Cheesy Games Privacy Policy

Account data

• Immutable random account identifier
• Username and optional display name
• Versioned one-way password hash; never the plaintext password
• Access role (user, family, or administrator)
• Account creation and update timestamps
• Optional recovery email: verified address, pending replacement address, normalized lookup keys, verification state, change generation, and timestamps. Email is optional for registration and play; a verified address is required to submit feedback.
• Feedback submitted through the signed-in form: receipt, reply address, category, optional game identifier, subject, message, sanitized page context, request digest, idempotency key, and submission timestamp. Do not include passwords, recovery codes, or sensitive personal information.
• Multiplayer groups you own or join, membership states, invitations and approval requests, account blocks, and structured abuse reports. Request-link credentials are stored only as one-way hashes; games retain their own table seats and gameplay records.

Security and authorization data

• One-way hashes of session and recovery credentials with creation, expiry, or use timestamps
• Short-lived one-way-hashed authorization codes, client, redirect, PKCE challenge, nonce, scope, expiry, and use status
• Salted one-way network-address and account-key fingerprints in rate-limit windows
• Security audit event type, involved account identifiers where needed, event details, and timestamp
• Emergency signing-key revocation identifier, reason, actor, and timestamp
• Registered game client and first/last successful authorization timestamps
• One-way verification and password-reset token digests, purpose, account and credential generation, creation, expiry, redemption, and use state. Verification links expire after 24 hours; reset links after 30 minutes.
• Encrypted transactional email queue payloads, encryption key identifier, stable delivery identifier, retry, uncertain-delivery, and lease state, expiry, generic failure category, and completion timestamps. Raw link tokens are carried only in encrypted undelivered queue payloads and messages sent to the intended recipient.

Cloudflare necessarily processes network addresses and request metadata to deliver and protect the service. The portal stores only salted one-way fingerprints for its durable abuse controls.

Data sent to games

• A registered game receives only a signed audience-bound identifier token after an account authorization flow.
• The token may include immutable account ID, username, display name, and role. It does not include an email address, password hash, recovery code, session cookie, or raw network address.
• Family-only clients are denied unless the current role has the family entitlement.
• When transactional email is enabled, Proton Mail receives the recipient address, sender, subject, message, stable Message-ID, and any reply-to address required to deliver verification, password-reset, account-security, and support messages. Email addresses are not newsletter subscriptions or marketing consent.
• Feedback is saved before delivery and sent to mark@cheesy-games.com with the verified reply address. Provider delivery and copies in the support mailbox are separate from the portal database; portal deletion cannot recall a delivered message. Direct email to the contact address is processed as support correspondence.
• Social lookup uses an exact account handle. Group lists are limited to memberships. Authenticated game services receive only a current social decision for their game and the involved accounts; family entitlement alone does not imply shared group membership.

Each game publishes its own inventory for game-owned saves, matches, scores, or preferences. The portal does not silently merge local profiles that happen to share a display name.

Purpose and legal basis

We process account data to provide the account service you request, honor family access decisions, prevent abuse, secure authentication, and meet legitimate security and operational needs. We do not use it for advertising or third-party analytics.

Retention

• Accounts remain until the player deletes the account or the service is discontinued.
• Portal sessions expire after 30 days and may be revoked sooner; expired rows are maintenance data pending deletion.
• Authorization codes expire after five minutes and are single-use; expired or used rows are maintenance data pending deletion.
• Recovery codes remain until use, rotation, or account deletion and are stored only as one-way hashes.
• Rate-limit windows are operational security data and are deleted after two days.
• Audit and signing-key revocation records are retained for security accountability for up to one year unless a longer period is required to investigate active abuse. Account identifiers are removed when an account is deleted.
• Successful game-link records remain until portal account deletion. Deletion erases the portal account and link registry, leaving any game-held immutable identifier orphaned from the portal account. Independent game history remains under that game's local or device identity until its own deletion control is used.
• Optional email records remain until removal or account deletion. Replacing an address preserves the currently verified address until the replacement is verified; cancellation removes the pending replacement. Removed addresses cannot be used for password reset.
• Expired or consumed email-token records are eligible for deletion after one day. Queued encrypted email payloads are cleared on successful delivery, cancellation, expiry, or terminal failure; completed queue metadata is eligible for deletion after 30 days.
• Feedback database records are eligible for deletion after 90 days. Account deletion clears the feedback reply address, account link, subject, message, page context, and game identifier and cancels pending account mail; receipt and operational metadata may remain until retention cleanup.
• These retention periods are implemented by scheduled maintenance and depend on that maintenance running. Provider and support-mailbox retention and backup restoration procedures require operational configuration and review; this policy does not claim they have been verified in production.
• Social memberships and blocks remain until removed or account deletion. Deleting an owner account deletes its groups; account deletion also removes membership, invitation and block records and clears report/audit account references. Social audit and report records expire after 90 days; expired invitation records are deleted after a further 90 days by scheduled maintenance. Explicit game seats are managed separately by each game.

Your choices and rights

You can export portal account data, revoke all sessions, rotate recovery codes, change the password, or delete the account from the account controls. The deletion report lists every linked game that successfully received this account identity. Deleting the portal erases its account-to-game mapping; game history kept under an independent local or device identity must be erased with that game's deletion control.

Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing.

Security, processor, and contact

Passwords, sessions, recovery codes, authorization codes, and signing keys use the safeguards described above. HTTPS protects Internet traffic. No service is risk-free.

Processor: Cloudflare, Inc. (Workers, D1, hosting, DNS, and network delivery); Proton Mail (transactional SMTP submission and support mailbox when enabled)

Controller: Helix Games Studio · mark@cheesy-games.com