PEN FIGHT

Privacy Policy

Effective date: 24 August 2026. Last updated: 24 August 2026. This Privacy Policy is a standalone notice. You do not need any other page on this site in order to understand it.

1. Who we are and how to read this notice

1.1 This Privacy Policy describes how the publisher of https://penfight.xyz/ (“we”, “us”, “our”) collects, uses, stores, shares, and otherwise processes personal data in connection with the website and the browser game known as Pen Fight (the “Service”).

1.2 For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), we are the Data Fiduciary. You are the Data Principal in respect of your personal data.

1.3 This document is:

the notice required by section 5 of the DPDP Act and Rule 3 of the DPDP Rules;
the privacy policy required by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”); and
the privacy policy published for users of the Service under the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules, 2021”).

1.4 It is written in clear language, as those laws require. Technical names (for example, “player identifier”) are used because they are the actual fields the Service stores. They are defined in the table in clause 3.

1.5 Contact for all privacy matters, including access, correction, erasure, withdrawal of consent, nomination, and grievances:

Email: hello@penfight.xyz
Website: https://penfight.xyz/
Related contract: Terms of Use

1.6 We are not a Significant Data Fiduciary as of the effective date. If that status changes, we will update this notice and meet the additional duties that then apply.

2. Scope

2.1 This notice applies to personal data processed when you visit the Service, play, sign in, join a multiplayer room, or contact us. It also applies to advertising, analytics, and session-replay tools when those tools are configured on the Service.

2.2 It does not apply to third-party websites or applications that we do not control, including WhatsApp if you follow a community link, or an advertiser’s landing page. Those parties process personal data under their own notices.

2.3 “Personal data” means any data about an individual who is identifiable by or in relation to such data, as defined in the DPDP Act. We do not seek to collect “sensitive personal data or information” as defined in the SPDI Rules (passwords of the kind that rule names, financial information, health information, sexual orientation, biometric information). Google sign-in is handled by Google; we receive an email address and a Google account identifier, not your Google password.

3. Personal data we collect (itemised)

The following is an itemised description of the personal data we process, the specified purpose of that processing, and the service or use that processing enables, as required by Rule 3 of the DPDP Rules.

Category	Personal data	Specified purpose and service enabled	Required to use the Service?
Player identifier and local save	A unique player identifier; a local copy of your progression (Display Name, pens held, championship or defence status, scores, a match in progress); sign-in flags; an anonymous or Google session token stored by the sign-in library	To keep your game state on the device you are using, and to associate a write to our servers with a session. Enables continuing a game on that browser.	Yes, if you play. The identifier is created when the Service first runs in that browser.
Display Name and public game records	The Display Name you enter; pens held; match results; points; championship and defence records	To operate rankings and honours, and to show your name to other players. Enables the class ranking and match results. Points are computed on our servers from the match log, not from a number stored only on a device.	A Display Name is required to appear on a ranking. Playing writes a Match Record.
Google sign-in (optional)	Email address; Google account identifier; a snapshot of your progression	To bind one Google account to one Player Record and to restore that record on another device. Enables cross-device restore. The snapshot does not determine rank.	No. Sign-in is optional. You can play without it.
Multiplayer session	Display Name; selected pen; shot data; ready state; presence on the live channel	To keep both (or all three) clients in the same room showing the same match. Enables two-player and three-player play. The other player can see this data.	Yes, if you join a room.
Network and device data	Internet Protocol (IP) address; user-agent string; coarse city when the hosting platform supplies it; device class; HTTP referrer; invite or room codes in the URL	To serve the website, seat rooms, prevent automated abuse, and (when a city check is running) decide whether a particular on-site line is shown. The browser is not told the city. Enables hosting, security, and that limited geographic gate.	Yes, as a necessary part of using a website. The city check is not required to play.
Human verification	A Cloudflare Turnstile token	To reduce automated creation of sessions and rooms. Enables an anonymous session that is more likely to be a person.	Yes, when the check is presented.
Analytics (only if configured)	Player identifier used as an analytics user identifier; event names (for example boot, shots, sheet views, sign-in steps); device class; performance metrics. Display Names are not sent to Google Analytics.	To understand where people stop using the Service and whether a device can run the game. Enables product improvement. This processing is not required to play.	No. The script is included only when a measurement identifier is built into the site.
Session replay (only if configured)	A recording of the page as it appeared on your screen, which can include Display Names visible on that page; the same player identifier. Form field input is masked.	To see what the screen looked like when a session failed or was abandoned. Enables debugging of the interface. This processing is not required to play.	No. The script is included only when a replay identifier is built into the site.
Advertising (when ads run)	Cookie and device identifiers; IP address; user-agent; approximate location; pages viewed; ad impressions and clicks, as collected by the advertising partner	To display advertisements and, where permitted, to personalise them. Enables the advertising that may support the Service. This processing is not required to play.	No, except that visiting a page that carries an advertisement will cause the advertising partner to receive the data it needs to serve that advertisement.
Correspondence	The content of emails you send us, and the address you send them from	To respond to requests, rights exercises, and grievances. Enables support and legal compliance.	Only if you write to us.
Device-only pending reports	A result or duel report that has not yet been accepted by our servers	To finish a write after a network failure. These reports stay on the device and do not travel with Google sign-in, so two devices cannot commit the same match.	Created only if a write is interrupted.

3.1 Ranked writes go through server-side functions that clamp numbers and strip strings. The public key shipped in the page cannot read the underlying tables directly.

3.2 We do not collect a telephone number, postal address, school name, photograph of you, contacts list, precise GPS location, payment card data, or government identity numbers, unless you choose to put such information in a Display Name or in an email (which you must not do).

4. Purposes and the service each purpose enables

We process personal data only for the following specified purposes:

Providing the game. Creating a Player Record, recording matches, computing points, showing rankings, seating two-player and three-player rooms, and restoring a signed-in Player Record on another device.
Security and integrity. Binding a write to a session, running a human-verification challenge, clamping values a device can claim, and detecting abuse of rankings or rooms.
Hosting and operations. Delivering the website, logging faults, and sending operational alerts. Public ranking names may appear in an operational alert.
Optional measurement. Analytics and session replay, when those tools are configured, to improve the Service.
Advertising. Displaying advertisements, when we run them, including personalised advertisements where permitted by law and by your choices.
Legal compliance and communications. Meeting duties under applicable law, responding to you, and handling grievances.

We do not use personal data for a purpose that is not specified in this notice without providing an updated notice and, where the DPDP Act requires it, obtaining fresh consent.

5. How we collect personal data

5.1 Data you provide. Display Name; optional Google sign-in; emails you send us.

5.2 Data collected automatically. Player identifier and local save; network and device data; multiplayer session data; Turnstile tokens; cookies and similar technologies described in clause 7.

5.3 Data from third parties. If you sign in with Google, Google sends us the email address and account identifier you permit. Advertising, analytics, and replay partners collect data as described in their notices when their tags run.

5.4 Data from other users. In a room, the other player’s client receives the multiplayer session data listed above.

6. Legal basis under Indian law

6.1 The DPDP Act permits processing of personal data with the consent of the Data Principal for a specified purpose, and in the limited “legitimate uses” set out in section 7 of that Act (for example, where processing is necessary for compliance with any law, or for a purpose expressly covered by that section).

6.2 For providing the Service you request (playing, rankings, rooms, optional restore via Google), we rely on your consent. You give that consent by using the Service after this notice is available, by entering a Display Name, by joining a room, or by completing Google sign-in. Consent is limited to the personal data that is necessary for the purpose you requested.

6.3 For optional analytics, session replay, and personalised advertising, we rely on consent where the DPDP Act or other applicable law requires it. Until a separate consent control is shown on the Service, you may refuse those tools by the opt-out and browser methods in clauses 7, 8 and 9. If we add a consent banner or preference control, that control will be the means of giving and withdrawing consent for those purposes, with ease comparable to the means of giving it, as Rule 3 of the DPDP Rules requires.

6.4 We may process personal data without relying on consent where section 7 of the DPDP Act or another law applies, including compliance with a legal obligation, a court or government order, or responding to a medical or safety emergency if one ever arose in connection with the Service.

6.5 You may withdraw consent as described in clause 15. Withdrawal does not affect processing lawfully carried out before withdrawal. If you withdraw consent that is necessary to provide a part of the Service, we may be unable to provide that part.

7. Cookies and similar technologies

7.1 We and our processors use cookies, local storage, and similar technologies on your device.

7.2 Strictly necessary storage. The Service stores the player identifier, the local save, and the sign-in session on the device. Without that storage, the game cannot remember you on that browser and cannot complete a signed-in restore.

7.3 Third-party cookies and similar technologies may be set by:

Google, for Analytics (when a measurement identifier is configured) and for advertising (when ads run);
Microsoft, for Clarity session replay (when a replay identifier is configured);
Cloudflare, for Turnstile;
other advertising vendors, when we have not opted out of third-party ad serving.

7.4 You can delete site data in your browser. That deletes the local save on that device. A Player Record bound to Google can be restored by signing in again. A Player Record that existed only on that device cannot.

7.5 Most browsers let you block or delete cookies. Blocking strictly necessary storage will stop the game from working normally. Blocking third-party cookies may reduce advertising and measurement but does not prevent play.

8. Analytics and session replay

8.1 Google Analytics 4 is included only when a measurement identifier is built into the site at compile time. If that identifier is absent, the Analytics script is not shipped and that Analytics cookie is not set by us. Events use the player identifier. Display Names are not sent to Google Analytics.

8.2 Microsoft Clarity is included only when a replay identifier is built into the site. Recordings show the page as you saw it. Display Names that were visible on screen can appear in a recording. Characters typed into form fields are masked.

8.3 You can refuse these tools with a browser content blocker or by the cookie controls in your browser. The game still plays. Google’s notice is at https://policies.google.com/privacy. Microsoft’s notice is at https://privacy.microsoft.com/privacystatement.

9. Advertising

9.1 We may display advertisements on the Service, including advertisements served by Google and by other advertising networks. This clause is written so that those advertisements can be shown in accordance with the advertising partner’s publisher requirements.

9.2 Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.

9.3 Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

9.4 You may opt out of personalised advertising by visiting Google Ads Settings at https://adssettings.google.com. You may also opt out of a third-party vendor’s use of cookies for personalised advertising by visiting https://www.aboutads.info/choices/. Further information is available from the Network Advertising Initiative at https://optout.networkadvertising.org/.

9.5 Further information from Google: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

9.6 If we have not opted out of third-party ad serving, the cookies of other third-party vendors or ad networks may also be used to serve ads on the Service. We will identify those vendors on this page when they are engaged, and we will link to their notices and, where they offer one, their opt-out. Until a named additional network is engaged, the advertising vendor we anticipate is Google.

9.7 Advertising partners may collect device and browser data, cookie identifiers, approximate location, and information about advertisements shown or clicked. We do not sell your Display Name, email address, or match log to advertisers. We do not permit an advertising network to read the match log.

9.8 If we serve advertisements to users in the European Economic Area, the United Kingdom, or Switzerland, we will use a consent mechanism that meets the advertising partner’s requirements for those regions, including a certified consent-management platform where that is required. Until that mechanism is in place, we will not rely on this notice alone as consent for personalised advertising in those regions.

9.9 We do not knowingly use personal data of a child for tracking, behavioural monitoring, or targeted advertising. See clause 18.

10. Recipients and processors

We disclose personal data to the following categories of recipients, and only for the purposes stated in this notice.

Recipient	Role	Personal data received	Location of processing
Supabase, Inc. and its affiliates	Data processor: authentication, match log, rankings, live rooms, signed-in snapshots	Player identifier, Display Name, game records, Google email and account identifier if you sign in, session and room data	Outside India (the processor’s cloud regions)
Vercel Inc. and its affiliates	Data processor: hosting and edge routes	IP address, user-agent, URL, and (when supplied by the platform) a coarse city header	Outside India (the processor’s cloud and edge network)
Google LLC and its affiliates	Independent controller or processor, depending on the product: optional sign-in; Analytics when enabled; advertising when enabled	As described by Google for each product; for sign-in, the email and account identifier you permit	Google’s infrastructure, which may be outside India
Microsoft Corporation and its affiliates	Session replay when Clarity is enabled	Page recordings and the player identifier, as described in clause 8	Microsoft’s infrastructure, which may be outside India
Cloudflare, Inc. and its affiliates	Human verification (Turnstile)	The Turnstile token and associated security signals	Cloudflare’s infrastructure, which may be outside India
Other players in your room	Recipients necessary to play	Display Name, selected pen, shot data, ready state, channel presence	The other player’s device
Operational alerting tools (which may include Telegram)	Processors or channels used to keep the Service operating	Public ranking names and operational event summaries, not private diary contents	The operator of that channel
Professional advisers and competent authorities	Where required or permitted by law	Only what is necessary for the advice or the request	As applicable

10.1 We do not sell personal data.

10.2 Processors are engaged under arrangements that require them to process personal data on our instructions and to apply reasonable security safeguards. We remain the Data Fiduciary for processing we determine the purpose of.

10.3 If you open a WhatsApp community link, WhatsApp processes your data under its own terms. That is not our processing.

11. International transfers

11.1 Personal data processed in connection with the Service may be transferred outside the territory of India, including to the processors named in clause 10. Rule 15 of the DPDP Rules permits such transfers subject to any restriction the Central Government may specify regarding making personal data available to a foreign State or to a person under the control of such a State. We will comply with any such restriction that applies to us.

11.2 By using the Service you understand that your personal data may be stored and processed outside India. We use processors who offer contractual and security terms that are ordinary for this kind of consumer internet service.

12. Retention

We retain personal data only as long as it is needed for the specified purpose, or as required by law, whichever is longer.

Match Records and ranking rows: for as long as the Service is operated in a form that depends on a historical ranking, or until we grant an erasure request that the law permits us to grant.
Signed-in snapshot: until you ask us to erase it, you close the binding, or the account is otherwise closed.
Local save: until you clear site data or the browser evicts it.
Analytics and session replay: according to the retention settings of those products, typically a rolling window of months.
Server and security logs: a short operational window, and in any event not longer than needed for security, debugging, and legal claims, subject to clause 13.2.
Correspondence and grievance files: for the period needed to handle the request and to meet legal limitation periods.
After cancellation of a registration: where the IT Rules, 2021 require it, registration information is retained for one hundred and eighty days after cancellation or withdrawal.

When we no longer need personal data, we delete it or irreversibly de-identify it, except where a law requires us to keep it.

13. Security

13.1 We apply reasonable security safeguards appropriate to the nature of the data and the harm that may result from a breach, as required by the DPDP Act, Rule 6 of the DPDP Rules, and the SPDI Rules. Those safeguards include encryption in transit, access control on the systems that hold personal data, server-side validation of ranked writes, masking of form input in session replay, and contractual security terms with processors.

13.2 In accordance with Rule 6 of the DPDP Rules, we retain logs and related personal data needed to detect, investigate, and remediate unauthorised access, and to continue processing after a compromise, for one year, unless a longer or shorter period is required by law.

13.3 No method of transmission or storage is completely secure. You should not put a secret in your Display Name or in a share image.

14. Your rights

Subject to the DPDP Act and other applicable law, you have the following rights:

Access. To obtain a summary of the personal data we process about you and the processing activities undertaken, including the identities of others with whom the data has been shared, as provided in the Act.
Correction and completion. To have inaccurate or incomplete personal data corrected or completed.
Erasure. To request erasure of personal data that is no longer necessary for the specified purpose, or that we are otherwise required to erase. We may retain data where the Act or another law requires or permits us to do so. A finished Match Record may have to remain, in whole or in anonymised form, where deleting it would falsify a ranking that other people already rely on. If we refuse erasure in part, we will say so and why.
Withdrawal of consent. To withdraw consent with ease comparable to that with which you gave it, as described in clause 15.
Nomination. To nominate any other individual to exercise your rights under the DPDP Act in the event of your death or incapacity, by writing to us with the nominee’s name and contact details and enough information to identify your Player Record.
Grievance. To have a grievance considered under clause 16.
Complaint to the Board. To complain to the Data Protection Board of India as described in clause 17.

You also have rights under the SPDI Rules to review the personal information we hold about you and to withdraw consent to processing that is not required by law, understanding that we may then be unable to provide the related service.

15. How to withdraw consent and exercise rights

15.1 Communication link. Use https://penfight.xyz/privacy/ to read this notice, and send requests to hello@penfight.xyz. That is the means of withdrawing consent, exercising rights, and starting a grievance. There is no other required portal as of the effective date.

15.2 Identifier we need. To identify you we may ask for one or more of: the Display Name; the player identifier if you have it (it is the identifier stored by the Service for your Player Record); the Google email address if you signed in; and enough detail about the device or the approximate time of play to find the row. Rule 14 of the DPDP Rules permits us to require such an identifier.

15.3 Withdrawal of consent, by purpose:

Google sign-in: sign out on the Service, then email us if you want the binding and the server snapshot erased.
Analytics and session replay: use a browser content blocker or cookie controls. Email us if you want us to record that you object, and we will not use those tools on a subsequent visit where we can identify you.
Personalised advertising: use the opt-out links in clause 9. If we add a consent banner, use that banner. Withdrawal is then as easy as the original choice.
Playing and rankings: stop using the Service and email us to request erasure of the Player Record. We will erase what the law requires us to erase. Some Match Records may be retained or anonymised as described in clause 14.

15.4 We will not charge a fee for a reasonable request. We may refuse a request that is manifestly unfounded or excessive, or that we cannot authenticate, and we will tell you why.

15.5 We will respond within the time required by applicable law and, in any event, within ninety days of receipt of a complete request.

16. Grievance redressal

16.1 You may lodge a grievance about our processing of personal data, or about any other matter concerning the Service, by email to hello@penfight.xyz, addressed to the Grievance Officer.

Grievance Officer
Pen Fight
Email: hello@penfight.xyz
Website: https://penfight.xyz/

16.2 Under the IT Rules, 2021, the Grievance Officer shall acknowledge a complaint within twenty-four hours of receipt and resolve it within fifteen days of receipt, except where those Rules require a shorter period (including seventy-two hours for certain requests to remove information, and twenty-four hours for complaints concerning content that is prima facie sexual imagery of an individual or impersonation, including morphed images).

16.3 Under Rule 14 of the DPDP Rules, we will respond to a data-protection grievance within a period not exceeding ninety days. Where both timelines apply, we will meet the shorter one.

16.4 If you are not satisfied with the decision of the Grievance Officer on a matter covered by the IT Rules, 2021, you may appeal to the Grievance Appellate Committee through the mechanism published by the Government of India for that purpose.

17. Complaint to the Data Protection Board of India

17.1 If you are not satisfied with our response to a data-protection grievance, or if we do not respond within the time required, you may make a complaint to the Data Protection Board of India under the DPDP Act.

17.2 The Board functions as a digital office. The manner of filing a complaint is the manner published by the Board or by the Ministry of Electronics and Information Technology. See https://www.meity.gov.in/ and any portal the Board publishes. You should first write to us at hello@penfight.xyz and keep a copy of that correspondence.

17.3 An appeal from an order of the Board lies to the Appellate Tribunal in the manner provided by the DPDP Act and the DPDP Rules.

18. Children

18.1 Under the DPDP Act, a child is a person who has not completed eighteen years of age. The Service is directed at persons aged 18 or older. We do not knowingly process personal data of a child.

18.2 We do not knowingly undertake tracking, behavioural monitoring, or targeted advertising directed at children, which section 9 of the DPDP Act restricts.

18.3 We do not have a verifiable parental-consent mechanism, because we do not intend to offer the Service to children. If you are a parent or lawful guardian and you believe we have processed a child’s personal data, write to hello@penfight.xyz. We will delete the personal data we can identify and discontinue the processing.

19. Personal data breach

If we become aware of a personal data breach, we will, to the extent required by Rule 7 of the DPDP Rules, inform affected Data Principals without delay, in clear language, of the nature, extent and timing of the breach, the likely consequences for them, the measures we have taken or are taking, any steps they should take, and a contact who can answer queries. We will also intimate the Data Protection Board of India as that Rule requires, including a further report within seventy-two hours of becoming aware of the breach (or any longer period the Board allows).

20. What we do not collect

We do not ask for a telephone number, school, photograph, or contacts. We do not turn on the microphone or the camera. Sounds you hear are files we play, not a recording of your surroundings. We do not read the contents of a WhatsApp community. We do not use personal data to make an automated decision that produces a legal effect other than applying the published game rules to a Match Record.

21. Changes

21.1 We may update this Privacy Policy. The effective date at the top will change. The updated notice applies from that date. Material changes will be indicated on the Service where reasonably practicable.

21.2 A new advertising network, a new analytics or replay identifier, a new sign-in method, or a new category of personal data is a material change and will be added to the itemised table before that processing begins, except where a legal obligation requires us to process first and notify after.

21.3 Under the IT Rules, 2021 we will also inform users of a change to this policy at least once in every year of use, including by keeping this page current.

22. Contact

Publisher of https://penfight.xyz/
Email: hello@penfight.xyz

Also see the Terms of Use.