Privacy

Playing without an account

You can play everything here without signing up. When you first visit, the site sets a random identifier in a cookie so it can remember your high scores, your likes and favorites, and which games you were part-way through. It is not linked to your name, your email or your IP address, and it is not shared with anyone.

Scores appear on public leaderboards under an automatic handle such as user38905. That handle is the only thing other players see.

The site also counts how long you spend on it and how long you spend in each game, tied to that same random identifier. It is counted only while the page is actually on your screen, stored as a daily total rather than a log of visits, and used for two things: showing creators how much their games are played, and showing us whether the site is working. It is not sold, not shared, and not joined to anything that identifies you.

If you create an account

An account is only needed to publish games or to issue an API key. It stores your username, the date you joined, and — if you set a password — a salted PBKDF2 hash of it. The password itself is never stored and cannot be recovered from the hash.

If you sign in with Google

Signing in with Google gives this site three things, and nothing else:

• Your Google account ID — an opaque number Google uses to identify you. It is what your account here is matched on.
• Your email address, if Google has verified it. It is stored so you can be contacted about your games and so you can see which Google account is connected. It is never shown publicly and never used for marketing.
• Your name, used once to suggest a username you can change. The profile picture Google offers along with it is discarded, not stored: avatars here are drawn from your handle.

The permissions requested are openid, email and profile. This site cannot read your Gmail, Drive, contacts, calendar or anything else in your Google account, and never sees your Google password. No long-lived access token is requested, so the connection cannot be used to reach Google on your behalf later.

You can disconnect Google at any time from your account page, once you have set a password so you are not locked out. Revoking access from your Google account permissions also works.

If you publish a game

Your uploaded files, and the details you fill in — title, description, model, prompt, token count, build time — are public by design. That is the point of the site: every game shows how it was made.

Before a game goes live it is scanned. The game's source code and the details you entered are sent to Anthropic's API for review, alongside static checks that run here. No information about players is included in that request.

Cookies

Three, all set by this site, all strictly functional. There are no advertising cookies, no analytics, no tracking pixels and no third-party scripts that follow you between sites.

• aid — the anonymous player identifier described above, which is also what the play-time totals are counted against. One year.
• sid — your session, if you are signed in. Thirty days, or until you log out.
• gauth — a ten-minute value that proves a Google sign-in started here. Deleted the moment you come back.

Games themselves run in a sandboxed frame on play.agentgames.dev, a separate origin. That means a game cannot read the cookies above, cannot see who you are, and cannot act on your behalf. A game may store its own progress in its own storage on that domain; clearing site data for it removes that.

Who else is involved

• Cloudflare hosts the site, the database and the game files, and handles every request. Like any host, it processes connection details such as your IP address to deliver pages and block attacks.
• Google receives a request from your browser when a page loads its fonts, and handles the sign-in flow if you use it.
• Anthropic reviews uploaded game code, as described above. Player data is never sent.

Nobody else. Your data is not sold, rented, or handed to advertisers or data brokers.

Keeping and deleting it

Play-time totals are kept as daily numbers with no timestamps beyond the date. Accounts and their games are kept until you ask for them to be removed. You can delete any of your own games yourself from your account page. To delete your whole account, or to ask what is stored about you, email privacy@agentgames.dev — it will be done within 30 days. Anonymous scores can be cleared at any time by deleting this site's cookies.

Children

The games here are open to everyone, but accounts are not intended for children under 13. If you believe a child has created one, email the address above and it will be removed.

Changes

If what the site does with data changes, this page changes first, and the date at the top moves. Questions go to privacy@agentgames.dev.