Privacy policy
Last updated 10 August 2026
Open Mercy is a free browser card game. There is nothing to buy, so there is nothing to profile you for. This page says exactly what gets stored, what does not, and who else can see it.
On this page
The short version
You can play the entire game without giving a name, an email, or anything else. Press play and you get an anonymous account: a random id and a made-up handle. Nothing about you is attached to it.
If you decide to keep your stats, you create a real account, and then we hold an email address. That is the only personal detail the game asks for. Your data is never sold, and nothing is shared with anyone beyond the services listed below that are needed to run the game.
What gets stored
Guest play
A random account id and a generated display name like FeralWolf21. No email, no name, no contact details. This lives on our authentication provider so your stats survive a page refresh.
A real account
Your email address, and a password you choose. If you sign in with Google instead, Google tells us your email address and basic profile info, and nothing else: no contacts, no Drive, no Gmail. We never see your Google password.
Your profile
Display name, a share code for your public profile page, your equipped card back, and a country. The country is country-level only and comes from the header our CDN already attaches to every request. We do not run IP lookups and we do not store your IP address to get it.
Game results
Per-game statistics: whether you won, cards played, biggest draw stack you survived, how long the game took, how many opponents there were, and similar. This is what powers leaderboards, achievements and your profile.
Feedback you send
The message itself, an email address if you choose to add one, which page you sent it from, and your browser's user agent string. The email address is optional and only used to reply.
Shared kill cards
When you share a big stack as a link, the two player display names involved and the size of the stack are stored so the link can render for whoever opens it.
Kept in your browser, not on a server
Your daily challenge result, which opponents you have beaten, your sound and music preferences, and the code of a room you are currently in. These sit in your browser's local storage. Clearing your browser data removes them.
What never gets stored
Payment details
The game is free and has no purchases, so none are ever collected.
Your IP address
We keep no IP addresses in the game's database. Our hosting and CDN necessarily handle them to deliver the page and to block abuse, as any web host does, but the game itself neither reads nor records them.
Anything sold or brokered
Your data is not sold, rented, or handed to data brokers, and it is not used to build advertising profiles about you.
Voice chat audio
Voice in a game room is carried live by Cloudflare RealtimeKit and is never recorded, stored or transcribed. Joining is opt-in, only seated players can connect, and the microphone is off until you turn it on.
What other players can see
Some of this game is deliberately public, so it is worth being clear about which parts.
- Your display name and your country flag appear on leaderboards.
-
Your profile page at
/p/<code>shows your display name, country and statistics to anyone with the link. That link is only discoverable if you share it. - In multiplayer, the other players at the table see your display name.
- A kill card link you share shows the display names of both players involved to anyone who opens it.
Your email address is never shown to other players, on your profile, or on any leaderboard.
Who else is involved
Running the game means using a handful of services. Each one is here because something would not work without it.
- Supabase
- Database and sign-in. This is where accounts, profiles and game results live.
- Cloudflare
- Hosting, CDN and the multiplayer game servers. Handles the network requests that deliver the game.
- Cloudflare RealtimeKit
- Carries voice chat audio between players in a room, only if you join voice.
- Google Analytics
- Aggregate usage measurement: which screens get used, where people drop off.
- Google Ads
- A conversion tag that records that a visit from an ad led to someone playing.
- Google Sign-In
- Optional. Only used if you choose to sign in with Google.
- Google Fonts
- Serves the two typefaces the game uses, which means your browser requests them from Google.
- FormSubmit
- Relays feedback messages to the developer's inbox.
Analytics and ads
Google Analytics is used to see how the game is actually played in aggregate: which modes get opened, which screens people leave from, whether a change made things better or worse. It reports patterns across everyone, not a dossier on you.
A Google Ads conversion tag fires when someone who arrived from an ad starts playing, which is how ad spend is measured. Neither of these is used to target you with advertising elsewhere.
Both set cookies. A browser-level ad or tracker blocker will stop them, and the game works perfectly well with them blocked. Nothing about playing depends on analytics loading.
Your choices
- Play without an account. Guest play needs no personal information at all, and it is the default.
- Change your display name at any time from the lobby or your dashboard.
- Delete your account and its data. Send a request through the in-game feedback form, or email the address below, from the address on the account. Everything tied to it is removed, including profile and game results.
- Disconnect Google. If you signed in with Google, you can revoke access from your Google account's third-party access settings.
- Clear local data by clearing your browser's site data, which removes the daily result, unlocked opponents and preferences.
Children
The game is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact us and it will be removed.
Contact
Use the feedback button inside the game, or open an issue on GitHub. Questions about your data, including deletion requests, are answered at the same address.
If this policy changes, the date at the top changes with it. Material changes will be noted on this page rather than applied quietly.