Privacy Policy

Pogomon’s data controller is Anton Ponochovnyi, private individual, Ukraine. Data protection contact: support@pogomon.com. This policy covers pogomon.com and its user accounts.

We process your email, nickname, account creation date and email verification status. Password sign-in stores a password hash, not a plain-text password. Date of birth and gender are optional and may be left blank.

Google sign-in provides an account identifier, email and identity verification through a Google ID token. We do not request access to players’ Gmail messages, contacts or Google Drive.

Entered player nicknames, game settings, selected themes, turns and results are stored on the server. Local participants do not need their own accounts. Avoid unnecessary personal data about other people. We do not record voices, video or conversations.

For security, we process sessions, hashes and expiry times of service tokens, sign-in attempt limits, document versions and acceptance times. The server may also process IP addresses, request times and technical errors to operate the network and prevent abuse.

When you contact support, we process the sender’s address and correspondence. Do not send passwords, full card numbers or identity documents without an agreed need.

Data is needed to create accounts, sign in, save games, fulfil requests and protect the service. Depending on the purpose, the legal basis is providing the requested service, compliance with law, consent or a legitimate security interest balanced against your rights.

Optional information is supplied voluntarily. Where a feature needs consent, we request it before using the data. We do not sell personal data or send advertising merely because you register.

Sign-in uses a secure HttpOnly session cookie: page JavaScript cannot read it, and production transmission uses HTTPS. A refresh session currently lasts up to 30 days unless you sign out earlier or it is revoked.

At this version date, no advertising trackers or third-party marketing analytics are connected. Google Identity Services loads for Google sign-in; some fonts may load from Google Fonts. Google receives technical connection data under its own policy. Blocking cookies or external resources may affect sign-in or page appearance.

Pogomon infrastructure is hosted by DigitalOcean in the Netherlands. Google Workspace/Gmail API handles service emails and support; Google Identity Services handles sign-in. Google and other providers may process necessary data in other countries under their terms.

Access is limited to what each function needs. Data may be disclosed in response to a lawful request from a competent authority or to protect rights where the law permits. International transfers use the bases and safeguards required by applicable law.

When payments open, Paddle will process buyer data as an independent Merchant of Record under its own policy. Pogomon will receive order identifiers and statuses to provide access, but will not store full card details. Checkout is unavailable at this version date.

Account and game data is retained while the account is used and the data is needed for the service. Contact support for deletion. Some records may be retained longer to comply with law or resolve a substantiated dispute.

Expired authentication links and temporary records are regularly removed. Protected backups support recovery from failures, not routine access to deleted accounts. Deletion from the active database does not instantly remove data from every backup; backup data is removed through the backup rotation cycle.

We use HTTPS, password hashing, restricted permissions and separated service secrets. No online service can guarantee freedom from all risks. We notify users of incidents in the cases and within the periods required by applicable law.

Write to support@pogomon.com for information about your data, a copy, correction or deletion, to object to processing or withdraw consent where consent is the basis. Applicable law defines the extent of rights and exceptions. Withdrawal does not affect the lawfulness of earlier processing.

Use your account email and describe the request. To prevent third-party requests, we may check account ownership without asking for a password. You may also contact a competent data protection authority, including the Ukrainian Parliament Commissioner for Human Rights, or a court.

We will notify you of material changes to processing purposes or terms through the service or email. Where separate consent is needed, we will request it before that processing. The current version date is shown on this page.