Privacy Policy
Last updated: July 15, 2026
Welcome to Go Arena (goarena.games), a free online platform for playing the game of Go. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website and services (collectively, the “Services”).
By using the Services, you agree to the practices described in this Policy. Please also read our Terms of Service.
Summary of key points
You should read this Policy in full, but here are the essentials:
- No account required to play.
- Guest play stores almost everything locally in your browser.
- Optional accounts let you save progress across devices.
- Signed-in sessions use an essential first-party cookie (not for advertising) plus browser storage so you stay signed in.
- You can delete most local data anytime by clearing your browser data for this site.
- We use Google Analytics 4 for aggregated site usage (for example, page views). We configure it to avoid collecting account emails, passwords, or other obvious personal identifiers in analytics events.
- Advertising may appear on the Services. Ads may use cookies or similar technologies from Google and other partners. In the EEA, UK, and Switzerland, a consent message may appear before non-essential advertising or analytics cookies are used.
A. Information from All Users (Including Guests)
- Nickname you choose when playing.
- Gameplay data — moves, results, board size, timers, ratings (ELO/kyu/dan), and game records (temporary).
- Technical & usage data — IP addresses (processed by our hosting provider), request logs, error reports, device type, and connection metadata.
- Local storage data — nickname, reconnect token, sound preferences, quick-match settings, puzzle progress (device-only for guests).
- First-party operational metrics — privacy-preserving, non-identifying beacons we collect on our own servers for reliability and performance monitoring (separate from Google Analytics).
B. Information from Optional Accounts
- Email address and hashed password.
- Username (nickname) linked to your account, which you may update in Account settings.
- Account-linked gameplay history, ratings, and related progress (such as puzzle progress when signed in).
- Session identifiers used to keep you signed in (see Section 4).
- Email-change confirmation data when you request a new email address.
C. Contact Form & Support
- Name, email, and message content you voluntarily submit.
D. Site analytics (Google Analytics 4)
When Google Analytics 4 (“GA4”) is enabled on the Services, Google may collect or receive device and usage information on our behalf as an independent controller or processor under Google’s terms, including approximate location derived from IP, browser/device type, referring site, and pages or screens viewed on goarena.games. We use GA4 for aggregated measurement of how the Services are used (for example, traffic and navigation patterns).
We design our GA4 implementation to send path-level page information without query strings or in-game identifiers that could function as personal identifiers, and we do not intentionally send account email addresses, passwords, or precise geolocation to GA4. You must not enter personal information into URLs or other fields in a way that would cause it to be transmitted to analytics systems.
E. Advertising partners
When ads are shown, Google (including Google AdSense) and related advertising partners may collect or receive device and usage information, such as IP address, cookie identifiers, approximate location derived from IP, browser/device type, pages viewed, and ad interaction data, under their own policies.
We do not collect precise geolocation, biometric data, or government IDs.
2. How We Use Information
We use the collected information to:
- Provide and improve the multiplayer Go experience (matchmaking, spectating, reconnects, ratings).
- Maintain leaderboards and enable player challenges.
- Prevent abuse and cheating.
- Respond to support requests.
- Send account-related emails (verification, password reset, email-change confirmation).
- Maintain signed-in sessions and show account-specific navigation after you log in.
- Understand site usage and platform performance through first-party operational metrics and Google Analytics 4 (aggregated).
- Display, measure, and improve advertising where enabled.
- Comply with legal obligations.
We do not sell personal information. We may display third-party advertising (including Google AdSense) to help fund free access to the Services. Ad partners may use cookies or similar technologies to serve and measure ads, including personalized ads where permitted by law and your settings. We do not use your optional account email or password for advertising or for Google Analytics measurement.
3. How We Share or Disclose Information
We share data only in these limited cases:
- With service providers (see Section 7).
- With Google for Google Analytics 4 site measurement, as described in Sections 1 and 4 and Google’s privacy policy.
- With advertising partners (including Google) to display, measure, and improve ads on the Services, as described in Section 4 and their privacy policies.
- To comply with law, court orders, or government requests.
- To protect the safety, rights, and security of Go Arena, our users, or the public.
- In the event of a business transfer (merger, acquisition, etc.), with appropriate protections.
We do not sell personal information.
4. Cookies, Local Storage & Tracking
Essential first-party session cookie (accounts): When you create a verified account and sign in, we set an HttpOnly first-party session cookie (for example, go_arena_sid). This cookie stores a session token so we can recognize your signed-in browser on later visits, keep you logged in, and show the correct Account navigation on first page load. It is not used for advertising or third-party tracking. The cookie is set with security attributes appropriate to our hosting environment (including HttpOnly; Secure in production; SameSite restrictions). It typically lasts for an extended period (on the order of many months) unless you sign out, delete your account, or clear site cookies.
Browser local storage (guests and accounts): We also use browser local storage (or, in some local-development modes, session storage) for essential gameplay functionality. This may include nickname, a reconnect/player token used for live games and some account API calls, sound preference, quick-match settings, and puzzle progress. Guest play works without the session cookie.
Site analytics (Google Analytics 4): When enabled, GA4 and related Google tags may set or read cookies and similar technologies (or use local storage / similar mechanisms) to measure visits and page views on the Services. These technologies are used for analytics, not to provide your core gameplay session. Google’s collection and use of information is described in Google’s privacy policy and partner-site disclosures.
Advertising cookies and similar technologies: Google AdSense and related partners may set or read cookies and use similar technologies on your device to serve ads, limit how often you see an ad, measure ad performance, and (where allowed) personalize ads based on your activity on this site and/or across other sites and apps that participate in those partners’ networks.
Consent in the EEA, UK, and Switzerland: Where required by law, we may present a Google-certified consent management message that lets you consent, refuse, or manage options for non-essential advertising and/or analytics technologies. Until you provide required consent in those regions, we configure Google tags so that non-essential advertising and analytics storage remain restricted. Outside those regions, analytics measurement may operate under this Policy without a separate consent banner, subject to applicable law.
You may block or delete cookies through your browser settings. Clearing our first-party session cookie or local storage will sign you out of the account session in that browser (or reset guest reconnect data). Blocking advertising or analytics cookies may reduce personalization or measurement, but core gameplay may continue and ads may still appear in a non-personalized form where permitted.
We may use Cloudflare Turnstile for bot protection on the contact form.
5. Data Retention
- Temporary game records: deleted after a short period (typically ~30 minutes).
- Ratings and account data: kept while the account is active.
- Session cookie: remains until it expires, you sign out, you delete your account, or you clear site cookies.
- Local storage: remains on your device until you clear it.
- Contact messages: retained only as long as needed to respond.
- Google Analytics and advertising data: retained by Google under Google’s retention settings and policies for those products.
6. Security
We implement reasonable administrative, technical, and physical safeguards consistent with industry standards and New York’s SHIELD Act. This includes encryption in transit (HTTPS), hashed passwords, HttpOnly session cookies for signed-in browsers, and access controls. However, no system is 100% secure. You are responsible for keeping your password confidential and for activity on your account.
7. Third-Party Service Providers
- Hosting: Render + PostgreSQL
- Bot protection: Cloudflare
- Fonts: Google Fonts / Adobe Fonts
- Email delivery: SMTP provider
- Site analytics: Google Analytics 4
- Advertising: Google AdSense (and related Google advertising / measurement services)
All providers are contractually obligated to protect your data, or process data under their own published policies where they act as independent controllers (for example, Google for Analytics and advertising).
8. Children’s Privacy
Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will take steps to delete it.
9. Your Rights & Choices
- Local data: Clear site data in your browser at any time.
- Signed-in session: Use Sign Out in Account to end your session in that browser (clears our session cookie). Clearing site cookies has a similar effect for the first-party session cookie.
- Account data: When signed in, use Delete Account in Account, or contact us to request deletion or correction. You may also update username, email (with confirmation), and password from Account where available.
- Analytics & ads: Use browser controls to block third-party cookies; where shown, use our consent message to manage or refuse non-essential cookies in the EEA, UK, or Switzerland; and use Google’s ad settings tools where available. Clearing site data removes our local storage items and first-party session cookie but may not remove third-party cookies set by Google or other partners on their domains.
- Residents of certain states (including California) may have additional rights to access, delete, or opt out of the sale/sharing of personal information. We respond to verifiable requests promptly.
10. International Users
Your data is processed in the United States (and may be processed by Google and other providers in the United States and other countries where they operate). By using the Services, you acknowledge these transfers. Where required (including in the EEA, UK, and Switzerland), we rely on consent and/or other lawful bases and consent tooling described in Section 4 for non-essential cookies and similar technologies.
11. Changes to This Policy
We will post the revised Policy with an updated “Last updated” date.
For privacy questions, data requests, or concerns, please use our contact form on the website: https://goarena.games