Privacy & data practices

Participation and release review

This public beta is open to any signed-in member. Sign in with any configured provider, choose a public handle in Settings, and create a private game workspace. No creator invitation or additional linked provider is required.

Drafts are private. Hosted builds must pass ZIP and WebAssembly validation before preview or submission. Creators freeze an exact release and submit it for human moderator review. Publication is manual by default. A creator may explicitly opt in when freezing a release to automatic publication of that exact snapshot on approval, subject to the same publication checks. If those checks fail, neither approval nor publication is committed. Without that opt-in, approval leaves the release private until it is manually published. New metadata or builds require a new reviewed release. Review is not a legal, rights, AI-disclosure or safety certification; validation, review and sandboxing reduce risk but do not guarantee a harmless game.

Information used by the platform

• OAuth identity, private email addresses and session data support sign-in. Email is not public by default; you choose your own handle, display name and bio. Email sign-in links are delivered through Cloudflare Email Service, expire after ten minutes and can be used once. Verification tokens are stored hashed; request limits use rotating pseudonymous network and recipient signals.
• A secure, HttpOnly guest cookie supports this browser’s activity for up to 90 days. The server stores a hash of its secret. Losing it loses guest edit access unless you explicitly claim the activity after login.
• Turnstile verification is separate from guest identity. Guest play grants last 60 minutes and posting freshness is 15 minutes; the CAPTCHA token is not an application session.
• Public ratings, comments and profiles, private drafts, release snapshots, upload processing records, private reports and moderator audit records support the core service and safety operations. Guest credential expiry does not itself erase public ratings or comments.
• Page, launch-request, frame-load and outbound-click signals are labeled aggregates—not proof of a unique person, successful gameplay, purchase or follow. No ad pixels or game-embedded platform tracking are part of this baseline.

Retention and evidence holds

Scheduled cleanup uses these retention windows: uncompleted uploads, 24 hours; failed or sealed source artifacts, seven days, subject to references, backups and holds; guest credential hashes, up to 90 days; play records and raw analytics, seven days; daily aggregates, up to 13 months; rotating network abuse signals, 24 hours; sampled redacted logs, seven days; resolved reports and moderation audit records, 180 days by default. Published games retain current and previous approved builds; retired builds wait at least 24 hours before cleanup and remain subject to backup and hold checks. Backups are eligible for expiry after 30 days unless held.

Cleanup runs asynchronously. Active references, incomplete backups and lawful or security evidence holds can delay removal. These windows are operating cleanup thresholds, not unconditional deletion deadlines; held evidence remains protected.

Your controls

Settings lets members edit their public profile, explicitly link or unlink providers, revoke sessions, claim this browser’s guest activity or request deletion after recent sign-in. Deletion immediately revokes sessions and makes the public profile and creator’s published games unavailable, then schedules personal-data cleanup with a 30-day operating target, subject to lawful holds and backup expiry. Retained thread structure may be anonymized; the target is not an unconditional deletion guarantee.

Creator games run on isolated origins. Browser storage is best effort, not a cloud-save service. Approved outbound links go to independent sites with their own policies. Cloudflare Email Service, Turnstile and OAuth providers process information under their own notices.

Contact and escalation

For support, privacy requests, security concerns, rights or takedown requests, or moderation reconsideration, contact support@aigamelabs.net. Include a relevant public game URL or comment reference and a clear description. For rights requests, explain your ownership or authority to act. Never send passwords, account tokens, signed upload URLs or player/preview ticket URLs. No response-time guarantee is offered during beta.