ALPHA
Mishai Privacy Policy
Updated September 16, 2026.
Mishai is an original strategy game operated by Benjamin Gabbai under Shadow Rebbe Productions. This notice explains how the Mishai website handles sign-in information, profiles, games, and website usage data.
Contact: bugs.mishai@shadowrebbe.com.
Google sign-in: access and use
When you choose Google sign-in, Mishai uses Supabase Authentication to receive your Google account identifier, email address, and basic profile information, including your name and profile picture if supplied. These identify and authenticate your account and allow you to connect Google to an existing Mishai profile. Mishai does not request access to your Gmail messages, Google contacts, Google Calendar, or Google Drive. Your Google password is entered only with Google, never with Mishai. Your public Mishai handle, display name, and uploaded avatar are chosen separately; connecting Google does not replace them.
Storage and service providers
Supabase stores account and authentication information, including linked-provider identity information, and the profile and game records described below. Browser session credentials keep you signed in. The website hosting infrastructure processes requests and may keep operational or security logs. Google processes Google sign-in and, separately, website analytics. These providers process data to supply their services. Mishai does not sell Google sign-in data or use it for advertising targeting. Private sign-in emails and provider identifiers are not displayed in the lobby or shared game replays.
Guest mode requires no account. Easy and Medium guest games upload usage statistics, but not full move transcripts. Challenging uploads its completed games for engine research, as described below.
Guest games
An unfinished guest game is stored in this browser so a refresh can restore it. It is removed when the game ends. Clearing browser data can remove it earlier.
Practice and saved analysis
Practice runs analysis on your device when you request it. It saves your branches and completed analysis on the site. Your branch tree is private to your account; guest practice uses a random browser cookie to reconnect to its saved work. Clearing that cookie disconnects guest work but does not itself erase the server copy. Guest work is not automatically transferred when you sign in.
New completed analysis is automatically contributed to a shared bank, including positions, their move history, suggested continuations, evaluations, reported depth and reported node counts. Bank results are shown to other players without your name, account ID or browser identifier. The site internally retains the contributor identifier so you can remove your contributions. Browser reports are labelled unverified and can guide Practice search ordering; they do not supply trusted scores to the playing engine. Earlier private caches are not automatically shared. Use Delete line to remove a variation, New practice to replace your branches, and Clear saved analysis to remove your private cache and bank contributions. Deleting a line alone keeps position analysis. Other players may already have copies of a bank result in their open browser. Deleting an account also deletes its Practice data from the live database. Backups and service logs may persist under the hosting provider's retention. Practice results are not automatically used to train the engine or rank other players. Saves are subject to capacity and daily request limits.
Challenging engine research
Completed Challenging games are saved for research whether the computer wins, loses, or draws. This includes guest and signed-in play. Research records contain the move sequence, result, first player, human side, takebacks, engine version, and configured thinking budget. They contain no account identifier, name, avatar, or email. They are retained separately from your profile, including after account deletion.
Saved account computer games and participant game records may also be used to test and improve Mishai's computer. Research exports remove profile details; published strategy examples do not identify players. A loss is an observation, not proof that its final moves were mistakes. The last five individual moves are flagged for review, and the complete game can be examined. Lessons affect play only after a bounded review and testing process; the site does not run continuous background training.
Research batches are queued after every five and twenty eligible games. Reviews run only on the site owner's computer after explicit approval. Saved review reports contain game references, move analysis, and experimental results, without player profile details. A guest's device does not run these additional reviews.
Pending uploads remain in this browser and retry when you return to computer play or reconnect. Clearing browser data can remove unsent records. A daily hash of the connection address limits submissions and expires on a later upload. Game records must replay legally, but browser games are not independently verified as human play. Uploads are subject to free-service capacity.
Accounts and saved games
Signing in with X or Google creates or accesses a Mishai account. Supabase processes the provider’s identifier, email address, and available profile information, such as a name, handle, or profile picture. Your Google and X passwords are never sent to Mishai. Supabase can link sign-ins with matching verified email addresses. You can also connect another sign-in method from My Profile, keeping the same account and game history. Mishai requests Google identity and basic profile information, not Gmail, contacts, or calendar access. Profiles and game records are stored in Supabase in Northern Virginia. Your avatar, display name, and handle are shown to opponents and, when you deliberately enter the lobby, to other lobby players. Statistics and game histories are private. Player-game records are accessible to their participants; either participant may create a public replay link and revoke only their own links. Public replays include the players’ displayed identities and the complete move record.
Delete account removes your authentication account, profile, and avatar from the live database. Gameplay records are retained, including computer games and opponents’ records, with the removed profile displayed as Deleted Player. Links created by the deleted account are revoked; the opponent’s links remain under their control. Previously downloaded copies cannot be recalled. Infrastructure logs and backups may remain until their retention periods expire. Pending computer-game uploads may be stored in your browser and retried while signed in; deletion clears these copies in the browser you use for deletion.
Reopening email list
If player games reach capacity, you may leave an email address to hear when Mishai reopens. These addresses are stored privately in the website’s separate database and are accessible only to the operator. We use a daily, short-lived hash of the connection address to limit automated submissions; it is not included in the email list. We do not automatically subscribe you to a newsletter.
Website analytics and browser storage
Mishai uses Google Analytics to understand visits and how pages are used. It can collect page addresses, referring pages, interaction events, browser and device information, and approximate location, and may use cookies or similar identifiers. This is separate from signing in with Google. Mishai does not intentionally send your sign-in email, Google profile, or game move records to Analytics. The sign-in callback page is excluded from Analytics initialization. Browser storage is also used for sign-in sessions, preferences, unfinished guest games, and pending game uploads. Clearing it can sign you out and remove local records; it does not delete records already stored on a server.
We also collect first-party usage statistics: visits, tutorial progress, practice use, computer-game starts and results, move counts, takebacks, approximate active time, device category, referral source, and error occurrence. A random browser identifier estimates guest visits; when you sign in, a pseudonymous link helps avoid counting you twice. This analytics link does not transfer guest games into your account history. Reports compare guests and signed-in players. These statistics contain no email address, name, avatar, or full game transcript. Registration dates are used for signup counts. Historical pseudonymous statistics are retained separately from account profiles. Clearing browser storage resets the browser identifier but does not erase previously collected statistics.
Your choices and contact
You can play the computer without signing in. Edit your chosen display name and avatar from My Profile. Delete account in Edit profile removes your authentication account, linked sign-in information, public profile, and avatar from the live database; gameplay retention and infrastructure backups are explained below. You can also revoke Mishai’s Google access through your Google Account’s third-party connections settings. Revoking access does not itself delete your Mishai account or saved games. For privacy questions or data requests, contact Benjamin Gabbai at bugs.mishai@shadowrebbe.com. If you email us, your message and contact details are used to respond and handle your request.