Privacy Policy

About the game and this policy

The Fight Chain is a daily MMA puzzle. Connect two fighters through a chain of official UFC bouts, using as few connecting fighters as possible. This policy explains the information handled by the game and its sign-in and hosting services.

The Fight Chain is operated by Dan Patterson, who is responsible for the personal information described in this policy. For privacy enquiries, contact support@thefightchain.com.

Google sign-in and Google account information

Google sign-in is optional. It lets you return to the same account on other devices, keep account-linked gameplay and statistics, and, after choosing a display name, appear on eligible leaderboards and create friend challenges. Linking Google to your current guest account keeps that account’s history. Signing in to a different existing account does not merge guest history.

When you choose Google sign-in, Google shares basic sign-in information with Supabase Auth: a Google account identifier, email address and its verification status, and basic profile information such as your name and profile picture, where provided. Supabase creates or links an authentication identity and returns a user and session to the game’s server.

The Google integration is used for authentication and account linking. The game does not request access to Gmail messages, Google Drive files or Google contacts, and does not call those services. The application does not save Google API access or refresh tokens for later use.

The game stores account and authentication identifiers, account type and status, linked sign-in providers, your game display name and account timestamps. Supabase Auth separately handles your Google identity, email and basic profile information. Your Google email address, name and picture are not copied into the game’s account record or automatically used as your public game profile.

Guest accounts, progress and friend challenges

Opening the public puzzle does not create an anonymous account. When you first interact with fighter search, the game prepares a Supabase anonymous account if needed. A valid existing session is reused. Anonymous accounts have an authentication identifier and a generated game display name without requiring an email address. They are still server accounts, not anonymous to the service.

Official gameplay records can include the puzzle definition, selected fighters and chain, game date, start/completion timestamps, attempt status, wrong guesses, undos, lives, scores and validation events. These records support restored progress, statistics and rankings. Older browser-history snapshots may be stored separately as unverified history and do not become official results.

Friend challenges store a creator account and display-name snapshot, fighter endpoints, invitation token and timestamps. Attempts store participants’ progress and results. People who receive a challenge link can see the challenge and its shared results; share links only with intended recipients.

If account services are intentionally disabled in an environment, browser-only progress can be stored locally. An official-account error is not silently converted to browser-only play. Emailing support also shares your email address and the information you include with the support mailbox; never send passwords, one-time codes, cookies or tokens.

Public profiles and leaderboards

Eligible public daily, weekly and monthly leaderboards display your chosen game display name, rank and relevant game results or aggregate performance. Anonymous accounts and accounts without a chosen display name are not eligible. Your Google email address, Google profile photo, authentication identifiers and session tokens are not included in the public leaderboard response. Choose a game name you are comfortable making public.

Cookies, browser storage and verification

Sign-in cookies hold Supabase session tokens and information needed to keep your browser associated with its account. In Production these cookies use HTTPS and HttpOnly protection, which prevents application scripts from reading them. They are set with a maximum lifetime of 30 days; provider tokens can expire earlier and sessions may be refreshed. A separate sign-in cookie lasts up to 10 minutes and connects a Google sign-in to the browser where it began. A guest-proof cookie may identify older guest progress.

Your browser stores theme and How to Play preferences and, where applicable, local puzzle progress. Some pages also keep temporary tab state. Clearing site data removes local preferences and progress and may end access to an unlinked guest account; it does not delete server records. Account sign-in tokens are kept in HttpOnly cookies rather than application local storage.

Where configured, Cloudflare Turnstile is loaded inline when new guest-account verification begins. Cloudflare receives network, browser and device signals to assess automated abuse, and its widget may use browser storage under Cloudflare’s policies. The verification token goes through the game’s API to Supabase, which verifies it. New guest-account creation remains blocked if required verification fails. Public information and How to Play do not require successful verification.

Purposes, service providers and sharing

Information is used to authenticate and link accounts, restore gameplay, calculate statistics and rankings, operate friend challenges, answer support/privacy requests and protect the service against abuse. Replit hosts the game and API. Supabase provides authentication; the application keeps account and game records in its configured PostgreSQL database. Cloudflare provides Turnstile where enabled. Google provides optional sign-in and remotely loaded Google Fonts; font requests can disclose your IP address and browser/device request information even if you do not sign in.

The application currently has no advertising or analytics integration. The public name and score disclosures above are separate from information processed by these service providers. Service providers may process information outside your country. Contact us if you have questions about how providers handle your information.

Storage and security

We use server-side account checks to restrict access to account records, HTTPS session cookies in Production and verified encrypted connections to the account database. Requests that change account information are checked to prevent cross-site writes. Application logs record request identifiers, methods, page paths without query strings, response status and errors; cookie and authorization headers are redacted. Connection information is temporarily used to limit repeated requests. Hosting and authentication providers may keep their own technical and security logs. These measures reduce risk but cannot guarantee complete protection.

Retention and account deletion

Account-linked official history is retained with the account until it is deleted. Anonymous accounts and friend challenges do not currently expire automatically. Google sign-in flow records become unusable after 10 minutes but are not automatically erased when they expire. Support messages, operational logs and any provider backups are kept separately under the arrangements for those services; no fixed retention period or immediate removal from backups is promised here.

Request deletion through support@thefightchain.com. We need to verify ownership using an existing signed-in account session; email addresses or display names alone do not establish ownership. Keep access to your original browser if you play with an unlinked guest account. If that session is lost, we may be unable to verify ownership. See Account deletion for help. Deletion is handled manually, not automatically when an email is received.

If a verified request can be processed, the account is disabled during deletion. Deletion removes the game account, linked gameplay history, linked sign-in flow records and Supabase authentication identity. It also deletes challenges you created and their attempts, and removes your participation in other people’s challenges without deleting those challenges. A record of the request reference, status and timestamps remains after account identity fields are removed. We do not guarantee a completion date. Provider logs, backups, support correspondence and copies already shared with other people are separate from this account-deletion process.

Revoking Google access and privacy requests

You can review or remove The Fight Chain’s connection in your Google Account’s third-party connections settings. Revoking Google access does not itself delete game history, the Supabase identity or existing game-session cookies. Sign out to clear the game session and contact support separately to request verified account deletion. Clearing browser storage also does not delete a server account.

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to processing or obtain a copy of your information, or withdraw consent where consent applies. You may also contact the privacy authority with jurisdiction over you. Contact support@thefightchain.com about a request; rights and any legal exceptions vary by location.