Privacy

In your browser

Without an account, your breakpoints (saved games) and the "played today" ticks are stored in your browser only. They never reach our server. Clearing site data removes them.

Analytics

We use Google Analytics 4 to count visits and see which games and skills people look for. In the EEA, the UK and Switzerland we load nothing from Google until you choose: no script, no cookies, no pings. If you allow analytics, it loads and uses cookies as usual. Elsewhere analytics is on by default and loads once you scroll, tap or type. Ads features are not used to target you.

You can change or withdraw your choice at any time with Cookie settings at the bottom of every page. You can also block Google Analytics with any tracker blocker; the site works the same.

Submissions

When you submit a game we store what you typed, your email (to tell you about the review) and a one-way hash of your IP address (to limit spam). We don't publish your email or share it.

Reports

When you report a problem or suggest a change, we store your message, your email if you give one (only to ask you about the report), the browser family (such as "Firefox") and a one-way hash of your IP address to limit spam. Reports are deleted after 12 months.

Accounts

An account is optional. If you sign in we store your email address, your name and avatar URL (from GitHub or Google, or none), the id of each GitHub or Google account you connect, the username and bio you choose, your two settings ("I make games" and the weekly digest, off unless you turn it on), the breakpoints you save and the reports you send while signed in (linked to your account instead of an email). Breakpoints saved before signing in are copied to the account the first time you sign in on that browser.

Sessions and cookies. Signing in sets one cookie, bp.session_token, that keeps you signed in for up to 60 days. Signing out removes it. We keep each session's IP address and browser name with it, to spot misuse. These cookies are needed for signing in, so they don't ask for consent.

GitHub and Google. We ask only for your name, email and avatar. We keep the provider's account id so the button signs you in again, and we don't keep access tokens or read anything else from your GitHub or Google account.

Email links. A sign-in link works once and expires after 15 minutes. To stop abuse we allow 3 link requests per address and 5 per connection per hour, counted with one-way hashes, and use Cloudflare Turnstile on the form. A record of each link (address and expiry) is deleted after a day.

Your data and deletion. In Account settings you can download everything we store about you as JSON, and delete your account. Your account is deleted 30 days after you ask, so you can change your mind: until then you're signed out everywhere, your profile is hidden and we send you only sign-in and security emails. On the deletion date we remove your profile, sign-in methods, sessions, saved breakpoints and email address; reports you sent stay, no longer linked to you, and your username stays reserved for 90 days. Database backups are kept for 30 days, so a deleted account is gone from them 30 days after its deletion date.

Processors

Cloudflare (hosting edge, DNS and Turnstile, the spam check on our forms), Google Analytics (analytics, with consent where required), Resend (review and report emails, sign-in links), GitHub and Google (only if you sign in with them).