Privacy policy

Who we are

spiced.gg is operated by Kinetic Flux, LLC. Where this policy says we or us, that is who it means, and Kinetic Flux, LLC is responsible for the information described below. Reach us through the contact form.

Information we collect

Account information: your email address, your display name, and an avatar if you upload one. We do not ask for your age or date of birth. If you sign in with Google, Google gives us your email address, your name, and an identifier linking the two accounts. The name becomes your display name to start with; you can change it from your profile.
Purchases and memberships: which game or membership, how much was charged, when, and the reference Stripe uses for the transaction.
Play activity: which games you play, achievements, levels and Spice you earn, votes you cast, and events a game records through the platform SDK, such as a level completing.
Playtime: time spent playing while signed in, recorded by game and calendar month. It decides when you have played enough of a game to vote on it.
Saved game data: data a game stores on your behalf, for any game that uses the feature. It is never read by spiced.gg.
Beta feedback: if you answer the feedback form in a beta, your answers and any note you add.
Communications: if you contact us or send a developer enquiry, whatever you put in the form.
Developer information: if you publish, the name you publish under and the listings you create. If you take payments, we create a Stripe account at your request and keep its identifier. Your bank and tax details are held by Stripe, not by us.
Access logs: generated by serving pages and game files. Logs for the site itself record the visitor’s IP address. Logs for the game player do not.
Account security information: a one-way fingerprint of the IP address your account was created from, not the address itself.

How we use it

To run your account, serve games, and keep your library and your progress.
To save game progress for the games that use saves.
To run leaderboards, achievements, levels and Spice, and to decide voting eligibility.
To give a developer aggregate figures about their own game. Nothing we give a developer identifies a player.
To take payments and run memberships.
To reply when you write to us; to send mail about your own games and account (review outcomes, moderator edits, chat mentions, build and bandwidth notices); to tell you when a game you wishlisted or played the beta of goes live, when a beta you are testing gets a new build, or when you lose the top spot or drop out of the top ten on a leaderboard; and to send you news about spiced.gg. If you have an account, you get that news until you unsubscribe. Every announcement and notification has its own unsubscribe link, so turning one off does not turn off the others. Sign-in, support, review outcome, moderator edit and bandwidth mail has none.
To detect abuse, fraud, and one person running several accounts.
To keep the platform working and secure, and to meet legal obligations.

Payments

Purchases and memberships are processed by Stripe. Card details are entered on Stripe’s own payment page: the card number, expiry and security code never reach spiced.gg.

A game sold by a developer is sold through that developer’s own Stripe account, so their record of the sale is theirs. It holds what you enter on Stripe’s payment page, such as your email address and billing details. We send them nothing that identifies your spiced.gg account.

What games can access

A game receives your display name, your avatar if you have one, and a player id unique to that one game.

That id is not your spiced.gg account id, and two games cannot use their ids to recognise you as the same person. A game never receives your email address.

A game with an approved backend connects to its developer’s own server, which sees your IP address and whatever the game sends it.

What is public

Posting a score to a leaderboard puts your display name and avatar on that game’s public board, linked to a public player page showing the same name and avatar, the month you joined, and your current leaderboard spots. Achievements appear there only if you turn that on in your profile settings.

You can turn your name off leaderboards in your profile settings. Your scores still count and are still saved, and they stay on the boards, but shown as “Anon” with a number instead of your name and avatar, with no link to your player page; your player page stops listing spots.

A score you set while signed out goes on the board the same way, as “Anon” with a number. Nothing about you is stored with it, only the score and a hash of the play link it was set under, which expires within hours. Creating an account lets you put your name on it.

That page has its own address, one the platform assigns and one you chose if you claimed it. Neither is your account id, and the page never shows your email address.

If the page is shared somewhere that draws link previews, the service drawing the preview receives the display name and avatar it shows.

Service providers

Running spiced.gg means some information reaches the services that operate it:

Stripe, for purchases, memberships and developer payouts.
Google, if you choose to sign in with Google or link a Google account, and for advertising measurement. See the section below.
Amazon Web Services, which hosts the platform, stores its data, and delivers the email it sends.
Reddit, for advertising measurement. See the section below.

Each receives only what it needs to do that job. spiced.gg shares personal information with nobody else.

Advertising measurement

spiced.gg advertises on Reddit and on Google, and measures which of those ads bring people here. That works three ways, and each is described here rather than summarised as “analytics”:

Reddit’s advertising pixel runs on this site. In the European Economic Area, the United Kingdom and Switzerland it runs only once cookies are accepted; elsewhere it runs unless you reject. It records each page you view and when you create an account or take the developer role, and it sets cookies in your browser, including _rdt_uuid, which lets Reddit recognise the same browser across visits.
Google’s tag (Google Analytics and Google Ads) runs on this site. It records which pages you view and which of these steps you take: pressing Play on a game, the game starting, creating an account, taking the developer role, creating a listing, uploading a build, connecting Stripe, submitting a listing, publishing it, and buying a game. In those same three places it sets cookies, including _ga and _gcl_au, only once they are accepted; elsewhere it sets them unless you reject. Without cookies it sends nothing that identifies your browser.
Our own servers tell Reddit when you create an account or take the developer role. Your email address and IP address are scrambled first, so neither can be read back from what is sent. Nothing else you typed goes with it, and never your password.

These two scripts are the only ones here that spiced.gg did not write. Neither reads anything in your account, and nothing sent to either includes your name or email address.

When you take the developer role, spiced.gg keeps two notes on your account: the site or campaign that first brought you here, and the most recent campaign or ad click that did, each with the page you landed on and when. It uses them to tell which of its advertising reaches developers who publish. Neither note is shared with anyone.

In the European Economic Area, the United Kingdom and Switzerland, a first visit asks you to accept or reject these cookies before either script sets any; elsewhere they run unless you reject. Cookie settings in the footer lets you change your answer at any time, and the answer is kept for a year. None of this runs on the admin site.

Signing in sets our own cookie, __Host-spiced_rt, which keeps you signed in. Reject does not affect it.

How we measure the site

spiced.gg records which pages you view, which games you start, when you are asked to create an account and each step you then take (clicking the prompt, opening the sign-up page, sending the form, confirming the code), when you sign in, when a score you set as a guest is offered to you and when it is claimed, whether you were signed in, whether you have visited before, the kind of device you used (phone, tablet or desktop) and the site or campaign that brought you here, under a random id stored in your browser. It is used to see where visitors leave before creating an account, and for nothing else.

That id is minted by your browser, is not linked to your account even when you are signed in, and is shared with nobody. Clearing this site’s data in your browser resets it.

What we do not do

We do not sell your personal information.
We do not use what you play to build advertising profiles.
We do not show developers who bought their game. Their own Stripe account records each sale, as set out under Payments.

Retention

We keep information for as long as it is needed to run the service, keep it secure, settle payments, resolve disputes and meet legal obligations.

The periods that are set: access logs for the game player are kept for 14 days, access logs for the site itself are kept for a year as a security record, and the signup fingerprint above stops being used after 180 days. Your account information and play history are kept while the account exists.

Your privacy rights

Depending on where you live, you may have the right to ask what personal information we hold about you, to have it corrected, to have it deleted, and to object to or limit some uses of it. California residents may have further rights under the California Consumer Privacy Act, including the right to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information.

You can change your display name, your avatar and your password yourself in your profile settings. For anything else, use the contact form. We may need to confirm you are the account holder first. Using a right never costs you anything.

Deletion

To have your account and its data deleted, use the contact form. We delete it by hand. Three records are kept after that: the log of moderation and account actions, the ledger of Spice earned and spent, and the play events games recorded, which carry each game’s own player id rather than your account id. If you gave us an email address through a form without creating an account, ask us to stop writing to you or to delete it and we will. Every announcement and notification also carries a link that stops them.

Contact

Questions about this policy go through the contact form.

Privacy Policy