Privacy Policy

Last updated: October 15, 2026

1. Who we are

Al3ab Hub is a small, independent studio making social games in Tunisia. This policy covers al3ab-hub.com and its game sites: Football Duel (football.al3ab-hub.com), Dream XI (dreamxi.al3ab-hub.com), Belote (belote.al3ab-hub.com), Chkobba (chkobba.al3ab-hub.com) and Rayech Sahbek (rayechsahbek.al3ab-hub.com). “We” and “us” mean al3ab-hub.

2. What we collect and why

Anonymous visit statistics (our own, no third party)

To know how many people play and what to improve, our own server counts:

• pages viewed, the type of device (phone or computer), the site you came from, and game events (for example “a match started” or “a match ended”);
• a random visitor code stored in the cookie al3ab_vid (1 year), so one person visiting twice in a day counts once;
• if you arrived through a content creator's link (?ref=…), that creator's code in the cookie al3ab_ref (90 days), so we can thank the creators who bring players;
• a list of the last 300 finished matches: the in-game names of the two players, their decks, the winner, and the number of turns.

These statistics do not contain your email or IP address. Our server briefly sees your IP address when you connect, as every website does, and uses it in memory only to block abuse (for example too many sign-in attempts); it is not stored.

Your account (optional, Football Duel)

If you create an account, we store what is needed to run it:

• your nickname, email address and password (stored only as a secure scrypt hash, never in plain text), or, with Sign in with Google, the name, email and profile picture Google shares with us;
• your chosen avatar, saved decks, match history, online rating and leaderboard position;
• whether you agreed to receive news about our games (off unless you tick the box), and which creator link you arrived with, if any;
• a sign-in cookie fd_session (secure, HttpOnly, 180 days) that keeps you signed in.

Your nickname, avatar and results are visible to other players on the leaderboard and in online matches. Your email is never shown to other players.

Online matches

When you play online, your nickname, deck and moves are passed to your opponent (and, in public matches, to spectators) so the match can be played. They are kept in our server's memory only while the match lasts.

Online now and challenges (Football Duel)

While Football Duel is open, other visitors can see your nickname, your avatar, your online rating (if you have an account) and whether you are in a match, so they can challenge you to a duel. You can switch this off at any time with Show me online on the home page; you then also stop receiving challenges. Nothing about it is stored: you leave the list when you close the page.

Chat and voice chat (Football Duel)

Chat messages are passed to your opponent (and, in public matches, to spectators) like your moves, and are not stored after the match. Rooms with friends can also use voice chat: your microphone stays off until you tap 🎤 and allow it in your browser, and you can turn it off at any time. Your voice goes directly to the other player's device, encrypted. When a network blocks direct connections, it passes through our relay server, which only forwards the encrypted audio: it cannot listen to it and nothing is recorded. Voice chat is not available in public matches with strangers.

Bug reports and card ideas

If you send a report or a card idea, we keep what you write, the contact you choose to give (optional), and, if you leave the box ticked, details about the match and your browser (screen size and browser name) so we can reproduce the problem.

Stored on your device only

The games save some things in your browser's local storage so they work smoothly: sound and music settings, your name, decks you build as a guest, the tutorial progress and the match in progress (so refreshing the page doesn't lose it). This stays on your device and is not sent to us, except your decks once you sign in.

3. Advertising (Google AdSense)

Our pages show ads served by Google AdSense, which helps us keep the games free.

• Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our sites and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.
• Learn more in How Google uses information from sites or apps that use its services.

Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for their consent before personalised ads are shown, through Google's consent message. You can change your choice at any time from that message.

4. Cookies at a glance

You can delete cookies in your browser settings at any time. The games still work without them; you will simply be signed out.

5. Who else receives data

• Our hosting provider (OVHcloud), whose servers run our sites and store the data described above.
• Google, if you choose Google sign-in, and for the advertising described in section 3.

We do not sell, rent or trade your personal data, and we only send you news emails if you asked for them.

6. How long we keep it

• Visit statistics: up to 400 days, as daily totals.
• Accounts, decks and match history: until you ask us to delete your account.
• Bug reports and card ideas: until they are handled, then they may be deleted.
• Backups: 30 days.

7. Your rights

You can ask to see, correct or delete your personal data, or withdraw a consent you gave. You can change your nickname and avatar yourself in Settings. To delete your account or make any other request, contact us (section 9); we answer within 30 days. These rights apply under Tunisian data protection law (Organic Law No. 2004-63) and, for visitors in the European Union, the GDPR.

8. Children

Our games are for everyone, and no account is needed to play. Accounts are meant for players aged 13 or over; younger players should only create one with a parent's permission. If you believe a child has given us personal data without permission, contact us and we will delete it.

9. Contact us

For any privacy question or request, use the 🐞 Report a bug form in Football Duel (home screen or the 🐞 button during a match), choose Account / sign-in, write “Privacy request” and leave an email or Instagram handle so we can reply.

10. Changes

If this policy changes, we update this page and the date at the top. Important changes are also announced on our sites.

Player names. Football Duel is an independent fan game. It is not affiliated with, endorsed or sponsored by any player, club, league or federation. All card artwork is original; player names are used only to identify them.