Privacy Policy

Effective: April 8, 2026 · Last updated: September 20, 2026

The short version: We collect only what we need to run accounts, leaderboards, and the games themselves. We don't sell your data. The apps carry no analytics or advertising SDKs. The website uses Cloudflare Web Analytics, which is cookieless and does not track you across sites, and one small first-party cookie of our own that remembers how you first found us — asked for first wherever the law requires your consent. You can delete your account and all of your data at any time.

This policy describes how MSO Games ("we", "us") collects, uses, and protects information when you use the MSO Games website (msogames.com) and the MSO Games applications, including MSO FreeCell Arena and MSO Minesweeper Arena on Windows, macOS, Linux, Android, and iOS (collectively, the "Services").

If you have questions about this policy or your data, contact us at [email protected].

1. Information we collect

Account information

When you create an MSO Games account, we collect:

Device identifier

Each device you use the apps on generates a random unique identifier (a UUID). This identifier is associated with your account if you're signed in, or used anonymously if you're not. We use it to:

This identifier is not the same as advertising IDs (IDFA on iOS, AAID on Android) and we do not collect those.

Network information

When your device or browser contacts our servers we record the IP address the request came from and the user agent string your app or browser sends. We use these only to keep the Services working and honest — rate-limiting, blocking automated signup abuse, detecting duplicate accounts, and telling real players apart from automated test traffic in our own usage counts. We do not use them to locate you, build a profile, or target anything at you. They are stripped from the records we keep if you delete your account.

Steam account identifier

If you play a version of our games installed through Steam — including the free demo — the app reports your SteamID, the public numeric ID of your Steam account. We use it for one purpose: so that your gameplay history belongs to you rather than to a particular computer — your results, badges, and progress are tagged with it so they can be reunited with you after a reinstall, a dead machine, or a move to the full game. This recovery is automatic: once a game on a machine has confirmed your SteamID with Steam, the history from every other machine that has done the same is brought together into one, and the merge is permanent — it is additive and never removes anything. If a merge ever combines histories that should not have been combined, contact us and we can separate them. Signing in to an MSO Games account links your devices the same way.

We confirm the SteamID with Steam the first time a game launches, so the history is attached to the right player. This confirmation does not tell us anything about what you own or have paid for, and it does not change what the game gives you. We don't collect your Steam profile name, friends list, or any other Steam data, and we never publish your SteamID.

Hardware and system information

The apps report basic device characteristics so we can diagnose performance issues and decide which features to enable on lower-end devices. The desktop apps report the full list below; the mobile apps currently report only app version and platform. This includes:

Gameplay data

When you play a game and submit a result, we collect details of that game:

User-submitted content

How you first found us (website only)

When you first visit msogames.com we note three things: the campaign tags on the link you followed, if it had any (utm_source, utm_medium, utm_campaign, utm_content — nothing else from the address); the name of the site that sent you (for example reddit.com — never the full address of the page you came from); and which kind of page you landed on (for example "a challenge link", never the link itself). We keep this in one first-party cookie named mso_fc, which lasts 90 days and is never overwritten by a later visit. We use it for one thing: telling which of our posts and links actually bring players, so a two-person studio spends its time where it works.

If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland — or we cannot tell where you are — we ask first and store nothing until you say OK. To work out which country a visit comes from, our own server looks the IP address up in a country-level list we keep on the server (from DB-IP, downloaded in advance, so no one outside is told about your visit). It answers with a country and nothing finer, we use it only to decide whether to ask you, and we do not store the answer. If you say "No thanks" the cookie records only that answer, so we don't ask again. If your browser sends the Global Privacy Control signal we treat that as "no" everywhere and don't ask. You can clear the cookie at any time in your browser.

If that browser later plays in the browser or creates an account, we copy the note into our database alongside that device or account, once. It is not shared with anyone, it is not used to show you anything, and it does not follow you to other sites. The apps do none of this.

Information we do NOT collect

2. How we use your information

We use the information described above to:

We do not use your information for:

3. Where your data is stored

All data is stored on infrastructure operated by DigitalOcean (a US-based cloud provider) in their data centers:

Your data is transmitted between your device and our servers over HTTPS (TLS).

4. Who we share data with

We do not sell your data. We share your data only with:

5. Your rights and choices

You have control over your data. You can:

If you're in the European Union, the United Kingdom, or another region with comprehensive privacy laws (such as GDPR), you have additional rights including the right to object to processing, the right to data portability, and the right to lodge a complaint with your local data protection authority. We honor all such requests; please contact us at the address above.

If you're a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of any "sale" of personal information. We don't sell personal information.

6. Data retention

We keep your data while your account is active. If you delete your account, we delete your personal information and associated gameplay data within 30 days, except where retention is required by law.

When you delete your account we remove your gameplay outright — results, replays, badges, and progress. The device records that remain behind for the aggregate statistics described below are stripped of everything that links them to you: the account connection, the device identifier itself, your SteamID, your display name, and the network information we hold for anti-abuse. What's left cannot be traced back to you or matched to your devices.

If you play without an account — as a guest or in the Steam demo — your gameplay is held against your device and, on Steam, your SteamID, rather than against an account. We keep it so that your history can be reunited with you after a reinstall or a move to a new machine, and so it carries over when you create an account (see the note on automatic Steam recovery above). You can ask us to delete demo or guest gameplay at any time using the method described above. We also intend to remove demo gameplay that has gone unused for a long period, but that scheduled clean-up is not running yet — we will update this policy when it is.

The note of how you first found us (section 1) lives in its cookie for 90 days. Once copied to a device or account it is kept for as long as we hold that record; when you delete your account the link between the note and you is removed with everything else, and what remains is a channel name attached to nothing that identifies you.

Aggregated, anonymized statistics (for example, "how many players completed Daily Challenge #42") may be retained indefinitely for the purpose of running the leaderboards and historical data, but they cannot be linked back to you after deletion.

Replay files are kept for as long as we hold the game they belong to. We used to say that a replay might be deleted automatically once a record was broken and it dropped out of the top entries; that is no longer how the system works, and we now keep replays — features like watching your own past games and racing a rival's ghost depend on them. They are deleted when you delete your account or the associated gameplay data.

7. Children's privacy

The Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you believe your child has provided us with information without your consent, please contact us at [email protected] and we will delete the information.

8. Security

We use industry-standard practices to protect your data:

No system is perfectly secure. If we learn of a breach affecting your data, we will notify you within the time required by applicable law.

9. Changes to this policy

We may update this policy from time to time as the Services evolve. When we do, we'll update the "Last updated" date at the top of this page. For material changes, we'll also notify you via email or an in-app message.

10. Contact us

For any questions about this policy, your data, or to exercise your rights, email us at [email protected].

For general support, see [email protected].