from the EU and UK rely on the EU-US Data Privacy Framework and its UK extension, and on standard contractual clauses.
When you sign in to Duel, you sign in with an account you already have elsewhere: Google, Steam, Apple or Discord. The game opens our sign-in page in your web browser, you sign in with that account there, and our accounts server gives the game its own keys to your Duel account. When you play through Steam, the game signs in with your Steam account directly, with no browser: Steam gives the game a sign-in ticket, which our accounts server checks with Steam. The game keeps your player ID and its key on your computer, in its own folder beside your settings, and deletes them when you sign out.
Your Duel account holds:
We ask Google for your Google account ID alone. We don't ask for, or keep, your email address, name or picture, and we keep none of Google's own keys to your Google account. Steam's sign-in tells us your Steam ID and nothing else; we don't look up your Steam profile, name, picture, friends or games. The keys the game gets from us hold only your player ID. While you sign in, the sign-in page sets cookies the sign-in needs, which expire within 10 minutes. None of them tracks you.
We ask Apple for your Apple user ID alone, and not for your name or email address, so Apple sends us neither (and offers no "Hide My Email" address, as there is no email to hide). Apple's user ID for you is one Apple makes for us alone. We keep none of Apple's own keys to your Apple Account.
We ask Discord only for its identify permission, the least that tells us your Discord user ID. With it, Discord also sends your username, display name, avatar and a few profile settings such as your language; we keep the ID and none of the rest. We don't ask for your email address, and we keep none of Discord's own keys to your Discord account.
On our account page you can link another login to your player, or unlink one. Signing in there keeps you signed in for an hour, with a cookie and a record of when it expires; we don't keep your browser's details with it. If a login you link already belongs to another player that has played no matches, we ask first, then move that player's logins to yours and delete it.
Why: to recognise you each time you sign in, so your player is the same everywhere you play.
Legal basis: providing the account you asked for (GDPR Article 6(1)(b)).
Who handles it: our accounts server runs on Cloudflare (see "Playing online"), which stores the account for us as our processor. Google handles your Google sign-in, and Valve your Steam sign-in, each under its own privacy policy, and each learns that you signed in to Duel. To check a Steam sign-in, our accounts server asks Steam whether it really vouched for your Steam ID, or which Steam ID the game's sign-in ticket is for. Apple and Discord do the same as Google for a sign-in with them.
Wherever you live, you can:
If you are in the EU or UK, you also have the rights the GDPR gives you, including to object to or restrict our use of your data, and to complain to your data protection authority. If you are in California, the CCPA gives you similar rights. We do not sell or share personal information as the CCPA defines those words.
Duel is not meant for children under 13, and we do not knowingly collect data from them. If you are under 16 and live in the EU or UK, ask a parent before turning on any of the switches. If you think a child under 13 has sent us data, write to [email protected] and we will delete it.
If the game starts collecting something new, it will be behind a switch that starts off, and this policy will say what it is before the game sends any of it. We will change the date at the top of this page whenever we change the policy.