Privacy policy
Last updated October 5, 2026
Xs vs Os is a tic-tac-toe game played at www.xsvos.com and in the Xs vs Os apps for Android and iOS. It is made by DTM, an independent developer. This page says what the game collects, why, and what you can do about it. Questions: admin@dtmautomations.com.
Playing without an account
You can play against the computer without signing up. Those games, your settings and your theme stay on your device and are not sent to us.
What we collect when you have an account
- Email address and password. To create your account, sign you in and send sign-in, confirmation and password-reset emails. Passwords are stored only as a secure hash.
- Username and account ID. Your username is shown to other players in games, leaderboards, tournaments and chat.
- Game activity. Your games and moves, ratings, tokens, characters, campaign and puzzle progress, and tournament entries, so the game works and keeps your progress.
- Chat messages you send in games, which the other player sees.
- Notifications. If you turn on notifications, that browser's push subscription, or in the Android and iOS apps that device's push token, so we can tell you when it's your turn. Turning them off or signing out removes it.
We don't collect your real name, location, contacts, photos or device identifiers, we don't show ads, and we don't sell or rent your data to anyone.
Analytics on the website
The website may use Google Analytics to count page views, but only if you allow it when asked, and you can turn it off at any time in Settings → Privacy. It is sent only the page's route, never your username, email or game links. The Android and iOS apps don't use Google Analytics.
Who processes your data
We use these service providers to run the game. They handle data only on our behalf:
- Supabase: accounts, the database and the game server.
- Cloudflare: hosts the website, and may run a robot check (Turnstile) when you sign up or sign in.
- Resend: sends the game's emails.
- Google: Google Analytics on the website, only if you allow it, and Firebase Cloud Messaging, which delivers notifications to the Android app if you turn them on.
- Apple: the Apple Push Notification service, which delivers notifications to the iOS app if you turn them on.
All data travels over encrypted connections (HTTPS).
How long we keep it
- Your account and game data: until you delete your account.
- Database backups: 30 days, then they are deleted.
- Server error logs, which may include your account ID: 30 days.
Your choices
- You can ask for a copy of your data, a correction or deletion by emailing admin@dtmautomations.com from the address on your account.
- To delete your account and data, see Delete your account.
Children
Xs vs Os is not directed at children under 13, and we don't knowingly collect personal data from them. If you think a child under 13 has an account, email us and we'll delete it.
Changes
If this policy changes, we'll update this page and the date at the top.