Privacy policy
Last updated 29 September 2026
You can play Deal & Roll without an account, and we do not store your chat or game moves. If you create an account, send us a message or accept analytics, we keep only what this page lists, for the time it says, and you can see and delete your account data yourself. We do not sell your data and we do not use advertising trackers.
Who we are
Delivvo Computer System Development operates Deal & Roll at https://www.dealandroll.com and is the data controller for the personal data described in this policy. That means we decide why and how the data is used and we are responsible for protecting it.
| Detail | Value |
|---|---|
| Trade name | Delivvo Computer System Development (دلفو لتطوير نظم الحاسب الالي) |
| Legal form | Sole establishment |
| Licensing authority | Abu Dhabi Department of Economic Development (ADRA) |
| Licence number | CN-6512437 |
| Registration number | 101-2026-200103343 |
| Location | Abu Dhabi, United Arab Emirates |
| mohdbibo22@gmail.com | |
| Website | https://www.dealandroll.com |
This policy applies to the website and the games on it. We handle personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). If you are in the European Union or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR may also apply, and this policy explains the rights you have under them.
For any privacy question or request, email mohdbibo22@gmail.com.
What we collect
What we collect depends on how you use the site. The table below lists every category.
| When | What we collect | Where it is kept |
|---|---|---|
| Playing without an account | Your display name and avatar choice. Technical data that keeps your seat at a table after a refresh. | Only in your own browser. We do not receive it on our servers. |
| Playing at a table with others | Your display name, avatar, chat messages and moves are sent to the other players at the table. Your IP address is visible to their browsers and to the connection services described below. | In the browsers of the players at the table while the game runs. Not stored on our servers. |
| With an account | Email address, display name, avatar seed, date joined, date last seen, favourite games, game results (which game, win or placement, number of players, date) and support requests you send while signed in. | Our database (Supabase). |
| Contact and bug-report form | Category, subject, message, an optional email address for replies, which game you were playing, page address, browser and device details (user agent), screen size, and technical details of the error if you report it from inside a game. | Our database (Supabase). |
| Automatic error reports | When a game crashes in your browser: the error message, stack trace, game, page address, user agent and a random session id. No chat, display names or other personal content. | Our database (Supabase). |
| Analytics, if you choose "Accept all" | A random visitor id, a random session id, pages viewed, games started and finished, country (worked out from request headers where available), the referring page, user agent and screen size. | Our database (Supabase). |
| Analytics, if you choose "Essential only" | An anonymous page view count with no identifier attached. | Our database (Supabase). |
| Security and hosting | IP addresses, used in hashed form for rate limiting on sign-in and forms. Standard server logs kept by our hosting provider (IP address, time, page requested, user agent). | Our database for rate limiting. Vercel for server logs. |
| Payments (not live yet) | If we introduce paid features: what you bought, the amount, date and payment status. Card details are handled by Stripe and never reach us. | Our database and Stripe. |
We do not collect sensitive data such as health, religion or financial account details, and we do not ask for your real name, phone number or address. Please do not put such information in your display name, chat or messages to us.
How we use it and our legal bases
We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, the last column shows the legal basis we rely on. Under the PDPL we rely on the equivalent grounds, including your consent and the performance of a contract with you.
| Purpose | Data used | Legal basis |
|---|---|---|
| Running games and connecting players | Display name, avatar, chat, moves, IP address (shared between browsers) | Performance of our agreement with you (the terms of service) |
| Providing your account: sign-in, profile, favourites, game results | Account data | Performance of a contract |
| Answering support requests and fixing reported bugs | Support request data | Legitimate interests (helping you and improving the service), or performance of a contract for account holders |
| Finding and fixing crashes | Automatic error reports | Legitimate interests (keeping the games working) |
| Protecting the service from abuse and spam | Hashed IP addresses, server logs | Legitimate interests (security of the service and its users) |
| Measuring how the site is used with a visitor id | Analytics data with an identifier | Consent, which you can withdraw at any time |
| Counting page views without an identifier | Anonymous page view count | Not personal data |
| Processing and recording payments, if we offer paid features | Purchase records | Performance of a contract, and legal obligation for accounting records |
| Complying with the law and dealing with legal claims | Any of the above, as needed | Legal obligation, or legitimate interests in defending legal claims |
Where we rely on legitimate interests, we have checked that our interest is not outweighed by your rights. You can object to this use at any time (see your rights below).
We do not sell or rent your personal data. We do not use it for advertising, we do not share it with ad networks, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
We use your email address only to sign you in, to reply to your support requests, and to tell you about material changes to our terms or this policy. We do not send marketing emails unless you have separately agreed to receive them.
Peer-to-peer play
Games on Deal & Roll run in the host player's browser, and other players connect to the host directly over WebRTC. This keeps chat and moves off our servers, but it also means some data is shared with other people and with connection services:
- Other players at your table see your display name, avatar, chat messages and moves. They could copy or screenshot them.
- A direct connection exposes your IP address to the browsers of the other players at the table. An IP address can reveal your approximate location and your internet provider.
- To introduce players to each other, the site uses the public PeerJS signalling server (the PeerJS cloud service). It sees your IP address and the connection details needed to set up the call, but not your game or chat.
- To find a route between players, browsers contact STUN servers run by Google and Cloudflare. These see your IP address.
- If a direct connection fails, traffic passes through a public TURN relay (Open Relay, run by Metered). The relay sees your IP address and carries your game traffic in encrypted form.
WebRTC connections are encrypted between browsers. If you do not want other players to see your IP address, you can use a VPN, or play only with people you know.
Service providers
We use the following providers to run the service. Where they process personal data on our behalf, they may use it only to provide their service to us. The public connection services are operated independently and process data under their own policies.
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, account sign-in and sending sign-in emails | Account data, support requests, error reports, analytics, rate-limit records |
| Vercel | Website hosting and content delivery | Server logs (IP address, pages requested, user agent) |
| PeerJS cloud | Signalling server that introduces players to each other | IP address and connection setup details |
| Google and Cloudflare | STUN servers that help browsers find a route to each other | IP address |
| Metered (Open Relay) | TURN relay used when a direct connection fails | IP address and encrypted game traffic |
| Stripe (future) | Payment processing, if we offer paid features | Payment details, purchase records, email address |
We may also share personal data if the law requires it, to protect the rights, safety or property of our users or ourselves, or with a business that takes over the service. In that last case, this policy will continue to apply to your data unless you are told otherwise.
International transfers
We are based in the United Arab Emirates. Our providers operate servers in other countries, including the European Union and the United States, so your data may be processed outside the UAE and outside the country where you live.
When we transfer personal data abroad, we do so in line with the PDPL and, where it applies, the GDPR or UK GDPR. We rely on safeguards such as adequacy decisions, standard contractual clauses and the data protection terms our providers offer, and we choose providers that apply appropriate security measures. You can ask us for more information about these safeguards at mohdbibo22@gmail.com.
How long we keep data
We keep personal data only for as long as we need it.
| Data | How long we keep it |
|---|---|
| Account data (email, display name, avatar, dates) | Until you delete your account |
| Favourite games and game results | Until you remove them or delete your account |
| Support requests | 24 months after the request is closed |
| Automatic error reports | 90 days |
| Analytics events | 13 months |
| Rate-limit records (hashed IP addresses) | Less than 24 hours |
| Payment records, if we offer paid features | As long as UAE law requires, which is at least five years for accounting records |
| Hosting server logs | A short period set by our hosting provider |
| Chat and game moves | Not stored on our servers |
| Data in your browser | Until you clear it (see the cookie policy) |
When you delete your account, we delete your account, favourites and game results immediately. Support requests you sent are kept for the period above so we can finish dealing with them, but they are separated from your account and your email address is removed from them.
We may keep data for longer if we need it to deal with a legal claim or if the law requires it.
Your rights
Under the PDPL, and the GDPR or UK GDPR where they apply, you have the following rights over your personal data:
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to fix data that is wrong or incomplete.
- Deletion: ask us to delete your data.
- Restriction: ask us to limit how we use your data while a concern is looked into.
- Objection: object to our use of your data based on legitimate interests.
- Portability: receive your data in a structured, commonly used, machine-readable format, or have it sent to another provider.
- Withdraw consent: withdraw your analytics consent at any time through "Cookie settings" in the footer. This does not affect use of your data before you withdrew it.
- Complain: complain to a data protection supervisory authority.
How to use your rights
If you have an account, you can see all the data linked to it and delete the account yourself on your account page. For anything else, email mohdbibo22@gmail.com from the address on your account, or tell us enough to find your data (for example, the date and subject of a support request).
We may ask you to confirm your identity before acting on a request. We reply within 30 days. If a request is complex, we may need longer, and we will tell you why within those 30 days. We do not charge for requests unless they are clearly unfounded or excessive.
Data that exists only in your browser, such as your display name when you play without an account, is under your control. You can remove it by clearing your browser storage.
Complaints
Please contact us first so we can try to solve the problem. You also have the right to complain to the UAE Data Office. If you are in the European Union, you can complain to the data protection authority in your country. If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ICO).
Children
Deal & Roll is not directed at children under 13, and they must not use it. Users between 13 and 17 need permission from a parent or guardian to create an account.
We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete it. If you believe a child under 13 has given us personal data, please email mohdbibo22@gmail.com.
Security
We protect personal data with technical and organisational measures that fit the risk. These include encrypted connections (HTTPS) for the site, encrypted WebRTC connections between players, access controls on our database, sign-in without passwords, hashing of IP addresses used for rate limiting, and limits on how often forms and sign-in can be used.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires.
Changes to this policy
We will update this policy when the way we handle personal data changes. The new version will be posted on this page with a new date. The current version took effect on 29 September 2026.
If a change is material, for example a new purpose for your data or a new kind of data, we will flag it on the site before it takes effect, and ask for your consent again where the law requires it.
Contact us
For questions about this policy or your personal data, email mohdbibo22@gmail.com or use the contact form on the site. You can also write to Delivvo Computer System Development, Abu Dhabi, United Arab Emirates (licence number CN-6512437).