Privacy Policy

1. Who we are

Gamefinity is run by [OPERATOR LEGAL NAME], [OPERATOR POSTAL ADDRESS] ("we", "us"). We are responsible for your personal data as described here. For any question or request about your data, email [CONTACT EMAIL, e.g. privacy@your-domain].

This policy covers the Gamefinity website, Swipe mode and the games we serve from our separate games domain. The rules for playing are in our terms of use.

2. What we collect

Free play. Playing for fun needs no account. Your progress in free play stays in your browser (see Cookies and storage below). The only thing we learn is that a game started (see Play counts).

Your guest account. It is created automatically the first time you make a ranked attempt or open Swipe mode or your account page. It holds:

a random account ID;
your player name: a generated one such as BraveOtter0421, or one you choose if you are 13 or older;
your age group (under 13, 13–17, or 18 and over), if you tell us;
when the account was created and when it was last used (updated each time your sign-in is renewed);
your sign-in sessions: random tokens we store only in scrambled (hashed) form, with the kind of app they came from (for example "web") and when each was issued, used and expires.

Ranked runs. For each ranked attempt (a single game, the daily challenge or a gauntlet) we store:

the game and its version, your score, time and result, and when the run started and finished;
the level seed our server chose for the run, and the timed checkpoints the game sends while you play;
for a run that could reach the top of a leaderboard, and a small random sample of other runs, a replay: the record of your inputs in the game (taps, clicks and pointer positions inside the game area, keys pressed, letters typed in word games, device tilt in tilt games), with checks of the game's state and how long its frames took;
your browser's engine (Blink as in Chrome, WebKit as in Safari, or Gecko as in Firefox), worked out on your device so we can replay the run on the same engine. We don't store your full browser details;
your best score on each leaderboard, and whether you have used the day's daily attempt.

Fair-play checks. We re-run each replay on our servers to confirm the score. For our longer games we also measure patterns in the replay, such as how fast and how regularly inputs arrive, to spot bots; a run outside the human range gets a flag, stored with your account ID. Runs that reach the top 10 of a leaderboard of those games go to a review queue, where a person can look at your player name, the run and its patterns, and approve the run or hide it, with an optional note.

Play counts. When a game starts, your browser tells us which game it is, and we add one to that game's daily count (the Popular order). To count you at most once every 10 minutes per game, we briefly remember your account ID or, without an account, your IP address (for IPv6, only its first half), and forget it after 10 minutes. The counts are totals per game and say nothing about you.

Technical data. Like every website, our servers see your IP address with each request. We use it to slow down abusive traffic (it expires after a few seconds, at most about 10 minutes) and for play counts as above. We don't store IP addresses in our database or our application logs. Those logs record every error and a small sample (about 1%) of other requests: which part of the site was called, the result, how long it took and, if you are signed in, your account ID.

3. What other people can see

Leaderboards show your player name, rank and score to everyone, on the site and in our public leaderboard data, which also lists your random account ID.
Once a run is verified, anyone who has the run's ID can download its replay (a daily-challenge replay only after that day's leaderboard is final). We don't publish run IDs, but anyone you share a run with can watch it.
Nothing else about your account is public.

4. Why we use it

Under the GDPR and the UK GDPR, these are our purposes and legal bases:

Purposes and legal bases
Purpose	Legal basis
Running your guest account, saving ranked runs, showing your scores and keeping the daily to one attempt	Providing the service you ask for (contract)
Verifying scores from replays, spotting bots and reviewing top runs	Our legitimate interest, and every player's, in fair leaderboards
Slowing down abusive traffic and keeping the service secure (IP addresses, logs, sign-in tokens)	Legitimate interest in security
Counting plays for the Popular order	Legitimate interest in showing which games people enjoy
Asking your age group and keeping younger players on generated names	Legitimate interest in protecting children
Backups	Legitimate interest in not losing your data

We don't use your data for advertising or profiling. A score that fails the replay check stays off the leaderboards automatically; hiding a run for suspected automation is always a person's decision.

5. Cookies and storage on your device

We set one cookie. Everything else is kept in your browser's storage by our own pages, and it stays on your device unless the table says otherwise. None of it is used for advertising or analytics.

Cookies and browser storage
Name	Kind	What it does	How long
gf_rt	Cookie: HttpOnly, Secure, SameSite=Lax, sent only to our sign-in address	Keeps you signed in to your guest account	180 days, renewed each time it is used; removed when you delete your account
gf:session-hint	Local storage	Notes that this browser has a guest account, so pages know to sign you back in	Until you clear your browser's site data
gf:muted	Local storage	Your game sound setting	Until you clear site data
gf:theater, gf:speed:‹game›	Local storage	Your player layout and game speed choices	Until you clear site data
gf:recent, gf:recent-gone	Local storage	Your recently played games for Continue playing (up to 12). To show them, the page asks our server for those games' details	Until you clear site data
gf:pb:‹game›, gf:progress:‹game›	Local storage	Your best scores, stars and play counts in each game on this device	Until you clear site data
gf:store:‹game›:‹key›	Local storage	Data a game saves, such as its settings or unlocks	Until you clear site data
gf:platform-ok:‹game›	Session storage	You chose Play anyway on a device warning	Until you close the tab
gf-outbox	IndexedDB	Finished ranked runs and their replays, waiting to be sent to us	Until sent; anything older than 7 days is removed on your next visit
gf-resume	IndexedDB	The saved state of a long game, so you can continue it	Saves older than 14 days, or beyond the latest 8 games, are removed on your next visit

All of these either make a feature you use work or remember a choice you made. Under the EU and UK rules on cookies, that kind of storage needs no consent, so there is no cookie banner. If we ever add something that needs your consent, we will ask first.

Your guest account lives in this browser. If you clear its cookies or site data, you lose the account and we can't restore it, but its data stays with us (see How long we keep data). To remove it, delete the account on your account page first.

6. Games on our games domain

Each game runs in a frame on its own address on a separate games domain. The games are made by us and can load files only from our own game server. They can't read your sign-in cookie or your account details, and the games domain uses no cookies. When a game saves data, it does so through the main site, in the gf:store keys above.

7. Who else handles your data

We don't sell or share your personal information. There are no ads, analytics, social buttons, embedded videos, outside fonts or third-party scripts on Gamefinity. Two companies process data for us, on our instructions:

Cloudflare, Inc. (USA) runs our domain names and network. Every request to Gamefinity passes through Cloudflare, which sees your IP address, your browser's details and the pages you ask for, caches public pages and blocks attacks. If its bot protection is on, Cloudflare may set its own short-lived security cookie (such as __cf_bm). We may later turn on Cloudflare Turnstile, a bot check when a guest account is created, and store a second copy of our backups with Cloudflare R2; we will update this policy before either starts.
Hetzner Online GmbH (Germany) hosts our servers and database in its data centres in Germany and Finland, and keeps our backups in Hetzner Object Storage.

We may also disclose data when the law requires it, or to protect players and the service from fraud and abuse.

8. International transfers

Our servers and backups are in the European Union. Cloudflare is a US company whose network handles each request in a data centre near you, which may be outside your country. Cloudflare takes part in the EU–US Data Privacy Framework (with its UK and Swiss extensions) and also uses the European Commission's standard contractual clauses.

9. How long we keep data

Your account, runs, replays, fair-play flags and review records: until you delete your account. We don't yet delete unused accounts or old runs automatically.
When you delete your account: your player name is removed at once and the account stops working. Within minutes your leaderboard entries, replays and review records are deleted too. We keep the records of your past runs (games, scores, times, seeds and fair-play results), your age group and the account's dates under its random ID, with no name, so past results and cheat checks stay consistent.
Sign-in tokens: valid for 180 days from their last use; their records are deleted 7 days after they expire.
IP addresses: at most about 10 minutes, for slowing down abusive traffic and for play counts.
Logs: a few size-limited files per service, overwritten as new entries arrive.
Backups: a nightly copy of the database is kept for 14 days, so deleted data leaves our backups within 14 days.
On your device: as the table above says.

10. Your rights

Wherever you live, you can:

delete your account at any time, on your account page or in your Swipe mode profile;
correct your player name on your account page (if you are 13 or older), or ask us to correct anything else;
get a copy of the data linked to your account (access and portability). There is no download button yet: email [CONTACT EMAIL, e.g. privacy@your-domain] and we will send it in a common machine-readable format;
object to how we use your data on the basis of legitimate interests, or ask us to restrict it.

Before we act on a request, we will ask for something that shows the account is yours. We answer within one month. In the EU or UK you can also complain to your data protection authority (in the UK, the ICO).

California residents have the right to know, delete and correct their personal information, and not to be treated differently for using these rights. We don't sell or share personal information and don't use sensitive personal information. You or someone you authorise can make a request at [CONTACT EMAIL, e.g. privacy@your-domain].

11. Children

Gamefinity is a general-audience site of casual games. We don't ask anyone for contact details, show ads or use analytics. We ask for an age group, which we don't verify. Players under 13, and players who haven't told us their age, always keep a generated player name and can't type their own, so nothing they write appears on the leaderboards.

If you are a parent or guardian and want your child's account deleted, use the account page in their browser, or email [CONTACT EMAIL, e.g. privacy@your-domain].

12. Security

All traffic is encrypted (HTTPS). Sign-in tokens are stored only in hashed form, our servers accept web traffic only through Cloudflare, and administrative access goes through a private network. No system is perfectly secure; if a breach affects your data, we will tell you where the law requires it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use your data, we will point it out on the site before it takes effect.

14. Contact

[OPERATOR LEGAL NAME], [OPERATOR POSTAL ADDRESS]. Email: [CONTACT EMAIL, e.g. privacy@your-domain].

The short version