Privacy

Short version: we store as little as a game with a friend needs, and we do not sell anything about you.

Playing without an account

You can play without signing up. Your browser keeps a random player token so you return to your seat after a reload. Game rooms live on our servers for one day after the last move and are then deleted. We keep anonymous counts of rooms created, friends joined and games finished to see whether the game is working.

With an account

If you sign up we store your email address, a hashed password (never the password itself) or the identifier Google gives us, your game statistics and the badges you earn. Signing in with Google shares your email address and name with us; we ask for nothing else.

We send email to confirm your address, to reset your password, and once a week a short note about your place in the top and the game of the week. The weekly note is off with one click in the email or in your account. No other newsletters, ever.

Cookies and analytics

One cookie keeps you signed in. We also use Google Analytics to learn which games people enjoy and where they give up; it sets its own cookies and shows us anonymous, aggregated statistics. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics stays off until you allow it in the bar at the bottom of the page.

Advertising

The site is paid for by ads served by Google AdSense. Google and its partners may set cookies or read a device identifier to show ads, cap how often you see the same one and measure whether an ad worked. We ask Google not to personalise these ads: advertising storage is switched off by default for everyone, so what you see is based on the page you are on, not on a profile of you.

Google explains what it collects when you use sites that show its ads at policies.google.com/technologies/partner-sites. You can turn ad personalisation off across all sites at myadcenter.google.com. We never send Google your email address, your nickname or anything you type on the site.

Where it lives

Play XO runs on Cloudflare. Email is sent through Amazon Web Services. Both process data on our behalf only.

Your choices

You can delete your account, statistics and badges at any time from your account page. Questions: hello@playxo.com.

Last updated 6 September 2026.