Last updated: 4 October 2026
Gamah, the developer of Rotaliate on Steam ("we"), runs Rotaliate. This covers the Steam game and every service operated from rotaliate.io or its subdomains. A Steam account is the same account in every Rotaliate client. We keep the minimum needed to run the game, its leaderboards and fair play.
From Steam, at every sign-in: your Steam ID, your public persona name and your avatar link. Each sign-in replaces the previous name and avatar. We never see your Steam password or email.
From playing: each game's board, start and finish times, move count, result and placement, and the full log of every move you sent, selector movements included, each with the millisecond it reached us. In multiplayer, the log records which player made each move. The move log is what lets a game be replayed, and what we check a run against.
Sign-in tokens: a random token that lasts 24 hours. We store only a hash of it.
Network: your IP address is used to limit request rates and may appear in server logs, kept for up to 90 days.
If you send feedback on the website: your message, and your email address if you give one. Feedback is kept after the account that sent it is deleted, without the link to that account.
On the website: your browser keeps your player name, your settings, and an account key: a random code our server gives the browser on its first visit, which signs it in as you after that. The key is not your Steam ID, and anyone who has it can play as you. All of this stays in your browser until you clear its site data. We use no cookies, analytics or advertising trackers.
Your settings (key bindings, colors, sound, music) are saved on your computer and synced by Steam Cloud, which Valve operates. Achievements and stats are stored by Valve. Valve's privacy policy covers those.
Our API is public: anyone, player or not, can read what the game shows, and can collect it.
/profile/<Steam ID>): anyone who knows your Steam ID sees your 20 most recent
games: mode, board, time, moves, placing and when you finished.Your internal account ID is never shown.
To run the game, keep leaderboards, show replays, and detect and act on cheating (EULA §3). Where a law asks for a legal basis: performing our agreement with you, and our legitimate interest in fair leaderboards.
Nobody we sell to; we sell nothing.
Our hosting provider stores everything above on servers in the United States. We may disclose it if the law requires.
Game records and replays: as long as the game runs, unless you ask for deletion. Accounts used without Steam (guests) and their games are deleted after 30 days without play. Records of enforcement action are kept as long as they are needed to enforce it.
Email rotaliate@gamah.net with your Steam profile link to see what we hold about you, correct it or have it deleted. Deleting an account removes its games from leaderboards and replays. You must be old enough to hold a Steam account (at least 13, or older where your country requires it) to play.
We will post changes here and update the date above. A material change will be shown in the game.