Unofficial fan project, not affiliated with CD PROJEKT RED or Weird Co.
Play

Your data

Privacy

Go Solo is a hobby project. Accounts are optional. It has no ads, and nothing is sold or shared with advertisers. Google Analytics runs only if you accept it in the cookie banner; without that, no analytics cookies are set and nothing is sent to Google. This page lists, in plain terms, what is stored and why.

Who is responsible

Go Solo (go-solo.online) is a private, non-commercial fan project based in Poland. Contact: cyberpunk.polska.kontakt@gmail.com

He decides what is collected on this site and in the game and why (the controller of your data under the GDPR). Write to the address above about anything on this page.

This website

The pages on go-solo.online outside the game are plain static pages and load fonts from our own server. Unless you accept Google Analytics (see below), they set no cookies and the only thing they keep in your browser is your cookie choice (the game’s storage is listed below). Like any website, the hosting provider handles your request to deliver the page.

A small script of our own counts page views anonymously, whatever your cookie choice. For each page you open it sends our server one event with:

  • the section of the site (for example the card list, a card page, the decks, the FAQ or the news) and, on a card page, the card’s short name from its address;
  • where you came from, only when you arrive from another website: its domain (for example www.google.com) and a group (Google, Bing, DuckDuckGo, other search engine, social site, other website, or no referrer). The full address of that page and anything after the domain, such as a search query, is never sent or stored. Moving between our own pages sends no referrer;
  • the device class: phone, computer or home-screen app;
  • a two-letter country code when our network provider supplies one.

When you click a link from these pages into the game (such as Play now or the deck builder button), it sends one more event with the kind of link and the section you clicked it in. No cookie, ID or full address is sent, and the visitor is counted with the same daily-changing fingerprint as the game’s visits (see below).

Google Analytics (only with your consent)

If you click Accept analytics in the cookie banner, the site and the game use Google Analytics 4 to count visits and see which pages and features are used. It is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). Until you accept, its script is not loaded at all and nothing is sent to Google. If you reject or ignore the banner, Google Analytics stays off and the game works the same.

When you accept:

  • your browser loads Google’s script (gtag.js) from www.googletagmanager.com and sends Google the pages you open (their address without the part after #, and without query parameters such as the text typed into the card search; only campaign tags such as utm_source are kept), the previous page (for another website only its domain), a few game events (a game started, the language switched) and the technical data Google Analytics collects, such as your browser, device type, screen size, language and approximate location derived from your IP address;
  • Google Analytics sets two first-party cookies: _ga, a random ID that tells visits of the same browser apart, and _ga_FZZCDDRSCQ, which keeps the state of the current session. Both last up to 2 years;
  • advertising features, Google signals and ad personalisation are switched off, and the advertising consent signals are always sent as denied;
  • Google keeps the event data for 14 months, then deletes it;
  • Google may process the data in the USA (see Transfers outside the EU below).

You can change your mind at any time: click Cookie settings in the footer of any page (in the game, at the bottom of the home screen) and choose Reject. Google Analytics then stops, its _ga cookies are deleted and the page reloads. Your choice itself is kept in your browser’s local storage as cptcg.consent (accepted or rejected, with the time you chose) so the banner does not ask again; after 12 months it asks again. If you change your choice in one browser tab, other open tabs of the site follow it. More about how Google uses this data: Google Privacy Policy and how Google uses data from sites that use its services.

In your browser

The game keeps a few things in your browser’s local storage, on your device: a random player token (cptcg.token) so the server can recognise you when you reconnect, the language you chose with the EN/PL switch (cptcg.lang), your cookie choice (cptcg.consent), your settings, your saved decks (also kept on our server with your profile, so they follow you to other devices), your last game so you can resume it, an unsent feedback draft, and which tips you have already seen. For the duration of one browser session it also keeps a marker in session storage (cptcg.visit) so a visit is counted only once per session; the browser deletes it when the session ends. When you log in, the server also sets a session cookie (cptcg_sid, needed to keep you logged in, 90 days) and, only during a Google or Discord login, a 10-minute cookie (cptcg_oauth) that protects that login. Neither is used for tracking. Clearing the site data in your browser removes all of it and gives you a new, unrelated player token.

Your profile and account

Every player has a profile on our server with a nickname (generated for you, and you can change it). Without an account the profile is linked only to the random player token in your browser; a guest profile not used for 180 days is deleted. Your decks and your game settings (animations, end-of-turn confirmation, full screen, language) are stored with the profile so they are the same on every device you use; a deleted deck is removed for good after 90 days. We also keep a history of your finished games (date, mode, the Legends of both decks, the result, the number of turns and the length) to show your statistics; your opponent's history keeps the game too, and if you delete your account your nickname is removed from it.

If you create an account, we also store your e-mail address (to log you in, confirm the address and reset your password), a hash of your password (never the password itself), and, if you use Google or Discord, the account identifier and e-mail address they give us. For each login session we keep the time it started, when it was last used and a short device description such as “Chrome / Android”; no IP address is stored with it. Account e-mails are sent through Resend, our e-mail provider. Google and Discord only see that you log in to Go Solo.

In the account screen you can download all of this, decks, settings and game history included, as a file, see and end your sessions, and delete the account. Deleting it removes the profile, the e-mail address, the linked logins and the sessions at once; games other players played against you keep a “deleted player” in their place. Backups of the account database are kept for 7 days.

Anonymous usage statistics

To see how many people play and on what kind of device, the game server records simple events. These are our own statistics: they use no cookies and are recorded whatever your cookie choice. The site operator’s own devices are excluded from all statistics, including Google Analytics, with a technical cookie that holds no personal data.

Events counted with the daily fingerprint (see below), never with your player token:

  • A visit, once per browser session: the device class (phone, computer or home-screen app), your browser language, the language the game is shown in (English or Polish), the website that linked you here (its domain only), an optional campaign tag from the link, and a two-letter country code when our network provider supplies one.
  • During the beta, clicking Play (or Resume) on a computer opens a QR code window and sends one QR event with the same fields as a visit. The window that opens by itself for a room link sends nothing.
  • Using the language switch on the home page: only the direction of the change (English to Polish or Polish to English).
  • Two interface events, with only their name: importing a deck (deckImport) and opening the deck builder (deckBuilderOpen).
  • The page views and link clicks of this website described above.

Events of the game connection:

  • Connecting, with a short ID derived from your player token and whether that token is new.
  • Starting a game, with the same player ID: the mode, the AI level, your choice of who goes first, and your deck’s Legends (as a deck key).
  • Disconnecting, with how long you stayed connected, and the connection’s response times, without any ID.
  • Technical errors and hits on the rate limits, without any ID.

Your IP address is not stored with these events. The daily fingerprint is made from your IP address and a random value that is replaced every day, so the same visitor is counted once per day but cannot be followed from one day to the next. The player ID is derived from your player token, not your name or address; it is never stored together with the daily fingerprint.

Games

Games run on our server. Each game is saved while it is played and for 90 days after it ends, then deleted. A saved game contains the decks, the moves, the player names and the time; players are identified only by a hash of their player token, never by IP address.

Feedback and crash reports

When you send feedback from the game, the server stores what you entered (ratings, comment, and a contact if you chose to leave one) and a short player ID derived from your player token, together with technical details that help fix bugs: which screen you were on, the game version, your local time and time zone offset, device information such as the browser, screen size, language and memory, recent errors, a list of recent screens and actions, performance and connection measurements, your settings and the log of the current game. If you are playing that game, its saved record is attached as well. The feedback form lets you see exactly what is sent before you send it.

If the game hits an error, it sends a crash report with the error message and the same technical details automatically, without a comment or contact.

To stop spam, the server counts reports per IP address for ten minutes in memory. The IP address is not written to the stored report.

Abuse protection

The server limits how many connections, messages and games one address can open in a short time. These limits are kept in memory. When one address opens too many connections at once, the server log records that address so abuse can be investigated.

How long data is kept

Game records are deleted 90 days after the game ends. Usage statistics and feedback are kept in log files that are rotated by size, so the oldest entries are dropped over time; statistics for chosen days can also be deleted by the administrator. The rate limits and the spam counter live only in the server’s memory and are gone within minutes. Google Analytics event data is kept by Google for 14 months; the _ga cookies last up to 2 years in your browser unless you reject analytics or clear them. Everything kept in your browser stays there until you clear the site data.

Legal basis

  • Google Analytics: your consent (Art. 6(1)(a) GDPR), which is also what the rules on storing and reading information on your device require (Art. 5(3) of the ePrivacy Directive and the Polish telecommunications law). You can withdraw it at any time with Cookie settings; this does not affect what was collected before.
  • Our own anonymous statistics, game records, feedback and crash reports, and abuse protection: our legitimate interest in running the game, keeping it working and safe, and fixing its bugs (Art. 6(1)(f) GDPR).
  • The game’s own browser storage (player token, settings, decks, saved game and the other items listed above): strictly necessary for the game to work as you use it, so it needs no consent.

Transfers outside the EU

Google may process Google Analytics data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving an adequate level of protection. Our own statistics, game records and feedback are stored on our server and are not sent to Google.

Your rights

Under the GDPR you have the right to access your data, to have it corrected (rectification) or erased, to restrict its processing, to object to processing based on legitimate interest, to data portability, and to withdraw your consent at any time (for Google Analytics: Cookie settings). Write to the contact address above. Because Go Solo has no accounts and does not know your name, we may need some detail to find your data, for example the time you sent a feedback report. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl).

Questions

If you have a question about your data, write to the contact address above or through the feedback button in the game. Since Go Solo does not know who you are, the simplest way to reset everything on your side is to clear the site data in your browser.

Play Go Solo

Free Cyberpunk TCG in your browser, on your phone or your computer. Play against the AI.