Privacy Policy

Service: gameup.me

Last Updated: August 26, 2026

Effective: August 26, 2026

Operator: Private Individual · Location: Georgia · Email: gameup.me@proton.me · Website: gameup.me

1. Introduction

1.1. Purpose of This Policy

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the gameup.me Service (the "Service"). We are committed to protecting your privacy and being transparent about our data practices.

1.2. Scope

This Privacy Policy applies to all users of the Service. It forms an integral part of our Terms of Service.

1.3. Minimal Data Philosophy

We have designed the Service to collect and store the absolute minimum amount of data necessary for it to function. Unlike many communication platforms, we do not store your communications, metadata, or personal information.

1.4. Geographic Availability

The Service is currently not offered to users located in the European Economic Area (EEA) or the United Kingdom. If you are located in these regions, please do not use the Service. For more information, see our Terms of Service.

2. Data We Collect and Store

2.1. Data Stored in Our Database

We store only the following data for registered users:

Data Type	Purpose	Retention Period
Salted password hash (not the password itself)	Account authentication	Until account deletion
Randomly generated user ID (contains no personal information)	Account identification and WebRTC signaling	Until account deletion
Optional display name (if you choose to provide one)	Display in the interface	Until account deletion or until you change/remove it
Email address	Account recovery, password reset, and communication	Until account deletion
Game statistics (wins, losses, draws)	Track player progress and rankings	Until account deletion
Game history (moves, results, timestamps)	Review past games, prevent abuse	Until account deletion
Room data (if you create or join a room)	Room identification, access control, invitation management, and communication routing	Until room deletion or account deletion

Confirmation Flags (Registered Users)

For registered users, we store the following confirmation flags in your account:

Age confirmation: A flag indicating that you have confirmed you are at least 13 years old
Geographic confirmation: A flag indicating that you have confirmed you are not located in the EEA or the United Kingdom

Important:

We do not store your actual age or actual location
We store only the fact that you have completed the confirmation
This flag is associated with your account solely for the purpose of verifying eligibility
This is the minimum information necessary to comply with legal requirements (COPPA, GDPR)

Retention: These flags remain stored for as long as your account is active. If you delete your account, these flags are deleted along with all other account data.

Cross-device behavior: Because these flags are stored in your account, you do not need to confirm your eligibility again when logging in from different devices.

Session Data (Guest Users)

If you are not registered and use the Service as a guest, we maintain a session to remember your preferences and confirmations.

We store in the guest session:

A randomly generated session ID (stored as a persistent cookie)
Confirmation flags: Flags indicating that you have confirmed your age (13+) and geographic eligibility (not in EEA/UK)

Duration: The cookie is persistent — it remains stored in your browser until you manually delete it. This allows you to return to the Service without re-confirming your eligibility.

If you delete your cookies: The confirmation flags will be lost, and you will be asked to confirm your eligibility again the next time you visit.

Important: Guest session data is not linked to any account (because you don't have one). It is stored only in your browser's cookie.

Room Data

When you create, join, or are invited to a room, we store the following information:

Room ID: A randomly generated identifier (e.g., /r/123456)
Room alias (optional): A human-readable name you may choose (e.g., /r/my_room)
Room type: Temporary (deleted after use) or permanent (persists until deleted)
Creator: The user ID of the user who created the room (room administrator)
Members: User IDs of users who have been invited and accepted the invitation
Pending invitations: Users who have been invited but have not yet accepted
Invitation links: Unique tokens generated for each invitation
Last activity: Timestamp of the last interaction in the room
Comment (optional): A short description you may add to the room

Important: Room aliases and invitation links are not considered personal data but may be used to identify rooms. Choose aliases that do not contain personal or sensitive information.

For unregistered users accepting an invitation: We create a temporary account with the credentials generated for you. These credentials are stored in the same manner as regular accounts (see above). You may use these credentials to log in later.

Wishlist Data

If you submit a wishlist item, your submission is stored temporarily for moderation. If approved, the text is published. You may choose to:

Display a name (your display name or a custom name) alongside your item
Remain anonymous (no name displayed)

We store the name you choose to display (if any) with the published item. However, we do not store any information linking the submission to your user account. This means even if you display a name, we cannot verify that you are the author, and you cannot request deletion of a specific item after it has been published.

Guest Players

Game data is not stored for guests. Statistics and history are only saved for registered users.

Tools (Graphics Editor, Audio Editor, and other similar applications)

All Tools run entirely in your browser. No data is transmitted to our servers. We do not store any files created or edited in the Tools.

Collaborative Sessions (Games and Tools in Rooms)

When you use a game or tool collaboratively in a room:

No data is stored on our servers — data is only relayed in real-time
We do not retain any game state, drawing strokes, audio edits, or other activity data after the session ends
We have no access to the content of your collaborative sessions

2.2. Data We DO NOT Collect or Store

We explicitly do not collect or store:

Your actual age — we only store a confirmation flag that you have confirmed you are at least 13 years old
Your actual location — we only store a confirmation flag that you have confirmed you are not in the EEA or UK
IP addresses — not logged or stored (except anonymized analytics data, see Section 9.3)
Session logs — we do not record who connected, when, or for how long
Communication metadata — we do not record who called whom, call duration, or call frequency
Contact lists — we do not store your contacts
Audio content — we do not record or store any audio from your communications
Video content — we do not record or store any video from your communications
Text messages — we do not store chat messages
Screen sharing data — we do not store screen sharing content
Location data — we do not collect GPS or location information
Device information — we do not collect device models, OS versions, or browser types (except anonymized analytics data)
Graphics or files — we do not store anything created in the Tools
Collaborative session data — game state, drawing strokes, audio edits, etc. are relayed but not stored
Cookies with personal data — we do not store personal data in cookies (see Cookie Policy)
Wishlist user links — we do not link wishlist items to user accounts
Session history — we do not track your browsing or usage history

2.3. Why We Collect So Little

By design, we collect only what is strictly required for the Service to function:

The password hash allows you to log in securely
The user ID identifies you to other users during calls, games, and rooms
The display name (if provided) lets others see who they are talking to, playing with, or meeting in a room
The email address lets you reset your password if forgotten
Game statistics allow you to track your progress and compete with others
Room data allows you to create private spaces and manage invitations
Confirmation flags allow us to verify your eligibility without storing unnecessary personal information

3. Temporary Data Processing (Not Stored)

3.1. WebRTC Signaling

To establish video calls, the Service processes signaling data in real-time. This includes:

Session descriptions (SDP)
ICE candidates (network addresses)
IP addresses of participants

This data is:

Processed only for the duration of the connection setup
Not stored in any database or log
Discarded immediately after the connection is established or fails

3.2. WebRTC Media Streams

During a call, audio and video streams are transmitted:

Directly between users (peer-to-peer) whenever possible
Through our TURN server only when direct connection fails

These streams are:

Transmitted in real-time only
Not recorded, stored, or retained
End-to-end encrypted using WebRTC's built-in encryption (SRTP)
Discarded immediately after transmission

3.3. TURN Server Relay

If our TURN server is used to relay media:

Media traffic passes through the server in real-time
No media is stored on the TURN server
No logs of media content are created
TURN server IP addresses may be processed temporarily but are not stored

3.4. Game Sessions (Guest Players)

When guests play games in single-player mode:

Game state is processed in real-time in the browser
No game data is sent to our servers
No statistics or history are stored
All game logic runs locally on your device

3.5. Tools (Graphics Editor, Audio Editor, and other similar applications)

All applications in the Tools section run locally in your browser. This includes, but is not limited to, the Graphics Editor, Audio Editor, and any other tools we may add in the future.

No data is transmitted to our servers
All processing occurs on your device
Files you open are loaded locally
Edits are processed locally
Files you save are saved locally
We have no access to your files or edits

Note: Because all processing is local, these tools do not require an internet connection beyond the initial loading of the application.

3.6. Collaborative Sessions (Games and Tools in Rooms)

When you use a game or tool collaboratively with other users in a room:

Real-time data transmission: Game state, drawing strokes, audio edits, and other activity data are transmitted through our servers to synchronize the experience between participants
No data storage: This data is not stored on our servers. It is processed in real-time and discarded immediately after the session ends
No access to content: We do not access, review, or retain the content of your collaborative sessions
Encryption: Data transmitted during collaborative sessions is encrypted in transit
Duration: Data exists only for the duration of the session and is not persisted

Important: This is different from solo mode, where no data is transmitted at all. In collaborative mode, data is relayed but never stored.

3.7. Confirmation Flags (Age and Geographic Eligibility)

When you register or use the Service as a guest, you are asked to confirm:

That you are at least 13 years old
That you are not located in the European Economic Area (EEA) or the United Kingdom

How we handle this information:

We store a confirmation flag indicating that you have completed the confirmation
For registered users: This flag is stored in your account and is associated with your user ID
For guest users: This flag is stored in a persistent cookie in your browser and is not linked to any account
We do not store your actual age or actual location
This is the minimum information necessary to comply with legal requirements

Why we store this: COPPA requires us to verify that users are at least 13 years old. By not storing your actual age, we collect less information than many services. The confirmation flag allows us to meet this requirement without storing unnecessary personal data.

3.8. Server Logs

Our hosting provider (Hetzner) may maintain standard server logs that include:

Access times
Server resource usage
General technical information

These logs are:

Not accessed by us except for troubleshooting technical issues
Not used for user tracking or analytics
Retained only as long as necessary for technical operations

3.9. Future Data Storage (Optional)

In the future, we may introduce optional features that allow users to save game states, tool projects, or other content on our servers. This would be an opt-in feature, and we will:

Notify you before implementing such features
Update this Privacy Policy accordingly
Provide clear options for data storage, retrieval, and deletion
Only store data with your explicit consent

Currently, no game or tool data is stored on our servers.

4. How We Use Your Data

4.1. Purposes of Processing

We process your data solely for the following purposes:

Purpose	Legal Basis	Data Used
Account creation and authentication	Contractual necessity	Password hash, user ID, email
Establishing video calls	Contractual necessity	User ID, signaling data (temporary)
Displaying your chosen name	Contractual necessity	Display name (if provided)
Password reset	Contractual necessity	Email address
Game matchmaking and statistics	Contractual necessity	User ID, game stats, game history
Room creation and management	Contractual necessity	Room data, user ID
Invitation management	Contractual necessity	Invitation links, user IDs, room data
Collaborative session relay	Contractual necessity	Game/tool data (temporary, not stored)
Eligibility verification	Legal obligation / Legitimate interest	Confirmation flags (minimum information necessary)
Wishlist moderation and publication	Legitimate interest	Submission text (temporary); published text and chosen name (if provided)
Analytics (Google Analytics)	Consent	Anonymous usage data (IP anonymized)
Service improvement	Legitimate interest	Aggregated technical data (no personal data)

4.2. No Marketing or Profiling

We do not:

Send marketing emails
Use your data for advertising
Profile users for commercial purposes
Sell or rent your data to third parties

4.3. No Automated Decision-Making

We do not use automated decision-making or profiling that has legal or significant effects on you.

5. Data Storage and Security

5.1. Where Data Is Stored

Your data is stored on servers operated by Hetzner (our hosting provider), located in [Germany / Finland — укажите фактический дата-центр]. All stored data is located on servers within the EU (Hetzner's data centers are in Germany and Finland).

5.2. Security Measures

We implement the following security measures:

Password hashing: Passwords are stored as salted hashes (using a secure algorithm). We never store plain-text passwords.
Encryption: WebRTC streams are encrypted using SRTP. Collaborative session data is encrypted in transit.
Access control: Only the Operator has access to the database.
Minimal data: By storing minimal data, we reduce the impact of any potential breach.
Secure connections: All communication with the Service is over HTTPS.

5.3. Retention Period

Your data is retained for as long as your account is active. When you delete your account:

All stored data (password hash, user ID, display name, email, game stats, game history, confirmation flags) is permanently and irreversibly deleted
Wishlist submissions are not affected because they are stored anonymously and are not linked to your account
Rooms you created may be deleted or reassigned at our discretion
No backups of user data are retained

Guest players: No game data is stored, so there is nothing to delete.

Tools: No data is stored on our servers, so there is nothing to delete.

Collaborative sessions: No data is stored, so there is nothing to delete.

Guest session data: Deleted when the session expires or when cookies are cleared.

5.4. Data Breach Notification

In the event of a data breach that affects your personal data:

We will investigate the breach
We will notify affected users as soon as reasonably possible
We will take steps to mitigate the breach

6. Your Rights

6.1. Your Rights Under Applicable Law

Depending on your jurisdiction, you may have the following rights:

Access: You can request a copy of the data we hold about you
Rectification: You can correct inaccurate data (e.g., update your display name)
Deletion: You can request deletion of your account and all associated data
Restriction: You can request restriction of processing (though we process minimal data)
Objection: You can object to our processing (e.g., if we were processing for marketing, which we do not)
Portability: You can request data portability (we store very little data)

6.2. How to Exercise Your Rights

To exercise any of these rights, please contact us at: gameup.me@proton.me

We will respond within a reasonable time, typically within 30 days.

6.3. Verification

To protect your privacy, we may request verification of your identity before fulfilling your request.

6.4. No Charge

We will not charge you for exercising your rights, unless requests are manifestly unfounded or excessive.

Note on Wishlist

Because wishlist items are published anonymously and are not linked to your account, you may not be able to request deletion of a specific wishlist item after it has been published. If you believe a wishlist item violates these Terms, please report it to us.

Note on Rooms

If you request deletion of your account, any rooms you created may be deleted or reassigned at our discretion. Room data is stored separately from your account and may persist if reassigned to another user.

Note on Collaborative Sessions

Because collaborative session data is not stored on our servers, we cannot provide access to, or deletion of, this data. It exists only during the session and is discarded immediately after.

Note on Guest Sessions

If you use the Service as a guest, your confirmation flags are stored only in your browser's persistent cookie. If you clear your cookies, this data is lost and cannot be recovered. We do not store guest session data on our servers.

7. Children's Privacy (COPPA Compliance)

7.1. Minimum Age

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

7.2. COPPA Compliance

We comply with the U.S. Children's Online Privacy Protection Act (COPPA):

We require all users to confirm they are at least 13 years old
We do not target the Service to children
We do not have actual knowledge that we are collecting data from children under 13

Games

The 3D Shooter is restricted to users 18 and older. Guests may play Reversi and Backgammon in single-player mode without age verification, but no data is stored.

7.3. Discovery of Underage Users

If we discover that a user is under 13:

We will immediately terminate the account
We will permanently delete all associated data
We will not use the data for any purpose

7.4. Reporting

If you become aware that a user is under 13, please report it to us at: gameup.me@proton.me

8. International Data Transfers

8.1. Data Storage Location

Your data is stored on servers located in [Germany / Finland — укажите фактический дата-центр Hetzner].

8.2. No Transfers to Third Countries

We do not actively transfer your data to countries outside the location where it is stored. However, data may pass through networks that are international in nature.

8.3. Users Outside the EU

If you are located outside the EU, your data will still be stored on our servers within the EU. By using the Service, you consent to this processing.

9. Third-Party Services

9.1. Hosting Provider (Hetzner)

We use Hetzner for server hosting. Hetzner may process technical data to provide their services. For more information, see Hetzner's privacy policy.

9.2. Email Services (Proton Mail)

We use Proton Mail (gameup.me@proton.me) for email communication. When you contact us via email, your email is processed by Proton Mail's service. For more information, see Proton Mail's privacy policy.

9.3. Google Analytics

We use Google Analytics to collect anonymous usage statistics. This helps us understand how users interact with the Service and improve it.

What we collect:

Pages visited
Time spent on pages
Clicks and interactions
Browser type and device information (anonymized)
Approximate geographic location (country level, anonymized)

What we DO NOT collect:

Your name, email, or any personal information
Your exact IP address (IP anonymization is enabled)
Content of your communications

IP Anonymization: We have enabled IP anonymization in Google Analytics. Your IP address is truncated before being sent to Google's servers.

How to opt out: You can opt out of Google Analytics by:

Using the Google Analytics Opt-out Browser Add-on
Adjusting your browser cookie settings
Declining analytics cookies in our cookie consent banner

Data processing: Google may process your data in the United States and other countries. For more information, see Google's Privacy Policy.

9.4. Other Analytics Services

We may use additional analytics services in the future. We will update this policy accordingly.

9.5. No Advertising Networks

We do not use advertising networks, retargeting, or marketing cookies.

10. Data Requests and Complaints

10.1. Contact for Data Requests

For any data-related requests (access, deletion, correction), please contact us at: gameup.me@proton.me

10.2. Response Time

We respond to all legitimate data requests within 30 days.

10.3. Complaints

If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority. For users in the EU/EEA, you can contact your national data protection authority. However, please note that we do not offer the Service to users in the EEA or UK.

10.4. Scope of Rights

The rights described in Section 6 are subject to limitations under applicable law. In particular, because we store very little data, some rights (such as data portability) may have limited practical application.

11. Changes to This Policy

11.1. Right to Modify

We reserve the right to update or modify this Privacy Policy at any time, in our sole discretion.

11.2. Notice of Changes

We will notify you of material changes by:

Posting the updated policy on the Service website
Sending an email to the address you provided
Displaying a notice within the Service

11.3. Effective Date

Changes become effective on the date specified in the notice. For material changes, we will provide at least 30 days' notice.

11.4. Continued Use

Your continued use of the Service after the Effective Date constitutes acceptance of the updated Privacy Policy. If you do not agree, you must stop using the Service and delete your account.

12. Contact Information

12.1. Privacy Contact

For privacy-related questions, concerns, or to exercise your rights, please contact us at:

Email: gameup.me@proton.me
(please put "Privacy" in the subject line)

12.2. Response Commitment

We take privacy seriously and will respond to all privacy-related inquiries within a reasonable time.