Three in a row wins. Against the bot everything runs in your browser and nothing is sent anywhere. Against a friend the match is refereed by a server that owns the board: it decides whose turn it is and whether a square is free, so a tampered page cannot move twice or play out of turn. Tic tac toe is a solved game, which is why there is no leaderboard for it. Two people who know what they are doing will draw every time, and that is the point.