Privacy Policy
What we collect
Creators (signed in): when you sign in with GitHub we receive your GitHub id, login, and display name (and email only if you provide it). We store the projects, API keys, and deployments you create.
Players: players need no account. A game assigns a per-room player id and a display name (which you choose, default "Guest N"); these are tied to the room, not to a personal profile. Scores you submit are stored for the game's leaderboard.
Operational data: we process IP addresses transiently for rate limiting and abuse prevention, and to derive an approximate country (used only as an aggregate count to plan server locations — the IP itself is not stored against it). We keep aggregate, non-identifying counters (page views, traffic source, country, rooms, concurrent players) for capacity, billing, and understanding usage. Our own counters are daily aggregate totals.
We use Google Analytics (client-side, via the standard gtag.js snippet) to
understand page traffic: it sets first-party _ga cookies to recognize returning
browsers. We configure it analytics-only — ad storage, ad user data, and ad personalization
are all explicitly denied, and Google Signals is off. Our server additionally mirrors
selected product events (deploys, room lifecycle, sign-ins) to PostHog and
Google Analytics; these server events carry no browser identity, no IP, and no user agent —
pseudonymous, HMAC-derived identifiers only. PostHog is configured to build no per-person
profiles. There is no session recording anywhere.
Cookies
The only cookies on this origin are Google Analytics' _ga measurement cookies
(see above). Authentication never uses cookies — it uses a bearer token held in your
dashboard's local storage — and games you host or play cannot read analytics cookies from
their sandboxed frames. Hosted games remain served without any tracking injected into the
game itself.
Why we process it (legal basis)
To provide the service you asked for (performance of a contract), and for our legitimate interest in keeping it secure and abuse-free. We do not sell your data or use it for third-party advertising.
Who we share it with (sub-processors)
We use service providers strictly to run antics: GitHub (sign-in), MongoDB Atlas (database hosting), Amazon Web Services (server & file hosting), PostHog, and Google Analytics (privacy-preserving product analytics). They process data on our behalf under their own terms.
Where & how long
Data is hosted in the United States, so if you are in the EEA your data is transferred outside it. For those transfers we rely on appropriate safeguards — our hosting providers (Amazon Web Services and MongoDB Atlas) offer Standard Contractual Clauses through their data-processing agreements.
Keyless rooms and their data expire (currently after 24 hours). Account data (projects, keys, leaderboards) is kept until you delete it or close your account.
Your rights
If you are in the EU/EEA (or a similar regime), you have the right to access, correct, delete, export, or object to the processing of your personal data. Sign-in account data can be removed by deleting your account in the dashboard, or email [email protected]. You may also complain to your local data-protection authority.
Children
antics is not directed at children under 16, and we do not knowingly collect their personal data.
Changes
We may update this policy; we'll change the "last updated" date above and, for material changes, give notice where appropriate.