Terms of use & privacy

01The playground and its operator

XO Club at xoclub.games is an expanding-board five-in-a-row game for 2–4 opposing players. The operator and contact for requests is Phạm Huy Hưng, at [email protected].

The current modes are free. XO Club does not accept wagers, run prize redemption or exchange Elo, rankings or match results for money or assets.

These terms describe use of the service. They do not replace licences, conditions for providing online games or the operator’s mandatory legal obligations.

02Playing together

Each player has a symbol and takes turns placing one piece on an empty cell. The server confirms the result so participants share the same board state.

• Make at least 5 consecutive pieces of your own horizontally, vertically or diagonally to win. There is no rule requiring the ends to be unblocked; 4 pieces with two open ends do not yet count as a win.
• The first tap selects a cell; tap the same cell again to confirm. There is no undo for a move already accepted by the server.
• Quick Play lets you use a nickname, create a room and share an invitation link. Friendly rooms do not change ranked Elo.
• Matchmaking prioritises people; after 20 seconds of waiting, XO Bots may fill the remaining seats. Bots are clearly labelled in the room and results.
• Ranked matches allow 30 seconds per turn. Leaving, running out of turn time or remaining disconnected beyond the grace period can end a match as a forfeit.
• A friendly rematch starts only with a full room and everyone’s agreement. Leaving frees a place; rooms with no players are cleaned up.

03Elo and the leaderboard

Sign in with your XO Club username and password to use automatic ranked matchmaking and save your rank. The 2-, 3- and 4-player formats have separate Elo and statistics, each starting at 1,000 Elo.

In ranked matches with only human players, when a player wins on the board, points transfer from each opponent to the winner. The transfer depends on their Elo difference, is divided by the number of opponents and rounded to a whole number. The winner receives the total points lost by the opponents.

• At equal Elo: a 2-player match gives +16/−16; a 3-player match gives the winner +16 and each opponent −8; a 4-player match gives +15 and −5 respectively.
• When a human-only match ends through a forfeit or timeout, the responsible player loses 16 Elo and records a loss. Other players gain no winning points and do not record a loss from that interrupted result.
• Any match containing an XO Bot preserves everyone’s Elo and ranked wins, losses, draws and game totals, including forfeits and timeouts. Its history is still saved separately and labelled as a bot game.
• Without a winner or a forfeit/timeout, no Elo transfers. Quick Play and practice do not add ranked Elo.
• Verified errors or cheating may lead to a correction of affected data with a recorded reason. Affected players may request an explanation and review.

04Accounts and staying safe

Choose an appropriate nickname, keep your password private and sign out on shared devices. Do not impersonate others, trade accounts or use accounts outside your control. The operator does not ask you to email passwords or verification codes.

A guest session belongs to a browser and its cookie. Deleting cookies or switching devices may prevent you from continuing that session. A registered account identifies you again and keeps your rank across devices.

Minors need a parent or legal guardian’s involvement and supervision as required by law. The access methods described here do not replace the operator’s duties concerning player verification, child protection and playtime management. Take regular breaks and stop when playing affects your health or daily life.

05Fair play and respect

Everyone shares responsibility for a safe playground. Do not use XO Club to carry out or assist unlawful activity.

• Do not insult, threaten, harass or discriminate against others, or choose nicknames containing unlawful content or content that harms children or other people’s rights.
• Do not use external bots, assistance software or multiple accounts to cheat in rankings; do not collude, deliberately throw matches or exploit bugs for points. System-matched XO Bots are disclosed practice opponents.
• Do not attempt password guessing, unauthorised access, malware distribution, service disruption or interference with system data and operation.
• Do not wager on matches, sell rankings or attach prize-redemption offers to play. Do not share another person’s personal data without a lawful basis.
• Report bugs or misconduct with the necessary description and evidence. Avoid publicly exposing sensitive information in reports.

06What other players can see

People in a room can see nicknames, symbols, moves and results. The leaderboard shows player names and relevant competition statistics. Avoid putting telephone numbers, addresses or sensitive information in your nickname.

Recipients of an invitation link may join while space and room conditions allow. Share links only with people you want to invite; a link does not verify a participant’s identity or trustworthiness.

07Information collected

XO Club keeps data generated by visits and play. Some records are connected to a player identifier or account, so the statistics are not all anonymous data.

• Account information: player identifier, nickname, username, creation time, account status and a salted scrypt password hash. Login passwords are not stored as readable text.
• Play data: room participants, board state, moves, results, Elo and format statistics, plus administrative action records when accounts are changed.
• Activity data: visits and recent activity times, visit counts, time with the page visible, playing time, a device category based on screen size and the referring hostname if the browser supplies it. This measurement does not collect the referring page’s full path or query string.
• Technical and security data: IP addresses, request information and logs needed for login limits, abuse prevention, troubleshooting and system protection. Infrastructure providers may process connection data when handling requests.
• Cookies and browser storage: maintaining guest or account sessions, linking activity visits and remembering language, appearance and usage preferences.

08Using and protecting information

The operator uses data to provide playing sessions and matchmaking, save results and Elo, protect accounts and handle errors, cheating and support requests. Activity records are also aggregated in an administrative dashboard to observe online users, usage time and website activity.

Administrative access is restricted to authorised people. Hosting, network and technical providers may process data needed to operate the service. Information may also be supplied on a lawful basis or in response to a lawful request by a competent authority. This page does not grant blanket permission for advertising, selling data or sharing it outside disclosed lawful purposes.

Processing must have a legal basis. Where consent is required, the operator must obtain clear consent for each purpose and allow its withdrawal as required by law. Reading this page or remaining silent does not count as consent to every form of processing.

XO Club uses protections for sessions, passwords and access. These measures do not guarantee that every data-loss risk is eliminated. If an incident occurs, the operator must assess it, take corrective action and meet applicable notification duties.

09Retention and data requests

Retention depends on the purpose, dispute handling, security needs and legal obligations. Empty rooms, queues and expired sessions are cleaned up operationally. Leaving a room or deleting cookies does not delete an account, match history or server-side activity records.

The system does not currently automatically erase all accounts and activity histories on a single schedule. You may request information, access, correction, a copy or deletion of your data, withdraw consent, or request restriction of or object to processing to the extent allowed by law, by emailing [email protected].

Include your username or player identifier, the request and just enough information to verify your rights to the data. The operator reviews requests manually and responds with the action taken or the reason it cannot yet be completed. Some information may need to be retained to meet legal obligations or resolve lawful rights and interests. Do not send passwords, verification codes or unnecessary identity documents. You retain your legal rights to complain, bring proceedings and seek compensation.

10Misconduct and mistakes

Depending on the circumstances and evidence, the operator may require a nickname change, correct inaccurate records, revoke login sessions or suspend and restore an account to protect players and the system. Measures must be proportionate, reasoned and recorded. Urgent situations may require restrictions before a full review.

If you disagree, contact support with your account, room code, time and relevant evidence. The operator must review the information and respond. An administrative decision does not remove your right to use legal dispute-resolution channels.

11Interruptions and responsibility

Internet connections, devices and system faults may delay synchronisation or interrupt matches. The operator aims to maintain the service, announce maintenance when possible and review reports of incorrect results. Continuous availability and recovery of every unconfirmed move cannot be guaranteed.

The operator and players remain responsible for their respective conduct and obligations under law. Nothing here excludes the operator’s mandatory responsibilities or your rights to data protection, compensation, complaints or legal proceedings. Ending the service must follow applicable notice requirements and protections for players.

12Getting in touch and changes

Questions and reports about accounts, matches and privacy are received at [email protected]. We favour discussing the issue and reviewing evidence to find a resolution. You may still seek resolution from a competent authority or court under Vietnamese law.

When these terms change, the new version will state its update date and effective time. Important changes will be announced on the website before taking effect. Changes do not automatically create consent for new processing purposes. If you do not accept them, you may stop using the service and submit account or data requests. Existing rights are handled in accordance with law.

These terms are read alongside mandatory legal requirements. If a provision is unenforceable, the rest applies to the extent lawful. If the Vietnamese and English texts differ, the interpretation more favourable to the consumer applies to the extent required by consumer protection law.