Privacy notice

Scope and current service boundary

This notice describes the GamesFor.Me Python and TypeScript application contained in this package. Escape Games opens at a separate subdomain and is not represented by this repository, so its code, storage, operators, and policy coverage must be reviewed separately before a shared-policy claim is made.

Information used by the application

• Age-confirmation status and an optional gamer tag in first-party HttpOnly cookies.
• A first-party HttpOnly anti-CSRF token used to protect forms and polling requests.
• Game preferences, room-scoped resume data, and tournament participant credentials in browser storage when a client needs them.
• Room, tournament, player, score, move, and private-sector simulation state held by the Python service and checkpointed to a private, versioned SQLite database.
• Ordinary hosting and application logs needed for reliability and security, which can include timestamps, request paths, status codes, error categories, and network metadata supplied by the host.

Purposes and data minimization

The application uses these values to confirm eligibility, display player labels, protect state-changing requests, connect players to the correct room, restore a valid tournament identity, operate game rules, prevent abuse, and diagnose faults. It does not create user accounts or require real names.

Reconnect credential protection

Tournament reconnect credentials are generated from 256 bits of randomness. The server stores context-bound one-way HMAC digests rather than reusable raw credentials. Successful reconnects rotate the browser credential, and old credentials receive only a short grace period for an already-open tab.

Retention and deletion

• Age and gamer-tag cookies are configured for up to 180 days unless cleared earlier.
• The anti-CSRF cookie is configured for up to 12 hours and rotates when absent.
• Browser storage remains until the game removes it, it expires by client rules, or the user clears it from the Storage page or browser settings.
• Durable room, tournament, and private-sector snapshots remain until application or operator cleanup removes them. No authoritative automatic retention period is configured in this work-in-progress package, which remains a deployment blocker.
• Hosting-log retention is controlled by the hosting environment and has not been authoritatively documented in this repository.

Sharing and tracking

No advertising tracker, analytics SDK, social-login provider, or third-party identity service is declared by this source tree. The host necessarily processes network requests to deliver the site. No claim about the separate Escape Games implementation is made here.

Your controls and requests

Use the Storage page to clear GamesFor.Me local storage, session storage, and first-party cookies from this browser. Because the current application has no account directory, a server-side request must identify the specific gamer tag, private room context, approximate time, and other information needed to locate any retained record without exposing another user’s data.

The repository does not contain an authoritative public privacy-contact method or operator identity. Those business facts are a production blocker and must be configured before deployment.

Children

GamesFor.Me is not intended for children under 13. Do not enter a gamer tag or join a room if you are under 13. A parent or guardian who believes an underage child supplied information should use the verified operator contact method once it is configured for production so the relevant data can be located and deleted.