Cado Privacy Policy

Last updated: 10 August 2026

Cado is a competitive word game operated by Tom Gleeson (Australia). This policy describes exactly what data the game holds and what happens to it. The short version: Cado collects the minimum it can, shares nothing, and shows no ads.

What we collect

• Username. Chosen by you at sign-up. It is the only identifier Cado holds — no email address, phone number, or real name is requested or stored.
• Passphrase. Stored only as a salted cryptographic hash. We cannot read it, and there is no password-reset flow that would ever email it anywhere.
• Gameplay records. Match results, scores, ratings, season standings, practice runs, and the input logs of ranked matches (used server-side to verify that submitted scores are genuine).
• Presence. A "last seen" timestamp while the app is open, so other players can see who is online.
• Feedback. If you use Send Feedback, the message text is stored with your username so we can follow up on bug reports.
• Transient technical data. IP addresses are used in server memory for rate limiting and appear in short-lived infrastructure logs. They are not stored in the game's database or linked to your account.

What we do with it

Run the game: matchmaking, leaderboards, season history, cheat prevention, and responding to feedback. Nothing else.

What we don't do

• No advertising, and no data is sold or shared with third parties for any purpose.
• No analytics or tracking SDKs — the app contains no third-party code that watches what you do.
• No tracking across other apps or websites.

Where it lives

Data is stored in a managed database and application host (Render) which processes it on our behalf as infrastructure. Traffic between the app and the server is encrypted with TLS.

Deleting your account

You can delete your account at any time from inside the app (menu → Delete Account) or on the website. Deletion is immediate and permanent: your username is removed from the leaderboard, records, matchmaking, and feedback, sign-in becomes impossible, and your identity is scrubbed from stored data. Finished matches remain in your opponents' histories in anonymised form (shown as "deleted-…"), because their results depend on those games having happened.

Children

Cado does not knowingly collect personal information from children. The only personal data it holds is a self-chosen username; players should not use their real name as a username if they prefer not to be identifiable.

Changes and contact

If this policy changes, the date above changes with it. Questions or requests: tagleeson@gmail.com.