Legal · Updated 29 September 2026

Privacy policy

Play without an account or your real name. We collect the minimum information needed to run the game, keep it reliable and prevent misuse.

The short version

Computer games stay on your device. Friends can see your chosen nickname and the public actions in their room, but not your hidden cards. There is no public chat, location sharing or player directory. Please use a nickname and share room links only with people you trust.

Who is responsible?

Four Card Golf is operated by HUGO.FM Limited, registered in England and Wales, company number 11911713. Registered office: 55 Station Road, Manningtree, Essex, England, CO11 1EB. For support, privacy requests or other enquiries, use the HUGO.FM contact form and mention Four Card Golf.

HUGO.FM Limited is the controller of the personal information described here.

What we use and why

  • Friends games: your nickname, room membership, cards, game actions, current state and an anonymous reconnect token let us operate your requested game. Other room members see only information permitted by the rules.
  • Device storage: a reconnect cookie recognises your seat. Your selected appearance and an unfinished computer game can be saved in your browser. The saved computer game is not uploaded to our game database.
  • Reliability: error reports contain a reference number, time, release, general page or action, error description and limited technical context. We do not intentionally include hidden hands, cookies, session tokens or room codes in these reports. Automatic filters remove obvious email addresses, IPv4 network addresses and identifiers, but cannot detect every personal detail in free text. Do not include personal information when reporting a problem.
  • Abuse prevention: the hosting provider receives connection information, including an IP address, to deliver and protect the service. Our application uses a salted, regularly changing hash of that address for short-lived request limits; it does not keep the raw IP in its rate-limit database.
  • Aggregate counters: we count actions such as starts, completed holes and failed joins by day and mode. These counters contain no visitor ID, room code or behavioural profile.
  • Enquiries: information you choose to send through the HUGO.FM contact form is used to respond. That form has its own privacy notice.

Our legal bases

We use information necessary to provide the game you request to perform our agreement with you. We rely on legitimate interests for proportionate security, debugging and service-improvement measures, balanced against players’ privacy, including children’s interests. Where optional services require consent, they will not operate without the required consent. We do not sell your personal information.

How long information stays

Friends rooms become unavailable after 48 hours without a saved game update. The reconnect cookie lasts up to seven days after its last refresh. The error dashboard shows the most recent 30 days; aggregate counters are retained for up to 90 days. Request-limit records expire within an hour. Expired database records are removed by routine cleanup triggered by site activity, so physical removal can occur later when there is no traffic.

A saved computer game expires after seven days and is removed when you next visit, finish it or clear it. Appearance preferences remain until you reset or clear your browser storage. You can clear both through Help & privacy. Hosting providers may keep separate security logs or backups under their own retention arrangements.

Providers and international processing

The website uses OpenAI Sites hosting, running on Cloudflare Workers and Cloudflare D1. These providers process information needed to deliver, store and protect the service. Providers and their infrastructure may be outside the UK. Where UK data protection law requires safeguards for international transfers, we must ensure the applicable safeguards are in place. Contact us for information about the arrangements relevant to your request. We may also disclose information where required by law or to protect legal rights.

Advertising

Google advertising is not currently enabled. Preparing the site for Google review does not load advertising scripts. Before ads are introduced, we will update this notice with the services used, provide the required consent and privacy controls, and apply family-friendly category restrictions. There is currently no advertising profiling or optional tracking on the game.

Children and families

The game is designed for casual play, with the same privacy-protective defaults for everyone. We do not ask for ages, real names, contacts or precise locations, and do not offer public messaging. Parents or guardians can contact us about a child’s information. A nickname or problem report can still be personal information: avoid identifying details.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability of your personal information, or object to processing based on legitimate interests. You can withdraw any consent without affecting earlier lawful processing. Use the contact form; we normally respond within one month. We may need proportionate information to verify a request, but never send us your reconnect cookie or password. With no named player accounts, we may be unable to link anonymous activity to you.

You can complain to the UK Information Commissioner’s Office or your local supervisory authority. Please contact us first if you would like us to try to resolve a concern.

Changes

We will update this page when our practices change, and provide additional notice or choices where required. See also our cookies and storage notice and terms of use.