Who we are
Roundz (roundz.gg) is a live player-versus-player arena game operated by the Roundz team (“Roundz”, “we”). Players stake credits, eating another player takes their stake, and winnings can be cashed out. Contact: support@roundz.gg.
Roundz has two fully separated worlds: a Demo realm (free play-money credits — never money) and a Real realm (wallet or recovery-phrase accounts playing for USDC-pegged credits, where real-money features are enabled). There is no conversion between them.
What we collect
We collect only what the game needs to run. Specifically:
- Account identifier. For wallet accounts, your Solana public key is your account ID. For demo (word-code) accounts and real-money recovery-phrase accounts, we store only a SHA-256 hash of your code or phrase — the raw words are never stored, which is also why they cannot be recovered if lost.
- Nickname. Your chosen name (3–16 characters, unique). It is visible to other players in-game, in the kill feed, in chat, and on leaderboards.
- Gameplay stats and match history. Your balance (demo credits or real-realm credits, per your account's realm), and per-match records: stake, peak size, result, and payout. These drive your lifetime stats and profile. Demo and real records never mix on leaderboards.
- Referral relationships. If you joined through a referral link, we record who referred you. This is set once at account creation and is permanent. We also record referral earnings (the program pays referrers 30% of house revenue generated by their invitees). Your invite link carries an opaque 10-character code, not your account ID or wallet address.
- IP address. We store the IP of your most recent login. It is used for abuse review and referral anti-collusion (if a referrer and invitee share an IP, the revenue share is withheld). The admin panel additionally rate-limits and logs login attempts by IP. We do not sell IP data, use it for advertising, or share it with anyone. Bans are enforced by device fingerprint, not IP.
- Device fingerprint. A random ID stored in your browser, combined with a hash of your browser/device characteristics (user agent, language, platform, screen, timezone). Its only purposes are stopping banned devices from creating new accounts and referral anti-collusion — it is not used for tracking or profiling.
- Chat messages. Chat is not stored in our database. Messages live in server memory only: a rolling log of at most 30 recent messages, each expiring after 30 minutes, all wiped when the server restarts. Messages are auto-moderated as they arrive (profanity masking, link blocking, a 1-message-per-5-seconds limit). The only thing persisted is an anonymous daily count of messages sent.
- Operational fields. Account creation date, last login time, ban status, and — for real-realm accounts that deposit or withdraw — your personal deposit address, deposit/withdrawal amounts and transaction signatures mirrored from the blockchain, and the withdrawal destination addresses you provide. (The private keys of deposit addresses are never stored anywhere — they are re-derived from an operator master secret only at the moment funds are moved to reserve.)
- Aggregate counters. Anonymous daily totals (visits, logins, new accounts, games joined, chat messages). No per-user analytics rows exist.
In your browser — localStorage only, the game sets no cookies
| Item | What it is | Why |
|---|---|---|
roundz_resume |
Session token, 24-hour sliding expiry | Keeps you logged in |
roundz_fp |
Random device ID | Ban enforcement (see above) |
roundz_age_ok |
Your 18+ confirmation | So the age box stays ticked on this device |
roundz_gfx, roundz_audio, roundz_muted, roundz_scheme, roundz_durcache |
Graphics, sound and touch-control preferences; music-track length cache | Local settings only; never sent as tracking data |
roundz_last_tier, roundz_auto_restake |
Your last stake tier and the auto-restake toggle | In-game convenience — the re-enter shortcut |
roundz_pwa, roundz_pwa_visits |
Install-prompt state and a local visit count | So the “add to home screen” nudge never asks twice |
roundz_wc |
A flag that you signed in through WalletConnect | Ends the right wallet session on logout; cleared on logout |
roundz_dl, roundz_dl_pending |
Phantom mobile connection keys and session | Only if you connect Phantom via mobile deeplink; cleared on logout |
What we deliberately don't collect
- No email address, real name, phone number, or postal address — we have no field for any of them.
- No KYC or identity verification at this time. If legal requirements applicable to real-money play require it, this may change — we will update this policy first and tell you what changed.
- No passwords: wallet login is a cryptographic signature (identity only — never a transaction), and demo codes and recovery phrases are stored only as hashes.
- No advertising trackers and no third-party analytics — no Google Analytics, pixels, or session recording. Our only metrics are the anonymous daily counters above. One honest caveat: the WalletConnect/Reown wallet-connection library we bundle contacts its own telemetry endpoint when wallet features are active; see Section 4.
Third parties
- Railway hosts our servers and database; all stored data resides there.
- Solana RPC nodes (a network RPC provider): when you connect a wallet or deposit/withdraw, these nodes see your wallet address and transactions.
- Google Fonts: your browser fetches fonts from Google, which sees your IP address in that request.
- esm.sh (CDN): your browser loads open-source crypto libraries from it for wallet features.
- Phantom: if you use Phantom, its extension/app handles your keys and connection; on mobile, connection goes through phantom.app links.
- WalletConnect / Reown: if wallet features are enabled, your browser connects to WalletConnect relay and API servers, including a Reown telemetry endpoint we do not control. This is the only third party that may receive usage data.
We never sell data to anyone.
On-chain data is public and permanent
Anything you do on the Solana blockchain — your wallet address, deposits, withdrawals — is publicly visible to the entire world, forever, on infrastructure nobody (including us) can edit or erase.
If you want distance between your identity and your play, use a dedicated wallet — or a recovery-phrase account, which has no chain wallet of its own.
Privacy controls
- Hide from leaderboard: removes you from all public boards; your public profile then shows only your name and join date.
- Hide P&L (on by default): your money results are hidden from public profiles and earnings boards unless you opt in. You always see your own numbers.
- Public profiles and leaderboards use an opaque generated handle, never your wallet address.
- Live game broadcasts never include balances — only your own connection receives your stake and balance.
Retention
Account records are kept while your account exists. Match, revenue, referral, and (for real-realm accounts) deposit/withdrawal records are kept for game-integrity and financial auditing. Chat vanishes within 30 minutes. Session tokens expire after 24 hours of inactivity. We have no automatic deletion schedule; deletion on request is described below — note that records of real-money transactions may be retained where required for accounting, audit, or legal reasons.
Security
What we do: demo codes and recovery phrases stored only as hashes; wallet login by signature so we never see your wallet's keys; deposit-address private keys are never stored (re-derived from a master secret only at sweep time, so a database leak yields public addresses only); withdrawals pass automated solvency and integrity checks before any payout leaves; one live session per account; all admin actions are logged with the acting admin's IP.
What we can't promise: perfect security — no one can. Deposit only what you are prepared to have at risk in a young product.
Your choices and rights
- Access: your profile shows most of your data; email us for a full copy.
- Deletion: we can delete your database record (nickname, stats, IP, fingerprint, referral links), keeping only anonymized accounting aggregates. Caveats: word-code and recovery-phrase accounts are pseudonymous, so we can only act for whoever holds the words; and on-chain data cannot be deleted by anyone.
- Correction/objection: if GDPR or similar law applies to you, contact us and we will honor applicable rights.
- You can clear localStorage at any time (this logs you out) and use the privacy toggles above.
Age and prohibited jurisdictions
Roundz is for adults 18 years or older (or the age of majority where you live, if higher). Roundz may not be used from any country or territory where skill-based play for stakes or crypto-asset gaming is prohibited or restricted by applicable law. This policy is governed by the laws of Saint Vincent and the Grenadines.
Changes
We will update this policy as the product evolves. Material changes will be announced in-game and the “Updated” date on this page changed.
Contact
Questions, access, or deletion requests: support@roundz.gg.
Last updated: 4 August 2026.