Last updated: 2026-08-25
StillDeck (“we”, “us”, “our”) is a free online Klondike solitaire game operated by MN Media s.r.o. This policy explains what data we collect, why, and what choices you have.
We keep things simple: gameplay and settings are stored locally by default, optional measurement and advertising follow your privacy choices, and we never sell personal data.
What we collect and why
Without an account (default)
Your entire game — cards, moves, score, settings, and statistics — is stored locally in your browser using localStorage. The site may still contact Google for consent management and, subject to your choices in Google Privacy & Messaging and applicable law, Google AdSense may show up to three static display ads to the right of the game, only on sufficiently wide desktop game layouts. No display ad is shown during active play on phones or tablets. We assign a pseudonymous device identifier (a random UUID stored in localStorage) solely so that if you later create an account, we can merge your local stats with the server copy without duplicating them.
With an optional account
If you choose to sign in (email magic-link, no password), we additionally store:
- Your email address — to authenticate you and send the sign-in link.
- Game results (win/loss, time, moves, score per game) — to sync statistics across your devices.
- Settings JSON (theme, draw mode, accessibility preferences) — to sync preferences.
- Device identifier — linked to your account to prevent duplicate stat merges.
After analytics consent
If you accept analytics cookies, Google Analytics 4 collects:
- Truncated IP address (last octet zeroed by GA4 default).
- User-agent string, screen resolution, browser language.
- Pages visited, feature-usage events (e.g. “started game”, “changed theme”).
After session replay consent
If you accept session replay, Microsoft Clarity collects:
- Anonymized IP address.
- Clicks, scrolls, and cursor movements.
- Page content snapshots with sensitive input fields masked.
Advertising and consent management
Google Privacy & Messaging manages advertising choices. Subject to those choices and applicable law, Google AdSense may show up to three static display ads to the right of the game, only on sufficiently wide desktop game layouts. No display ad is shown during active play on phones or tablets. Google may process:
- IP address, user-agent string, device information, and browser language.
- Consent signals and advertising identifiers or cookies where permitted.
- Ad delivery, interaction, frequency-control, measurement, and fraud-prevention data.
Legal bases for processing
Under the GDPR we rely on the following legal bases:
- Consent — Art. 6(1)(a) — Analytics (GA4), session replay (Microsoft Clarity), and advertising storage or personalization where required. You can withdraw consent at any time through the Google privacy message in the footer or Settings panel.
- Performance of a contract — Art. 6(1)(b) — Storing your game state, settings, and statistics locally; account creation and cross-device sync when you choose to sign in.
- Legitimate interest — Art. 6(1)(f) — Security logging, fraud prevention, and maintaining service reliability. We balance our interest against your rights by minimizing the data collected and retaining it only as long as necessary.
Sub-processors
We share data with the following third-party processors:
| Name | Purpose | Location | Transfer basis | DPA / Privacy |
|---|---|---|---|---|
| Supabase, Inc. | Account storage: email, game results, settings | EU (Ireland, AWS eu-west-1) | No cross-border transfer (EU-only) | DPA / Privacy |
| Google LLC (Google Analytics 4) | Aggregate traffic measurement and feature usage | United States | EU Standard Contractual Clauses (2021/914) | DPA / Privacy |
| Microsoft Corporation (Microsoft Clarity) | Session replay and heatmaps — complementary coverage including short-duration sessions | United States | EU Standard Contractual Clauses (2021/914) | DPA / Privacy |
| Google LLC (Google AdSense) | Consent management and up to three static right-side display ads on sufficiently wide desktop game layouts; no active-play display ads on mobile or tablet | United States | EU Standard Contractual Clauses (2021/914) | DPA / Privacy |
Cookies and local storage
StillDeck uses localStorage for essential game data. Google and Microsoft may use cookies or local storage for analytics, session replay, consent management, and advertising according to your privacy choices.
Users in the EEA, UK, and Switzerland choose through Google’s privacy message. Elsewhere, these tools operate according to applicable law and product settings. You can review your choices at any time via Settings → Privacy & data.
| Name | Provider | Purpose | Expiry | Category |
|---|---|---|---|---|
solitaire:game:v1 / stilldeck:game:freecell:v1 / stilldeck:game:spider:v1 | StillDeck (localStorage) | Saves your in-progress Klondike, FreeCell, and Spider games, including guest/account attribution for the active attempt | Persistent | Essential |
solitaire:settings:v1–v4 / solitaire:settings:v4:field:* / solitaire:settings:v4:recentDeal:item:* / solitaire:settings:v4:recentDeal:owner:* / solitaire:settings:v4:recentDeal:guest-current:v1 | StillDeck (localStorage) | Remembers game, appearance, sound, and accessibility settings; field and owner-isolated recent-deal entries prevent concurrent tabs or account switches from overwriting preferences and no-repeat history, while older versions remain for safe migration | Persistent | Essential |
solitaire:stats:v1–v3 / solitaire:results:v1 / solitaire:results:v1:item:* / solitaire:results:v1:owner:* / solitaire:results:v1:guest-migrated:v2 / solitaire:recordedWins:v1 / solitaire:recordedWins:v1:owner:* / stilldeck:consecutiveLosses:v1 | StillDeck (localStorage) | Stores guest and account-isolated local game-result journals, statistics, terminal-outcome claims, and streaks; the migration marker prevents a former account snapshot from becoming guest history | Persistent | Essential |
solitaire:sync:v1 / solitaire:sync:v1:results / solitaire:sync:v1:results:user:* / solitaire:sync:v1:results:epoch:* / solitaire:sync:v1:settings / solitaire:sync:v1:settings:user:* / solitaire:sync:v1:settings:dirty:* | StillDeck (localStorage) | Tracks per-account result/settings cursors, result-reset generations, and owner-bound pending offline setting values without letting concurrent syncs or account switches overwrite each other | Persistent | Essential |
solitaire:timer:v1–v2 | StillDeck (localStorage) | Restores active-game timers; v2 keeps a bounded per-game journal and v1 is read only for migration | Persistent | Essential |
solitaire:device:v1 | StillDeck (localStorage) | Pseudonymous device ID for stats merge | Persistent | Essential |
solitaire:installPrompt:v1 / stilldeck:firstGame:v1 | StillDeck (localStorage) | Remembers install-prompt state and whether the first game has been used | Persistent | Essential |
stilldeck:last-locale:v1 | StillDeck (localStorage) | Remembers preferred language | Persistent | Essential |
stilldeck:consent:v1 | StillDeck (localStorage) | Remembers legacy privacy choices while migrating them to the current preference | Until migration or browser storage is cleared | Essential |
stilldeck:measurementOptOut:v1 | StillDeck (localStorage) | Remembers an analytics and session-replay opt-out where Google’s European message does not apply | Until you change the preference or clear browser storage | Essential |
stilldeck-precache-* / stilldeck-runtime-* | StillDeck (CacheStorage) | Caches the game shell, localized shortcuts, selected card art, sounds, and route assets for offline play | Until replaced by a newer release or browser storage is cleared | Essential |
sb-*-auth-token | Supabase (cookie/localStorage) | Keeps you signed in | Until sign-out or 30 days | Essential |
_ga | Google Analytics | Distinguishes unique visitors | 2 years | Analytics |
_ga_QZR4D0GWW5 | Google Analytics | Maintains GA4 session state | 2 years | Analytics |
_clck | Microsoft Clarity | Persists the Clarity user ID across sessions | 1 year | Session replay |
_clsk | Microsoft Clarity | Connects multiple page views within a single Clarity session | 1 day | Session replay |
FCCDCF / FCNEC | Google Privacy & Messaging | Stores advertising consent and privacy choices | Up to 13 months | Advertising |
__gads / __gpi / __eoi | Google AdSense | Ad delivery, frequency controls, measurement, and fraud prevention where permitted | Up to 13 months | Advertising |
IDE / test_cookie | Google advertising services | Ad delivery and browser capability checks where permitted | Up to 13 months / 15 minutes | Advertising |
International transfers
Essential account data stays within the EU (Supabase, AWS eu-west-1). Google Analytics, Microsoft Clarity, Google Privacy & Messaging, and Google AdSense data may be transferred to the United States under the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914). Declining the relevant choices limits non-essential transfers, although consent, security, and fraud-prevention data may still be processed where necessary.
How long we keep your data
We retain data only as long as necessary for the purposes described above.
- Account email: Retained for the life of your account. Deleted within 30 days of account deletion.
- Game results (server): Retained for the life of your account. Deleted together with your account.
- Settings (server): Retained for the life of your account. Deleted together with your account.
- Device identifier: Tied to account lifetime. Stored locally until you clear browser storage.
- Google Analytics: Google Analytics default retention: 14 months for user-level data.
- Session recordings: Session recordings retained up to 13 months by Microsoft Clarity, then auto-deleted.
- Advertising and consent data: Google retains advertising and consent data according to its product settings and applicable legal requirements.
- Local storage (browser): Retained until you clear your browser storage.
Your rights
Under the GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate personal data.
- Erasure — request deletion of your data (“right to be forgotten”).
- Restriction — ask us to limit how we process your data.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interest.
You also have the right to lodge a complaint with your local data protection authority. For users in Czechia, this is the Office for Personal Data Protection (ÚOOU).
Withdrawing consent
In the EEA, UK, and Switzerland, Google’s privacy message lets you change or withdraw applicable consent choices. Outside the message’s scope, the same footer or Settings control opens StillDeck’s on-device opt-out for analytics and session replay; this local control does not manage advertising. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
Children’s privacy
StillDeck is a general-audience card game. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated through a refreshed Google privacy message or another prominent notice. The “Last updated” date at the top of this page always reflects the latest revision.
Contact us
If you have questions about this policy or want to exercise your rights, email us at hello@mnmedia.io. We aim to respond within 30 days.
Data controller
The data controller for StillDeck is:
MN Media s.r.o.
Varšavská 715/36, Vinohrady, 120 00 Praha 2, Czechia
hello@mnmedia.io