This policy explains which personal data Up to 9 (upto9.no) processes, and why. The same policy is available inside the game.
Data controller
Up to 9 is run by a private individual (Wilhelm). Contact: wilhelm@hkbits.no.
What data we process
- Account: username, email address and password (stored encrypted with bcrypt — we never see your password).
- Game data: the games you take part in, your moves, results, friends and feedback you submit.
- Technical: your IP address is processed briefly when you use the service (requests and server logs).
- Statistics: anonymous usage statistics via self-hosted Umami (see the statistics section).
Purposes and legal basis
- Providing the game and your account — basis: performance of a contract (GDPR art. 6(1)(b)).
- Sending password-reset emails — same basis.
- Operations, security and debugging (logs) — legitimate interest (art. 6(1)(f)).
- Anonymous statistics to understand and improve usage — legitimate interest, and the data is anonymised.
- Showing ads to fund the service — legitimate interest, and consent for personalised ads in the EEA.
Cookies and local storage
The game itself uses no tracking cookies — your browser only stores what is needed to keep you logged in and keep your settings (login token, preferences and hand ordering), and our statistics are cookieless. Ad serving may set cookies from Google — see the advertising section.
Anonymous statistics (Umami)
We run a self-hosted Umami installation on our own server. It is cookieless, anonymises IP addresses, shares nothing with third parties and does not track you across websites. You can opt out at any time:
Anonymous statistics are on.
Advertising (Google AdSense)
The website shows ads from Google AdSense to cover running costs. Google and its partners may use cookies and ad identifiers to serve and measure ads. In the EEA, personalised ads are only shown with your consent — you get a separate consent choice (provided by Google) before such cookies are set, and you can change it at any time. Ads never affect the game itself. Read more in Google's policy for partner sites.
Sharing and processors
We do not sell your personal data, and game data is not shared with third parties. Everything runs on our own server, and our statistics are self-hosted. The exception is advertising: ads are delivered by Google AdSense (see the section above), where Google processes data under its own policies.
Retention
Account and game data are kept for as long as you have an account. If you delete your account, or ask us to, the data is removed. Server logs containing IPs are rotated regularly.
Your rights
You have the right to access, rectification, erasure, restriction and data portability, and to object to the processing. Contact us at wilhelm@hkbits.no. You can also complain to the Norwegian Data Protection Authority (datatilsynet.no).
Security
All traffic uses HTTPS, and passwords are stored encrypted. No solution is 100% secure, but we take reasonable measures to protect your data.
Last updated: August 17, 2026