Privacy

The short version

• You can play without an account. Playing is measured with a first-party identifier in a cookie. No ad networks, no cross-site tracking.
• An account needs an email address and a handle. That is the whole requirement.
• Games are uploaded by other people and served publicly. We host them; we do not take ownership of them.
• Multiplayer discloses your IP address to the other players in your lobby. That is how peer-to-peer connections work. Turning on relay hides it from them.
• We do not sell your data and we do not run advertising.

Who we are

OpenGame is operated by Vesper Tech, Inc., a Delaware corporation doing business as OpenGame. Questions about anything on this page go to team@opengame.io, which a person reads.

Your account

When you create an account we store:

• Your email address, to sign you in and to send you the handful of emails listed further down.
• Your handle and the OG number issued when you claim it. Both are public and both appear in URLs.
• Your display name, bio, avatar and any links you add. The default avatar is generated from a number, so choosing not to upload one means there is no image of you anywhere.
• Your country, as a two-letter code. We ask because prize eligibility depends on it, not to profile you.
• Your settings: theme, and which optional emails you want. If you opt in to anything, we record the moment you did.

Signing in

Authentication runs on Supabase Auth, on our own auth.opengame.io subdomain. Two ways in:

• A six-digit code by email. The code expires quickly and is invalidated as soon as a new one is sent.
• Google. We ask Google for your email address and basic profile, meaning your name and profile picture, and nothing else. We do not receive your password, your contacts, your Drive, or anything else in your Google account, and we do not post anything on your behalf. You can revoke our access at any time in your Google account's security settings.

Playing a game

No account is needed to play, so we needed some way to tell one visitor from another. That is a random identifier we generate and store in a first-party cookie on opengame.io, mirrored into local storage so it survives. It is not linked to your identity, it is not shared with anyone, and it does not follow you to other websites.

It does three jobs, all of them ours:

• Counting a play once rather than four times when you refresh.
• Remembering that you liked a game so the heart stays filled.
• Stopping one person from repeatedly reporting the same game.

Each play we record:

• Which game and which version of it, and when.
• How long the tab was actually visible and focused, and whether that was long enough to count as a play, and if it did not count, why not.
• Your country, worked out from your connection. Country only, nothing finer.
• The host that referred you, reddit.com rather than the full link, so creators can see where their players came from.
• A broad device description from your browser.

If a game keeps a leaderboard, the score, the name you typed into the game, and whatever the game chooses to display beside the number are stored by us and shown publicly on that board. Those numbers are the game's own claim. See the jam rules.

Multiplayer, and your IP address

Multiplayer games connect players directly to each other. Making that connection requires each player's device to tell the others how to reach it, which means your IP address is disclosed to every other player in the lobby. This is how peer-to-peer works in every browser rather than anything specific to OpenGame, but it is easy to be unaware of, so: an IP address is roughly a city and an internet provider, and someone technical can read it out of a connection you are part of.

We run a relay for this reason. When a game routes through it, other players see the relay's address instead of yours, and we see the traffic pass through instead. The lobby tells you which mode you are in. If you would rather not be in a lobby with strangers, do not join one.

Our signalling broker briefly holds the lobby code, the peers connected to it, and the messages needed to set up the connection. None of it is written to a database and it disappears when the lobby does.

Uploading a game

Published games are public. The files you upload are served to anyone with the link, from a separate domain reserved for exactly that. Alongside the bundle we store what you tell us about it, and what our checks find:

• Your submission: title, description, cover art, screenshots, the track you entered, and the version history of every build you upload.
• Validation output. We run your game in a sandbox: screenshots at five window sizes, a short capture, frame rate, memory, and a log of every network request it attempted. Reviewers see all of it.
• Your attestations. When you tick “I own the rights to this” and the others, we record each one separately with a timestamp, the exact text you agreed to, your browser's user agent, and a hash of your IP address rather than the address itself. These exist for one purpose: if a rights holder complains, or a result is disputed, we can show what was claimed and when.
• Review decisions: who decided what, when, and why. This log is append-only and is not deleted with your account.

Analytics

We use PostHog to understand how the site is used, served through our own domain rather than loaded from theirs. Specifically:

• Named events only. Automatic capture of every click is turned off; we send a defined list of events such as a play starting or a submission step being completed.
• Profiles for signed-in people only. Anonymous players are counted, not profiled.
• Session recording is limited to the submission flow, the upload wizard, where people get stuck and we need to see why. It is not used on gameplay. The game runs in a frame from another domain, which the recorder cannot see into even in principle, and we do not record the pages around it either.
• Errors are captured here too, so a crash reaches us without a separate tool.

Games themselves cannot send anything to PostHog. They are not permitted to reach it, which is deliberate: an event from a game would be indistinguishable from one of ours.

Email

Mail is sent through Resend. Sign-in codes, a welcome note, and the messages that tell you your entry was received, needs a change, or is live. Those are transactional. You cannot unsubscribe from a sign-in code you asked for. Anything else, such as a jam reminder or a digest, is optional and has an unsubscribe link that works.

We log what we sent, to which address, and whether it was delivered, bounced or opened, so that “I never got the email” is a question we can answer.

What the servers log

Our hosting and network providers log requests, including IP addresses and user agents, to serve pages, apply rate limits and block attacks. We use Cloudflare Turnstile when you sign in, to keep scripts from making accounts in bulk; it decides whether you look like a browser, and does not track you across sites. It runs on the sign-in step and nowhere else.

Who else sees your data

We share data with the services that run OpenGame, and for nothing else. We do not sell it, and there are no advertising or data-broker relationships to disclose.

One exception, for jam winners only. To deliver a sponsor's prize we give that sponsor the winner's name, handle and email address, and to pay any prize we collect proof of eligibility, a tax form and payment details, which we keep for as long as tax law requires. The official rules say when.

We will also hand over data where the law requires it. If we are allowed to tell you first, we will.

What is public

Your handle, OG number, display name, avatar, bio, links and published games are public, along with the play counts and likes on those games. Your email address, your country and your draft submissions are not, and are not visible to other users.

Cookies and local storage

We set a small number of first-party items and no third-party ones:

• A session cookie once you sign in.
• The play identifier described above.
• Your theme and sound preferences.

There are no advertising cookies. The domain games are served from is kept free of our cookies entirely, on purpose. It is the boundary that stops a game reading anything about your account.

How long we keep things

One exception cuts across all of it: anything subject to a legal notice or an open investigation is held until that is resolved, so evidence is not destroyed by a timer.

Deleting your account, and getting a copy

Email team@opengame.io from the address on the account and say which you want. Plainly, what happens:

• A copy. We send you what we hold about you in a machine-readable file.
• Deletion. Your profile, settings, likes and library go. Your email address is removed from the account and from our mailing lists.
• Your games. Tell us whether to unpublish them. We will not decide that for you, because other people may be playing them.
• Your handle is never reissued. An old link cannot end up pointing at somebody else.
• What survives. Attestations, review decisions, audit records and, if you won something, the result. Those are evidence about what happened, and deleting them would defeat their purpose.

We aim to answer within [LEGAL: statutory response window].

Where your data is

Our database and our backups are in the United States. Cloudflare serves pages and game files from wherever you happen to be, and our validation sandbox runs wherever our compute provider places it. [LEGAL: international transfer mechanism for EU/UK visitors: SCCs, DPF, or a stated position]

Your rights

Depending on where you live you may have rights to access, correct, export, delete or restrict the use of your data, and to object to some of it. Ask and we will do it. We would rather handle these by email than make you find a form. [LEGAL: which regimes apply (GDPR, UK GDPR, CCPA), the lawful basis for each purpose, and whether a representative or DPO is required]

Age

Entering the jam requires you to be 18 or over. For accounts generally, [LEGAL: minimum age to hold an account]. We do not knowingly collect data from children, and if we learn we have, we delete it.

Changes

When this changes materially we will say so on the site and update the date below. The version of the terms and rules you agreed to at submission is recorded with your entry, so a later edit cannot rewrite what you signed up to.

Contact

team@opengame.io. Privacy questions, deletion requests and complaints all go to the same place.