The small print
Privacy
Last updated 27 July 2026
Who runs this
OneTwo is run by an individual developer based in the Netherlands. For anything in this statement, email onetwofootie@gmail.com.
What we store
There are no accounts. When you first play, your browser gets a random ID in a signed cookie — that ID is what your streak, daily plays, blitz times and optional display name hang off. It says nothing about who you are.
We also keep coarse visit statistics per browsing session: approximate location (country/region/city as reported by our hosting provider’s network — we never see or store your IP address), device type, browser and OS family, the external site that referred you, and which pages you viewed. Automated/bot visits are discarded.
Why (legal bases)
Game state exists to provide the game you asked for (performance of our service). Visit statistics exist to understand whether the game works and where players come from (legitimate interest). We don’t profile you, there is no third-party analytics or advertising on this site, and nothing is sold or shared.
Cookies
| Name | Purpose | Lifetime |
|---|---|---|
| cpa_uid | Signed random ID that keeps your streak and plays together. Strictly necessary — there are no accounts. | 1 year |
| cpa_gate | Remembers that you entered the beta passphrase (only while the site is invite-only). | 90 days |
| cpa_admin | Keeps the site owner signed in to the admin dashboard. Never set for players. | 30 days |
All of these are functional, first-party cookies — the kind Dutch law (art. 11.7a Telecommunicatiewet) does not require a consent banner for. There are no tracking or advertising cookies.
Retention
Visit statistics are kept for at most 12 months. Gameplay records stick around so your streak and the leaderboards keep working. Delete the cookie and the ID it pointed at is orphaned — nothing left links to you.
Your rights
Under the GDPR you can ask for access, correction, deletion, restriction or a copy of data tied to your ID — email us with the ID cookie value and we’ll handle it. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Where the data lives
The site runs on Vercel and the database on Neon; both act as processors for us and may process data in the EU and the US under standard contractual safeguards.