Privacy Policy

Last Updated: September 21, 2026

Atlas Lion Games ("Atlas Lion Games", "we", "our" or "us") respects the privacy of the visitors to our website and the players of our game Ronda (accessible at https://playronda.ma and our official corporate website https://atlasliongames.com), and we are committed to protecting it through our compliance with this Privacy Policy.

We adhere strictly to the principle of data minimization. You can play Ronda completely without registering an account, providing an email address, or submitting real-world identity credentials. We only collect the minimal technical and gameplay information necessary to deliver the game experience, preserve your progression, operate real-time multiplayer lobbies, and ensure infrastructure stability.

To go directly to the section of the Privacy Policy of interest, please click on the section below:

1. Introduction and Scope

   This Privacy Policy explains how Atlas Lion Games handles technical data, gameplay metrics, and user preferences across our web services.

   Our data processing complies with:

   • General Data Protection Regulation (GDPR - EU 2016/679)
   • Moroccan Law No. 09-08 on the protection of individuals regarding the processing of personal data (supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel – CNDP)
   • Applicable electronic privacy regulations (including European ePrivacy / Cookie Directives).

2. Data Controller

   The data controller responsible for the processing of data on this website and in Ronda is:

   Atlas Lion Games

   Bureau 46, Diar Alamal Dar Bouazza

   Casablanca, Morocco

   Email: contact@atlasliongames.com

   Tel.: +212 663 573 934

   Websites: https://atlasliongames.com  |  https://playronda.ma

3. Categories of Data We Collect and Why

   We adhere strictly to the principle of data minimization. You do not need to register, provide an email, or submit passwords to play. Here is what is processed:

   A. Player Identity and Profile Data

   • Pseudonymous Player ID: On first launch, a random string identifier (e.g., usr_xxxx_xxxx) is generated and stored locally in your browser.
   • Display Name and Discriminator: If you set a custom player handle, it is saved with a random 4-digit discriminator (e.g., Atlas#1234). Guests receive an automated label (e.g., Guest#5678). All handles are run through an automated profanity filter.
   • Account Transfer Codes: If you choose to sync your game state across devices, the backend generates an ephemeral 6-digit sync code (RND-XXXXXX) that expires and is permanently deleted after 15 minutes.

   Legal Basis: Art. 6(1)(b) GDPR (service delivery) and Art. 6(1)(f) GDPR (legitimate interest in preventing handle spoofing and abuse).

   B. Gameplay Progression and In-Game Economy

   • Score & Leaderboards: Total accumulated points (total_points), win/loss statistics (solo bot matches vs. El Haj and multiplayer games), and leaderboard rankings.
   • In-Game Customization: Virtual coin balances (coins), unlocked cosmetic items (such as Zellij table felts and card backs), equipped items, and milestone timestamps.
   • Challenge Progress: Daily and weekly challenges completed along with active cooldown timers.

   Legal Basis: Art. 6(1)(b) GDPR (providing core gameplay progression).

   C. In-Game Telemetry (analytics_events)

   When you start or complete a match, limited telemetry is sent to our backend:

   • Match Identifiers: Session ID (matchID) and game mode (singleplayer vs. bot, 1v1, or challenge).
   • Match Metrics: Round duration in seconds, final card scores, rematch status, and challenge outcome flags.
   • Technical Context: UI language (ar, fr, or en) and broad device category (Desktop, Android, iOS) derived from your browser's standard User-Agent.

   We use this solely to balance game rules, diagnose bugs, and check server capacity. We do not construct personal behavioral profiles or perform cross-site tracking.

   Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in technical stability and game balance).

   D. Real-Time Multiplayer Networking

   Multiplayer lobbies and live matches run via WebSockets through our boardgame.io framework.

   • The server processes your room ID, seat number (playerID), handle, card moves, and connection status in volatile server memory.
   • Your IP address is processed dynamically by the network stack to maintain the WebSocket connection.

   Legal Basis: Art. 6(1)(b) GDPR (necessary for real-time multiplayer).

   E. Server Logs

   When accessing our websites or game backend, hosting providers (Cloudflare and Railway) automatically record standard access logs (IP address, browser type, request path, timestamp, HTTP status code).

   These logs are used strictly for network security, defending against DDoS attacks, and debugging crashes. They are rotated and purged automatically.

   Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in server security and availability).

4. Local Storage and Client-Side Data

   We do not use tracking cookies or marketing cookies.

   Instead, we use browser Web Storage (localStorage) to keep your game state directly on your own device. Here is the complete list of keys used:

   Key	Type	Purpose
   ronda_player_id	localStorage	Unique pseudonymous player key generated on first launch.
   ronda_player_profile	localStorage	Current display handle, discriminator, and guest status.
   ronda_challenge_progress	localStorage	Completed challenges and cooldown timers.
   ronda_store_coins	localStorage	Virtual coin balance for cosmetic customizations.
   ronda_cached_rank	localStorage	Cached leaderboard rank for instant rendering.
   ronda_lang	localStorage	Selected interface language (en, fr, or ar).
   ronda_muted / ronda_volume	localStorage	Sound effects and background audio volume preferences.

   These items are strictly functional and technically necessary (under Art. 5(3) of the European ePrivacy Directive). They allow the game to save your progress without requiring traditional passwords, intrusive accounts, or third-party cookies.

5. Monetization and Payments

   A. Ad-Free Experience

   Ronda is completely ad-free. We do not display third-party ads and do not embed ad-tracking networks or tracking pixels.

   B. Optional Supporter Purchases (Stripe)

   Players can optionally support Ronda's development by purchasing an in-game "Supporter" badge.

   • Payment Processor: All transactions are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland) or Stripe, Inc. (San Francisco, USA).
   • No Financial Data on Our Servers: Atlas Lion Games never collects, receives, or stores credit card numbers or bank account details. All payment data is entered directly into Stripe's encrypted interface.
   • Webhook Processing: When a payment succeeds, Stripe notifies our backend via an encrypted webhook (/api/stripe/webhook) with your pseudonymous playerId and transaction ID to set is_supporter = true.

   For details on Stripe's data handling, see the Stripe Privacy Policy.

   Legal Basis: Art. 6(1)(b) GDPR (contractual fulfillment of your virtual purchase).

6. External Third-Party Services and Hosting

   A. Self-Hosted Fonts

   In Ronda, all typefaces (Cairo and Cinzel) are self-hosted and bundled directly with the application. The game does not make any requests to Google Fonts servers, so your IP address is never sent to third-party font CDNs.

   B. Hosting, CDN, and Security (Cloudflare)

   Our corporate website https://atlasliongames.com is hosted on Cloudflare Pages and served via the global edge network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA).

   • Cloudflare acts as a reverse proxy, caching static assets, providing SSL/TLS 1.3 encryption, and defending against DDoS attacks and automated bots.
   • Connection metadata (IP address, requested resource, HTTP status) is processed temporarily by Cloudflare edge servers to route requests securely.

   Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in security and reliable website delivery).

   C. Cloudflare Web Analytics (Cookie-Free)

   We use Cloudflare Web Analytics on https://atlasliongames.com to monitor aggregate site traffic.

   • It does not use cookies, local storage, or fingerprinting.
   • It does not track you across other websites or build personal profiles.
   • Metrics (page views, referrer, country, browser) are strictly aggregated and anonymous. Complete IP addresses are never stored.

   Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in understanding site traffic).

   D. Game Backend and Database (Railway)

   Our game servers, WebSocket lobby, and managed PostgreSQL databases for https://playronda.ma are hosted on Railway Corp. (548 Market St, PMB 57274, San Francisco, CA 94104, USA).

   All traffic between client, API, and database is encrypted via TLS/HTTPS. Standard Contractual Clauses (SCCs) are in place.

   Legal Basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

7. Data Retention and Deletion

   We keep data only as long as needed:

   • Inactive Guest Accounts: Guest accounts (is_guest = true) with 0 points that have been inactive for more than 30 consecutive days are automatically deleted by a daily database cleanup job (cleanupInactiveGuests).
   • Sync Transfer Codes: Ephemeral codes expire and are purged after 15 minutes.
   • Active Players: Profiles with custom usernames or accumulated scores are kept until you request account deletion.
   • Match Telemetry: Match events are periodically aggregated and raw records pruned.

8. International Data Transfers

   Infrastructure providers (Cloudflare, Railway, Stripe) process data on servers in the United States or globally.

   Transfers outside the EEA or Morocco rely on European Commission approved Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF), supported by transport encryption (TLS 1.3).

9. Your Rights Under GDPR and Moroccan Law 09-08

   Under GDPR (Articles 15–22) and Moroccan Law No. 09-08 (Articles 7–10), you have the right to:

   • Access: Request confirmation and a copy of your stored data (stats, profile).
   • Rectification: Request correction of inaccurate information (e.g., display handle).
   • Erasure ("Right to be Forgotten"): Request full deletion of your player profile, scores, and database records.
   • Restriction: Request temporary restriction of data processing.
   • Data Portability: Receive your data in a structured, machine-readable format.
   • Objection: Object to processing based on legitimate interests (Art. 6(1)(f) GDPR).

   Right to Lodge a Complaint

   You may lodge a complaint with a supervisory authority:

   • Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) – www.cndp.ma
   • European Union: The data protection authority in your EU Member State.

   How to Exercise Your Rights:

   To request deletion of your account or an export of your data, send an email to:

   contact@atlasliongames.com

   Please include your Player ID (found in your in-game profile/settings) so we can locate your record in our database, since we do not store emails or real names.

10. Protection of Minors

    Ronda is built for general audiences. We do not knowingly collect personal data from children under 16. Display handles are sanitized by an automated profanity filter. If you believe a minor provided personal data to us, contact us at contact@atlasliongames.com and we will delete the data immediately.

11. Changes to this Privacy Policy

    We may update this policy as features or infrastructure change. The "Last Updated" date at the top reflects the latest revision.

12. Contact Information

    Atlas Lion Games

    Bureau 46, Diar Alamal Dar Bouazza

    Casablanca, Morocco

    Email: contact@atlasliongames.com

    Tel.: +212 663 573 934

    Website: https://atlasliongames.com

    Game: https://playronda.ma