Privacy Policy
Momiji Go v0.1.0 · Last updated 19 September 2026
The short version. Momiji Go has no accounts, no sign-in, no advertising and no game servers of ours. It does not ask for your personal information, and your games are never sent to us or stored anywhere. The site does measure its own audience, and one of the two tools it uses for that — Google Analytics — sets cookies in your browser. Both are described in Counting visits, and neither can see anything you do at the board.
The one exception worth reading about is a two-player game, which connects your browser directly to your opponent's. That is covered in Two-player games.
Who we are
Momiji Go is made and published by BRUNA GOODS LLC ("we", "us", "our"). This policy explains what happens to information when you play the game, and it applies to the game and to these pages.
Questions, requests or complaints about privacy: support@bruna.world.
What we collect
Nothing. We do not ask for your name, e-mail address, age, location or payment details, and the game has no way to send any of them to us. In particular, Momiji Go does not:
- create an account or a player profile of any kind;
- store your games, your settings or anything you do at the board, in your browser or anywhere else (the analytics cookies under Counting visits are the only things written to your browser, and they hold no game data);
- show advertising, or sell or share anything about you with anyone;
- use your microphone, camera or passthrough images;
- record, store or transmit your games.
Your settings — board size, opponent strength, language, music — live in memory for as long as the tab is open, and are gone when you close it.
What stays on your device
The game's code, models, textures, fonts and sounds are ordinary web files, and your browser caches them the way it caches any web page, so that a second visit starts faster. That cache belongs to your browser, not to us, and clearing your browsing data clears it.
In a headset, hand and controller tracking is performed by the headset and the browser. The game receives positions and orientations through the standard WebXR interface and uses them to move your hands in the scene; nothing about your surroundings, your body or your play space leaves the device — except the head and hand positions described below, in a two-player game.
Two-player games
Playing a friend online is peer-to-peer: there is no game server of ours in the middle, and there is no lobby, no chat and no account. It works like this, and these are the only points at which anything about you goes anywhere.
Finding each other
One player hosts a room and reads out a four-digit code; the other types it in. The
code is random, temporary, and tied to nothing about either of you. To introduce the
two browsers, the game uses Trystero,
which carries the WebRTC handshake over public relays, and public STUN servers
operated by Google (stun.l.google.com) and Twilio
(global.stun.twilio.com) to discover the public network address your
connection appears from. Those operators see connection metadata — including your IP
address — under their own privacy policies. They do not see the game.
Playing
Once the two browsers have found each other, everything travels directly between them over an encrypted WebRTC data channel: the moves, the board size, the result of the count, and — several times a second — the position and rotation of your head and hands, so the other player can see you sitting opposite. Nothing else is sent, and none of it reaches us.
What the other player can see
A direct connection means your opponent's device and yours exchange IP addresses. That is how peer-to-peer connections work everywhere, and it is worth knowing before you share a room code with a stranger. Share codes with people you are happy to play with; if you would rather not, play Lord Tsukikage instead — a solo game never downloads the networking code and never contacts a relay.
Hosting
Wherever these pages are served from, the hosting provider may keep standard web server logs — IP address, time, the file requested, browser version — for security and operational reasons. Those logs are created by the host, are not used by us to identify anyone, and are subject to the host's own retention policy.
Counting visits
We measure how many people come to this site, so that we know whether anyone is playing. Two tools do that, and neither of them can see your games: no move, no board position, no room code and no opponent is sent to either one.
Vercel Web Analytics
Run by our host as part of serving the site. It sets no cookies and writes nothing to your browser. It records the page, the referring site if there was one, and the country, operating system, browser and device type your request arrived with. To tell one visit from another without identifying anyone, Vercel derives a hash from the request — including its IP address — together with a salt that is discarded and replaced every day. The IP address itself is not stored, and once the salt rotates the same visitor is no longer recognisable as the same visitor.
Google Analytics
We also use Google Analytics 4 (property G-G3Q297N7F), provided by
Google. Unlike the above, it sets cookies — first-party cookies
named _ga and _ga_…, which Google uses to recognise
a returning browser and which last up to two years unless you clear them. It also
receives the page you are on, the referring site, your approximate location derived
from your IP address, and your device, browser and language. Google acts as our
processor for this, handles the data under
its own privacy policy, and may process it outside your
country, including in the United States.
If you would rather not be counted by it, Google publishes a browser opt-out add-on; any tracker blocker or a browser set to refuse third-party scripts will also stop it, and clearing your cookies removes what it has stored. The game plays exactly the same either way — nothing about it depends on being measured.
We look at totals: how many views a page had, roughly where in the world from, on what sort of device. We do not try to identify individual players, and we do not combine this with anything else.
Children
Momiji Go is not directed at children under 13, and we do not knowingly collect personal information from anyone — of any age. If you believe a child has sent us personal information, write to support@bruna.world and we will delete whatever we have. Virtual reality headsets carry their own manufacturer age requirements; please follow them.
Your rights
Depending on where you live, you may have rights under the GDPR, the UK GDPR, the CCPA/CPRA or similar laws to access, correct, delete or port your personal data, and to object to its processing. Because we hold no personal data about you, there is in practice nothing to access, correct, delete or port — but you are welcome to write to support@bruna.world and ask, and we will answer. We do not sell or share personal information, because we do not have any.
If you correspond with us, we will hold that correspondence for as long as it takes to deal with it, and no longer than we need to.
Changes to this policy
If the game changes in a way that changes this policy — a leaderboard, an account, a purchase — we will update this page and the date at the top of it before that change ships. Material changes will be noted in the game's release notes.
Contact
BRUNA GOODS LLC
support@bruna.world