Stupid Fun Games privacy policy
Effective date and last update:
Short version: you can play every game without an account, and then we collect nothing about you, apart from short technical logs. If you sign in, we keep only what the leaderboards, streaks, badges and friends need, we never sell it, and you can delete all of it yourself with one big red button. The long version is below. We tried to keep it readable.
Who we are (the culprits)
Stupid Fun Games is a free website of small browser games at https://stupid-fun-games.com ("Stupid Fun Games", "we", "us"). We decide what personal data is collected and why, so we are responsible for it (the "controller", in legal terms).
For any privacy question, request or complaint, write to privacy@stupid-fun-games.com. We answer within one month, usually much sooner.
This policy covers the whole website, in all its languages, and its optional sign-in.
Just playing: we know nothing, and we like it that way
You can play every game without an account. Then we collect no personal data (apart from the short technical logs described below, when a page asks our server for something): no ads, no analytics, no tracking pixels, no third-party scripts, and we set no cookies.
Your browser keeps a few things on your own device, in its local storage; they stay there unless you sign in to save a score:
- your best score in each game;
- the language you picked;
- small reminders while you use the site, such as a finished game waiting to be saved if you sign in, or that you asked us to stop suggesting it. Most are wiped when you close the tab, and you can delete all of them in your browser's settings.
Like every website, ours is delivered by a host, Cloudflare. To deliver pages and protect the site from attacks, Cloudflare's network handles the technical details of each request, such as your IP address and browser type. We don't get logs of page views: only aggregated traffic statistics (for example, visits per country), which don't identify anyone, and a record of any request Cloudflare blocks as an attack. Viewing a leaderboard or opening the sign-in window asks our server for something (the scores, or the list of ways to sign in), so that request appears in the short technical logs described in the next section.
Signing in: what Google, GitHub or Discord tell us
Signing in is optional, and it only exists for leaderboards, streaks, badges and friends. You sign in with Google, GitHub or Discord, so we never see or store a password.
From Google we ask only for the basic sign-in scopes openid, email and profile. From GitHub we ask for read:user and user:email, and from Discord for identify and email, which are the same basic permissions. From that, we keep exactly these fields, and use each one only as described:
- Your account ID at the provider (an opaque number, such as Google's "sub"): to recognize you the next time you sign in.
- Your email address, and whether the provider has verified it: to tell accounts apart, to open the same account when you sign in with another provider that confirms the same verified address, and so friends who know your address can send you a friend request. We never send you email. An address the provider hasn't verified is thrown away, not stored.
- Your name (or your username, if the provider has no name): shown only to you, on your profile page. We don't use it for anything else.
- The link to your profile picture: so it can be your avatar. A Google picture is suggested as your avatar when you pick your nickname (you can choose one of our silly drawings instead, then or any time later); a GitHub or Discord picture is only used if you pick it yourself. We don't copy the image; browsers load it straight from the provider.
- The list of permissions you granted (the scopes above), as part of the sign-in record.
The provider's answer can include other basic profile details (such as your GitHub bio, or your Discord banner and language). We don't keep them. The provider also hands us access tokens; we throw them away at once, so we can never act on your Google, GitHub or Discord account, and we never read your contacts, files, emails or anything else there.
When your browser talks to our server (to sign in, save a score, load a leaderboard or your friends), Cloudflare keeps a short technical log of the request: the address asked for (which can include a nickname), the time, whether it worked, the request headers your browser sends, such as browser type and language (cookies are masked), any error messages our code writes, and details Cloudflare adds, such as approximate location and network information, which can include your IP address. We use these logs only to fix bugs and stop abuse, and they are deleted within 7 days. To slow down abuse we also count requests per account and, for sign-in, per IP address: the IP is only the counter's key for one minute and is never stored by us.
What we keep while you play signed in
Once you're signed in, we also store what the games and features need:
- your nickname (chosen by you) and your avatar (one of our silly drawings, or your provider picture if you pick it);
- your best score in each game, and when you set it, on the daily, weekly and all-time leaderboards;
- your stats: how many games you've finished, your current and best daily streak, and the day you last played;
- your badges, and when you earned them;
- your friends, since when, and the friend requests you sent or received. If you add someone by email address, we don't store the address: only a scrambled fingerprint of it (a keyed hash), to match it if its owner signs in, and a masked label like j***@g***.com that only you see;
- when you were last active (updated every few minutes while you have the site open and in use), so your friends can see if you're online;
- your sign-in sessions: a random token, when it started and when it expires. We don't store your IP address, or which browser or device you use, with your account.
How we use it (and how we don't)
We use the data above only to run the site for you: to sign you in and keep you signed in, show your scores on the leaderboards, keep your streak, award badges, run friends and the online status, keep the site safe (rate limits, stopping abuse) and answer your messages.
We don't sell, rent or trade personal data. We don't use it for advertising, profiling or marketing, we don't send newsletters (or any email at all), and we don't use it to train AI models. There are no ads on the site today; if that ever changes, we'll update this policy first, and data from your sign-in provider will never be used for ads.
If you're in the European Economic Area, the United Kingdom or somewhere with similar laws: we use account data because you asked for the account features (to perform our agreement with you), and minimal technical and security data for our legitimate interest in keeping the site running and safe.
Google user data (the serious bit)
Stupid Fun Games' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: from Google we receive only your Google account ID, your email address (and whether it's verified), your name and your profile picture link, through the openid, email and profile scopes. We use them only to sign you in and to provide the features described on this page; while your Google picture is your avatar (it's suggested by default, and you can change it any time), anyone can see it next to your nickname, for example on the public leaderboards and in friends lists. Other than that, we don't transfer them to anyone, except to our host Cloudflare, which stores them for us, or when the law requires it. We don't use them for ads, we don't sell them, and we don't use them to train AI models. Nobody reads them unless you ask us to (for example, to handle a request of yours), for security reasons such as investigating abuse, or when the law requires it.
Who sees what
- Everyone, even without an account: your nickname, your avatar, and your scores and places on the leaderboards.
- Players you exchange friend requests with: your nickname and avatar.
- Your friends: also your streak, how many games you've played, your badges, your places on the leaderboards, since when you've been friends, and whether you're online (or when you were last seen).
- Only you: your email address, your name, your provider account, and the masked labels of the email friend requests you sent. They are never shown to anyone else.
Heads-up: a GitHub or Discord picture link contains your account number on that service, so if you choose it as your avatar, people could find your profile there. That's why we never choose it for you. Google picture links don't give your account away.
Who helps us run the show
We don't share personal data with anyone, except these service providers, each only for what's described here:
- Cloudflare, Inc. hosts the website and our server code (Cloudflare Workers) and stores the database (Cloudflare D1), on our behalf and under its data processing terms.
- Google, GitHub and Discord confirm who you are, only if you choose to sign in with them, and send us the fields listed above. Their own privacy policies cover what they do.
- Google Workspace delivers and stores the emails you send to our privacy address.
When a player uses their provider picture as their avatar, your browser loads it straight from Google, GitHub or Discord, which can see your IP address, as with any image on the web.
We may also disclose data if the law requires it, for example to answer a valid court order.
Where your data travels
Cloudflare runs a global network, so your data can be handled in countries other than yours, including the United States, where data protection laws may differ. Our database is set up in Western Europe. Where the law requires it, these transfers are covered by Cloudflare's data processing terms, which include the European Commission's Standard Contractual Clauses.
How long we keep things
- Your account and everything attached to it: until you delete it.
- Leaderboards: daily ones are deleted about a week after the day ends, weekly ones about 5 weeks after the week ends; all-time scores stay until you delete your account.
- Sign-in sessions: they expire 30 days after they were last renewed (at most once a day while you use the site), or at once when you sign out. An expired one is removed the next time it's checked, and always with your account.
- Friend requests: an unanswered one stops showing after 30 days. The record stays until the sender's or the receiver's account is deleted (a request sent to an email address, until the sender's account is deleted).
- Technical request logs (kept by Cloudflare): at most 7 days.
- Database backups (Cloudflare D1 Time Travel, a rolling history only used to recover from a disaster): up to 30 days.
- Emails you send us: as long as we need to handle your request and keep a record that we did.
Making it go away
Delete your account yourself, any time: Profile → Danger Zone has a big red button. It's immediate and can't be undone. In one go it deletes your account and everything attached to it: nickname, avatar, name, email, the link to your provider account, your scores on every leaderboard, stats and streak, badges, friendships (on both sides), the friend requests you sent and the ones you received by nickname, your last-seen time and every sign-in session. Grandma will be sad, but she'll cope.
Can't sign in any more (say, you lost your Google, GitHub or Discord account)? Write to privacy@stupid-fun-games.com from the email address of your account and we'll delete it by hand.
Take me to the Danger ZoneThe leftovers (and how long they hang around)
- Leaderboards: we clear the cached copy closest to you at once, but one somewhere else in the world can show your nickname for a minute or so, until it expires.
- Other devices: one where you're still signed in can look signed in for up to 5 more minutes. Nothing it does gets saved.
- Backups: our database keeps a rolling history of up to 30 days (Cloudflare D1 Time Travel), only there to rescue it if it ever catches fire. Your data drops out of it within 30 days of you leaving.
- Logs: Cloudflare keeps short technical logs of the requests to our server (what was asked, when, whether it worked, your browser's request headers such as browser type and language, with cookies masked, and any error messages our code writes) for at most 7 days. A nickname can show up in one when it's part of the address.
- Friend requests someone sent to your email address: those are their outbox, not your account, so we leave them alone and nobody can tell you left. Your answers to them are wiped. Each one shows on the sender's list until they cancel it or 30 days after they last sent it, and stays in their outbox (a scrambled fingerprint of the address plus a masked label like j***@g***.com, never the address itself) until they delete their own account.
Your rights
Wherever you live, you can ask us to:
- give you a copy of the personal data we hold about you (most of it is already on your profile page), in a common, machine-readable format if you like;
- correct it (you can change your nickname and avatar yourself);
- delete it (yourself, in the Danger Zone, or by asking us);
- limit how we use it, or object to a use;
- stop altogether: delete your account, and you can also remove our access in your Google, GitHub or Discord account settings.
To use any of these rights, write to privacy@stupid-fun-games.com from the email address of your account, so we know it's you. It's free, and we answer within one month. If you're in the European Economic Area or the United Kingdom, you can also complain to your data protection authority. California residents have the rights of the CCPA, and Brazilian residents those of the LGPD; we don't sell or share personal information as those laws define it.
Keeping it safe
Everything travels over HTTPS. Sign-in cookies are Secure, HttpOnly (scripts can't read them) and SameSite. We keep no passwords and no provider tokens, email addresses used for friend requests are stored only as keyed hashes, the database isn't reachable from the internet (only through our server code), and only the site owner can access our Cloudflare account. No system is perfectly secure, but if a breach ever affects your data, we'll tell you and the authorities as the law requires.
Kids
Anyone can play without an account, since that collects nothing beyond short technical logs. Accounts, however, are not meant for children under 13 (or under the age of digital consent in their country, which is up to 16 in parts of Europe), and we don't knowingly collect their personal data. If you think a child has made an account, write to privacy@stupid-fun-games.com and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top of this page. If a change is important (for example, a new kind of data or a new use for it), we'll announce it on the site before it takes effect.
Contact
Questions, requests, complaints or a good joke about socks: we read everything, and we answer within one month.
Write to privacy@stupid-fun-games.com