Privacy Policy

1. Data We Collect

When you create a Lexikon account, we collect:

• Username and display name
• Email address
• Password (stored as a salted hash -- we never see your plain text password)

During gameplay, we collect:

• Game moves, scores, and match history
• Rating and statistics
• In-game purchases and credit balance

2. How We Use Your Data

• To provide and operate the game service
• To calculate ratings and maintain leaderboards
• To facilitate friend connections and matchmaking
• To process in-game market transactions
• To send notifications about game events (your turn, friend requests, etc.)

3. Cookies

We use a single authentication cookie (lexikon_token) to keep you logged in. This is an HttpOnly, Secure cookie that expires after 7 days. We do not use tracking or advertising cookies.

4. Data Sharing

We do not sell, trade, or share your personal data with third parties. Your public profile (username, display name, avatar, rating, and game stats) is visible to other players.

5. Data Security

All data is transmitted over HTTPS. Passwords are hashed using PBKDF2 with SHA-256 and unique salts. Authentication tokens are signed using HMAC-SHA256.

6. Data Deletion

You may request deletion of your account and all associated data by contacting us. Game history may be retained in an anonymized form.

7. Changes

We may update this policy as needed. Continued use of Lexikon after changes constitutes acceptance of the updated policy.