Privacy

What is kept on your device

The site saves these in your browser's storage on your own device, so they are there next time you visit:

• the name and picture you pick, and your settings (look, sound, graphics);
• your game history, high scores and any game in progress;
• your friends, the chat rooms you've joined, and your messages with friends;
• players you've muted or blocked;
• a pair of secret keys made by your browser, which lets your friends recognise you;
• a copy of the site's files, so it opens quickly and works offline.

If you don't sign in, none of this is sent to us. To remove it, clear this site's data in your browser's settings. (Every visitor's browser does fetch the site's public key from our server once a week — no cookie, nothing about you — to check that players' account names are real.)

Which games are played. When a game starts, your browser tells our server which game it is, so the lobby can show the most played games. Only the game and the day are counted — not who played, and no cookie. The browser also asks our server which games the team has marked as new, updated or recommended.

If you sign in with Google (optional)

Signing in keeps your games safe if your browser's data is cleared, lets you carry on on another device, and puts your scores on the global leaderboards. Here is exactly what happens:

• From Google we keep only the account number Google gives our site. Google also tells us your email address and name when you sign in, but we don't store them (the email is only used, at that moment, to recognise the site's admins — only the email addresses of the admins themselves are kept, for the list of admins).
• Your cloud save: a copy of the things listed above that travel with you — your name and picture, game progress and high scores, game history, friends, chat rooms, messages with friends, and your secret player keys (so friends recognise you on every device). Settings that belong to one device (look, sound, graphics, controls) are not copied.
• Your account name, which you choose and which is yours alone (nobody else can take it). It's shown to other players — in lobbies, games and on the leaderboards — and is never your Google name. It can be changed once a year; an old name stays reserved for you for 90 days (and for 30 days after an account is deleted), so nobody can pretend to be you. Guests' names show with "_Guest" after them.
• Leaderboards: your best scores in the arcade games, shown publicly with your account name and picture. The time each game took is kept, to spot cheating.
• Messages for friends who are offline: if you write to a friend who isn't online, the message waits on our server until they come back (up to 30 days), then it's deleted. It's locked on your device with your friend's own key, so not even we can read it.
• One cookie, called ngc_s, which keeps you signed in on that device. It is only sent to the site's own sign-in service (the /api/ folder), lasts up to 180 days after you last use the site, and is removed when you log out. It's needed for the sign-in you asked for, so there is no cookie banner for it. There are no tracking or advertising cookies.
• Google's sign-in code (from accounts.google.com) is only loaded when you press Sign in with Google. Google's own privacy policy covers what Google does when you use it.
• Moderation: if an account is banned (taken off the leaderboards or stopped from signing in), the ban, how long it lasts and the reason are kept with the account, and admins' actions are logged.
• This is stored on the server of the company that hosts the site, in a place that can't be opened from the web. Only the site owner and the admins the owner appoints can look at account details (names, scores, bans) — not the contents of your cloud save.

You're in control: in Your profile → Account you can download a readable copy of everything we keep about your account (your secret player keys and chat-room codes are left out for safety — Download backup saves those), log out (which also clears that device, handy on a shared computer), or delete your account — that removes your cloud save, your leaderboard scores and your sign-ins straight away.

When you play online

Online games connect players' browsers directly to each other (peer to peer). To find each other, browsers pass short connection messages through free public relay servers (the Nostr network) and use public "STUN" servers from Google and Cloudflare to find a route between them. When a network won't allow a direct connection (some mobile, school and office networks), the game messages travel through Cloudflare's relay (a "TURN" server) instead; they're scrambled (encrypted) on the way, so the relay can't read them, and it doesn't keep them. These services are run by other organisations.

• As with any internet connection, the players you connect to and these relay, STUN and TURN services can see your device's IP address.
• Other players can see the name and picture you chose, and whether you are free to play.
• Your moves and chat go straight to the other players and are not stored on our server — unless someone reports a player (below).
• With strangers you can only use quick chat (ready-made messages). Free text chat is only possible between friends who share a chat room code.

Reporting a player

Anyone can report a player to the Neon Game Cave team from the ⋯ menu next to their name. A report is sent to our server and kept for the team (the site's owner and the admins they choose) to look at: the reported player's name, where it happened (the game, lobby or chat room), the reason and note you give, the last messages there (up to 20, so the team can see what happened), your name or account, and a one-way code made from your IP address (it can't be turned back into the address; it only shows when one connection sends many reports). Reports are only used to keep the site safe — for example to warn, rename or ban a player.

Camera

The site never uses your microphone. It only asks for your camera when you choose to scan a chat room's QR code; the picture is read on your device and never sent anywhere. You can say no, and change this at any time in your browser's settings.

Our web host

Like most websites, the company that hosts the site may keep short-term technical logs (such as IP addresses, the pages asked for and the time) to keep the site running and secure. The site's fonts are served from the site itself, not from Google Fonts.

Children

The games are for everyone, and the chat rules above are there to keep younger players safe: strangers can't send free text, and you can mute or block anyone. Children should ask a parent or guardian before playing online, joining chat rooms or signing in. Google accounts for children (Family Link) may need a parent's OK to sign in. Leaderboards only ever show the name and picture picked on this site, and names can't contain contact details.

Your choices and questions

Without an account, everything is in your browser, under your control. With an account, use the download and delete buttons above, or write to us. If the site ever starts showing adverts or anything else that changes what's described here, this page will be updated first.

Questions about privacy: support@neongamecave.com.