Privacy

Last updated 9 November 2026.

The short version

  • We keep what we need to run the game and your account. We never sell your data, and there are no adverts or trackers.
  • We don't keep your date of birth, and we never see your card details.
  • Under-18s can't buy anything, never get news emails, and appear in public only as a visitor number with the default avatar.
  • You can download your data, or delete your account, from your profile at any time.

Who we are

dub3 is run by The Book of Me Ltd. Registered in England and Wales, company number 16574220. We're responsible for your data (the controller). Our director is responsible for privacy, and you can reach us at hello@playdub3.com. Our postal address is on the contact page.

What we keep, and why

  • Your account and game: your login id, player name, avatar, and everything you do in the game, such as cards, decks, matches, packs, tokens, Cache, swaps, achievements and Daily Challenge results. We need these to run the game for you (our contract with you).
  • Your country: it sets your prices and currency, whether you can buy tokens, and when emails reach you (our contract with you).
  • Your age group, and if you're under 18 the month you turn 18: to keep under-18s away from purchases and the 18+ collection, and to open purchases up when you turn 18 (our legitimate interest in protecting younger players).
  • Purchases: what you bought, when, the price, and the wording you agreed to at checkout. We need these to sell you tokens, to deal with refunds, and to keep the tax records the law requires (our contract with you, and our legal obligations).
  • Your spending limit and any refund still owed: to keep spending within your limit and stop refunds being misused (our contract with you, and our legitimate interest in preventing fraud).
  • Sign-in: our sign-in provider, Clerk, holds your email address and sign-in details, with the device and network details it needs to keep sign-in secure (our contract with you, and our legitimate interest in security).
  • Technical logs: our hosting and database providers keep short-lived logs, including IP addresses, to run the service and protect it from attacks (our legitimate interest in keeping dub3 secure).
  • Page counts: Vercel Web Analytics records each page you view: the page, without anything after a "?" and with match numbers taken out; the site that linked you to it; your country, region and city, worked out from your IP address; and your device type, operating system and browser. It sets no cookies and stores nothing on your device. It tells visits apart with a code made from your request, which it throws away after 24 hours, so it can't follow you from one day to the next or across other websites. We use the counts to see which pages people use and how they find us (our legitimate interest in improving dub3).
  • Emails, reports, ratings, comments and crash reports: see their sections below.

To have an account you must give a player name, your country and your date of birth, of which we keep only your age group. To buy tokens, Stripe needs your payment details. Everything else is up to you.

What we don't keep

Your date of birth, or your card details, which go straight to Stripe. If the date you enter means you can't have an account, we remove the login and keep nothing about you. A small cookie stays on that device so the question isn't asked again.

Who we share it with

These services process data for us, on our instructions: Clerk (sign-in), Convex (game data), Vercel (hosting and page counts), Stripe (payments), Emailit (sending our emails), Sentry (crash reports) and GitHub (tracking the problems you report). Stripe also uses payment data under its own privacy policy, for example to prevent fraud. We share the problems you report with Anthropic, whose AI assistant Claude helps us investigate them. Anthropic handles them under its own terms and privacy policy, not on our behalf, and we've switched off its use of them to train its models. We don't sell your data or share it with advertisers. We'd share it with anyone else only if the law required it, or with whoever took over dub3, who would have to keep to this notice.

Data outside the UK

Most of these services keep data in the United States. Emailit sends from its data centre in the EU. When data leaves the UK, it's protected by safeguards that UK law recognises: the UK–US data bridge for US companies certified to it, or the UK's approved data transfer clauses in our contracts with the others. Data held in another country can be reached by that country's courts and authorities under its own laws. Ask us if you'd like the details.

Emails

We always email receipts and important account messages, because the law or your account needs them. Game notices (swap offers, achievements, finished sets) are on for adults unless they turn them off, and off for under-18s unless they turn them on. News and Card of the Week go only to adults who tick the box, and never to under-18s. Every yes and no is kept with the wording you saw, and every optional email has a link to stop it. We look up your address at Clerk each time we send and don't keep a copy. Emailit keeps each message for 7 days and its delivery record for 30. We don't track whether you open emails or click their links. A record of what we sent is deleted after 90 days. Game notices rely on our legitimate interest in telling you about your game, and news on your consent.

Reports and ratings

When you use Report a problem, we keep what you write, the page you were on, the app's version, your browser and screen size, the last few errors the app hit, and, if you were in a match, a copy of that match so we can replay it. We never take screenshots. We remove email addresses, phone numbers and links from what you wrote, then file it in our private GitHub project, where Claude helps us look into it. It goes there without your name or account. If we ask whether you're enjoying dub3, we keep your answer, the result of the match it came after and any comment you add, and we remember if you chose Not now or Don't ask again. The counts shown on our home page, and our running total of answers, don't record who answered. We use reports and ratings to fix and improve the game (our legitimate interest).

Comments on our website

We only show a comment if you tick the box saying we can, and that's your consent. It appears with a visitor number drawn for that comment, never your player name, and under-18s always appear with the default avatar. We read every comment before it appears and never change its wording. You can remove it from your profile at any time, and it comes off the website straight away.

Crash reports

If the app hits an error, the technical details go to Sentry: what failed in the code, the page, your browser and the app's version. They don't include your name, account, cookies or anything you typed. We use them to fix problems (our legitimate interest).

Daily Challenge

If you play the Daily Challenge, your score appears on that day's leaderboard next to your avatar and a visitor number such as "Visitor #0412". Your player name is never shown, and under-18s are shown with the default avatar.

How long we keep it

  • Your account and game: until you delete your account.
  • Purchase records and the token history that goes with them: six years after the end of our financial year in which you bought, as UK tax law requires.
  • Reports: 12 months. Answers to "Are you enjoying dub3?": about 13 months. Comments: 6 months. Daily Challenge results: 30 days. Records of the emails we sent: 90 days.
  • The short record kept after you delete your account (see below): while dub3 runs, because its job is to stop age and spending protections being reset.

Deleting your account

Deleting removes your cards, decks, matches, pack history, daily progress, reports, ratings and comments for good, and deletes your sign-in at Clerk, along with the email address Clerk holds. We keep purchase records and the token history that goes with them for tax, and Stripe keeps its own record of any payment. We also keep a short record so that deleting and signing up again can't be used to get round age or spending protections. It holds your age group (and the month you turn 18, if you're under 18), your country, your spending limit, any repayment owed, whether purchases are turned off, and whether you'd played that day's or the previous day's Daily Challenge. The record is filed under your old login id and a one-way hash of your email address, not the address itself. If you sign up again with the same email, those limits and blocks carry over to the new account. We keep it because we have a legitimate interest in keeping those protections working.

Cookies and storage on your device

We don't use advertising or tracking cookies, and our page counts use none at all. Clerk sets the cookies that keep you signed in. We set one cookie when the age check turns someone away, so the question isn't asked again on that device. Your browser also keeps a few dub3 settings: whether sound and motion are on, and which tips and splash screens you've seen. Your date of birth waits in the browser while you sign up and is removed once your account is made. All of these are needed for the game to work the way you've asked, so we don't ask for consent to them.

Your rights

You can download your data, and delete your account, from your profile. You can also ask us to show you the data we hold about you, to correct it, to delete it, to limit how we use it, to stop using it where we rely on our legitimate interests, or to give it to you in a form you can take elsewhere. Where we rely on your consent, you can withdraw it at any time: switch emails off in your profile, or remove your comment. The law puts some limits on these rights, and we'll tell you if one applies.

Ask us through the contact page or at hello@playdub3.com. We'll reply within a month.

If you're unhappy with how we've handled your data, tell us first, and we'll acknowledge your complaint within 30 days. In the UK you can also complain to the Information Commissioner's Office. Elsewhere you can go to the privacy regulator where you live, such as the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner or New Zealand's Privacy Commissioner.

Under 18s

Players aged 13 to 17 can't buy tokens or see the 18+ collection, never get news emails, and have game notices off unless they switch them on. Anything of theirs we show in public, such as a comment or a Daily Challenge score, has the default avatar and a visitor number. Profiles are private for everyone, there's no chat, and there are no adverts. dub3 isn't for children under 13. If you think a child under 13 has an account, tell us at hello@playdub3.com and we'll delete it.

Decisions made by computer

We don't make decisions about you by automated means alone that have legal or similarly significant effects on you.

Do Not Track

We don't track you across other websites, and we don't let anyone else track you through dub3, so there's nothing for a browser's Do Not Track setting to switch off.

Changes to this notice

When we change this notice, we update the date at the top. If a change matters to you, we'll tell you by email before it applies.

Back · Odds · Credits · Terms · Privacy · Contact