Privacy policy

1. Who we are

Gamefinity is run by [OPERATOR LEGAL NAME], [OPERATOR POSTAL ADDRESS] ("we", "us"). We are responsible for your personal data as described here. For any question or request about your data, email [CONTACT EMAIL, e.g. privacy@your-domain].

This policy covers the Gamefinity website, Swipe mode and the games we serve from our separate games domain. The rules for playing are in our terms of use.

2. What we collect

Free play. Playing for fun needs no account. Your progress in free play stays in your browser (see Cookies and storage below). The only things we learn are that a game started (see Play counts) and, if you press Share, that a result was shared (see Shares).

Your guest account. It is created automatically the first time you make a ranked attempt or open Swipe mode or your account page. It holds:

• a random account ID;
• your player name: a generated one such as BraveOtter0421, or one you choose if you are 13 or older;
• your age group (under 13, 13–17, or 18 and over), if you tell us;
• when the account was created and when it was last used (updated each time your sign-in is renewed);
• your sign-in sessions: random tokens we store only in scrambled (hashed) form, with the kind of app they came from (for example "web") and when each was issued, used and expires.

Ranked runs. For each ranked attempt (a single game, the daily challenge or a gauntlet) we store:

• the game and its version, your score, time and result, and when the run started and finished;
• the level seed our server chose for the run, and the timed checkpoints the game sends while you play;
• for a run that could reach the top of a leaderboard, and a small random sample of other runs, a replay: the record of your inputs in the game (taps, clicks and pointer positions inside the game area, keys pressed, letters typed in word games, device tilt in tilt games), with checks of the game's state and how long its frames took;
• your browser's engine (Blink as in Chrome, WebKit as in Safari, or Gecko as in Firefox), worked out on your device so we can replay the run on the same engine. We don't store your full browser details;
• your best score on each leaderboard, and whether you have used the day's daily attempt.

Fair-play checks. We re-run each replay on our servers to confirm the score. For our longer games we also measure patterns in the replay, such as how fast and how regularly inputs arrive, to spot bots; a run outside the human range gets a flag, stored with your account ID. Runs that reach the top 10 of a leaderboard of those games go to a review queue, where a person can look at your player name, the run and its patterns, and approve the run or hide it, with an optional note.

Play counts. When a game starts, your browser tells us which game it is, and we add one to that game's daily count (the Popular order). To count you at most once every 10 minutes per game, we briefly remember your account ID or, without an account, your IP address (for IPv6, only its first half), and forget it after 10 minutes. The counts are totals per game and say nothing about you.

Shares. When you press Share on a result, your browser tells us which game it was (or the daily challenge, or a gauntlet) and whether you used your device's share menu or copied the link, and we add one to that day's share count. A shared link ends in ?ref=share. When someone opens it, their browser tells us which page it was, we add one to that day's count of visits from shared links, and the page removes ?ref=share from the address bar. Neither message carries an account ID, and we never learn where or with whom a link was shared.

Returning players. From the ranked runs we already store, we count for each game and day how many accounts played it, how many of them had also played it the day before, and how many ranked games were finished. Only these totals are shown, on a private page for us; no list of players is made. Free play has no account, so it is not counted this way.

Page visits (from 16 October 2026). When you open a page on gamefinity.io, your browser tells our own statistics tool (Umami, running on our servers, not a third-party service) the page's address and title, the address of the page that sent you there, your browser, operating system and device type, your screen size and language. Cloudflare adds the country your connection comes from. To count how many different people visit in a day, the tool combines your IP address and browser details with a secret value that changes every day and keeps only the scrambled result, a visitor ID that can't be turned back into your IP address and can't follow you from one day to the next. Your IP address itself is never stored, no cookie is set and nothing is saved on your device. The game itself (on our games domain) sends nothing to it, and if your browser sends a Do Not Track signal, the page sends nothing at all. Only we see these statistics.

Technical data. Like every website, our servers see your IP address with each request. We use it to slow down abusive traffic (it expires after a few seconds, at most about 10 minutes) and for play counts as above. We don't store IP addresses in our database or our application logs. Those logs record every error and a small sample (about 1%) of other requests: which part of the site was called, the result, how long it took and, if you are signed in, your account ID.

3. What other people can see

• Leaderboards show your player name, rank and score to everyone, on the site and in our public leaderboard data, which also lists your random account ID.
• Once a run is verified, anyone who has the run's ID can download its replay (a daily-challenge replay only after that day's leaderboard is final). We don't publish run IDs, but anyone you share a run with can watch it.
• Nothing else about your account is public.

4. Why we use it

Under the GDPR and the UK GDPR, these are our purposes and legal bases:

We don't use your data for advertising or profiling. A score that fails the replay check stays off the leaderboards automatically; hiding a run for suspected automation is always a person's decision.

5. Cookies and storage on your device

We set one cookie. Everything else is kept in your browser's storage by our own pages, and it stays on your device unless the table says otherwise. None of it is used for advertising or analytics, and counting plays, shares, page visits or returning players adds nothing to it.

All of these either make a feature you use work or remember a choice you made. Under the EU and UK rules on cookies, that kind of storage needs no consent, so there is no cookie banner. If we ever add something that needs your consent, we will ask first.

Your guest account lives in this browser. If you clear its cookies or site data, you lose the account and we can't restore it, but its data stays with us (see How long we keep data). To remove it, delete the account on your account page first.

6. Games on our games domain

Each game runs in a frame on its own address on a separate games domain. The games are made by us and can load files only from our own game server. They can't read your sign-in cookie or your account details, and the games domain uses no cookies. When a game saves data, it does so through the main site, in the gf:store keys above.

7. Who else handles your data

We don't sell or share your personal information. There are no ads, third-party analytics, social media buttons, embedded videos, outside fonts or third-party scripts on Gamefinity. Our Share button uses your device's own share menu or copies a link, and loads nothing from anyone else. Two companies process data for us, on our instructions:

• Cloudflare, Inc. (USA) runs our domain names and network. Every request to Gamefinity passes through Cloudflare, which sees your IP address, your browser's details and the pages you ask for, caches public pages and blocks attacks. If its bot protection is on, Cloudflare may set its own short-lived security cookie (such as __cf_bm). We may later turn on Cloudflare Turnstile, a bot check when a guest account is created, and store a second copy of our backups with Cloudflare R2; we will update this policy before either starts.
• Hetzner Online GmbH (Germany) hosts our servers and database in its data centres in Germany and Finland, and keeps our backups in Hetzner Object Storage.

We may also disclose data when the law requires it, or to protect players and the service from fraud and abuse.

8. International transfers

Our servers and backups are in the European Union. Cloudflare is a US company whose network handles each request in a data centre near you, which may be outside your country. Cloudflare takes part in the EU–US Data Privacy Framework (with its UK and Swiss extensions) and also uses the European Commission's standard contractual clauses.

9. How long we keep data

• Your account, runs, replays, fair-play flags and review records: until you delete your account. We don't yet delete unused accounts or old runs automatically.
• When you delete your account: your player name is removed at once and the account stops working. Within minutes your leaderboard entries, replays and review records are deleted too. We keep the records of your past runs (games, scores, times, seeds and fair-play results), your age group and the account's dates under its random ID, with no name, so past results and cheat checks stay consistent.
• Sign-in tokens: valid for 180 days from their last use; their records are deleted 7 days after they expire.
• IP addresses: at most about 10 minutes, for slowing down abusive traffic and for play counts.
• Daily totals of plays, shares and visits from shared links: 40 days. They are counts per game and say nothing about you.
• Page visit statistics: 13 months, then deleted automatically. They hold no IP address and no account ID, and the visitor ID changes every day.
• Logs: a few size-limited files per service, overwritten as new entries arrive.
• Backups: a nightly copy of the database is kept for 14 days, so deleted data leaves our backups within 14 days.
• On your device: as the table above says.

10. Your rights

Wherever you live, you can:

• delete your account at any time, on your account page or in your Swipe mode profile;
• correct your player name on your account page (if you are 13 or older), or ask us to correct anything else;
• get a copy of the data linked to your account (access and portability). There is no download button yet: email [CONTACT EMAIL, e.g. privacy@your-domain] and we will send it in a common machine-readable format;
• object to how we use your data on the basis of legitimate interests, or ask us to restrict it.

Before we act on a request, we will ask for something that shows the account is yours. We answer within one month. In the EU or UK you can also complain to your data protection authority (in the UK, the ICO).

California residents have the right to know, delete and correct their personal information, and not to be treated differently for using these rights. We don't sell or share personal information and don't use sensitive personal information. You or someone you authorise can make a request at [CONTACT EMAIL, e.g. privacy@your-domain].

11. Children

Gamefinity is a general-audience site of casual games. We don't ask anyone for contact details, show ads or use third-party analytics or tracking. We ask for an age group, which we don't verify. Players under 13, and players who haven't told us their age, always keep a generated player name and can't type their own, so nothing they write appears on the leaderboards.

If you are a parent or guardian and want your child's account deleted, use the account page in their browser, or email [CONTACT EMAIL, e.g. privacy@your-domain].

12. Security

All traffic is encrypted (HTTPS). Sign-in tokens are stored only in hashed form, our servers accept web traffic only through Cloudflare, and administrative access goes through a private network. No system is perfectly secure; if a breach affects your data, we will tell you where the law requires it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use your data, we will point it out on the site before it takes effect.

14. Contact

[OPERATOR LEGAL NAME], [OPERATOR POSTAL ADDRESS]. Email: [CONTACT EMAIL, e.g. privacy@your-domain].