Privacy

Zaisma keeps as little about you as it can. Most games need no account, and guests leave nothing behind.

Playing as a guest

Guests get a temporary ID and a made-up name like "Swift Fox 42", used only to run the game session. They're kept in your browser tab and forgotten when it closes. We don't keep a profile, and we don't know who you are.

Your browser also remembers which games you played recently, so the home page can show them first. That list stays on your device; we never see it.

When you press Play, we count it for the game's developer and for lists like Popular: that the game was played, how long it was on screen, and whether this browser played it before (and on which day it first did). To keep the counts honest, Cloudflare checks, invisibly, when you open a game's page that it's a real browser, and we count players by internet provider (like Comcast or Vodafone) to spot bot networks. The same check lets you play online in multiplayer games, so bots can't fill their rooms. A play's details are kept for a day at most; after that we keep only totals for each game and day, never anything that says who played.

Zaisma measures how games run (load time, frame rate, crashes) by browser and device type, only as totals.

If you make an account

• Your username, the one you pick. Everyone can see it.
• Your password. Only Supabase, our sign-in provider, keeps it, as a scrambled hash nobody can read back. When you pick one, we check it isn't known from a data breach without sending it anywhere.
• Your email, only if you add one, as a way back in if you forget your password. We email it a code only when you ask for one. It's never shown to anyone, and we don't send marketing.
• Your player ID. When you're signed in, the games you play, and the sites you choose to sign in to with Zaisma, know you by a player ID, the same everywhere, and can look up your username with it. They never get your email, your age or anything from other games. Your account page lists the sites, and you can remove any of them.
• Your age group: 13 to 15, 16 or 17, or 18 and over. If you're under 18 we also keep your birth date, so your account moves to the next group on your birthday by itself, and we delete it when you turn 18. If you're 18 or over when you make an account, we never keep it. It's never shown to anyone.
• Your game saves. If you're signed in, your game saves are stored with your account, so your progress follows you to any device.
• The games you played. The last 20, so Continue playing follows you to any device too, and which games you've ever played, so their developers can be told if you delete your account.
• Your passkeys, if you add any: the public half of each key, the kind of device you added it on (like "iPhone") and when you last used it. The private half never leaves your device or password manager.
• The devices you sign in on. Each browser you sign in on keeps a random ID in a cookie, and we note that your account signed in with it, so your password always opens your account there, even while someone elsewhere is guessing it. The note goes a year after your last sign-in on that device.
• Your account's activity. For 90 days, sign-ins on a new device and changes to how you sign in or to your API keys, each with the device (like "Chrome on a Windows PC"), the network (like Vodafone) and the rough place (like near Manchester, UK) it came from, which we work out from your connection address without keeping it. Only you see it, on your account page. Turn off Keep where my account is used from there and we keep only what happened and when.
• Wrong passwords typed for your account: when, and whether it was on a device you'd signed in on. Never what was typed. Kept for a day.
• If you sign in with Google or Discord, they give us your email, plus the name and profile picture on that account. We only use the email, to sign you in; Supabase keeps the rest with your sign-in.

Accounts are for people 13 and up. If you're younger, you can't make one, and we keep nothing you typed. If we find out we have an account for someone under 13, we delete it.

Cookies

We only use cookies to keep you signed in, to remember where you are while you make an account, and to know a device you've signed in on before. No ads, no tracking, no analytics cookies.

Reports

When you report a game or a player, we keep what you wrote and nothing about you. Reports about a player include their temporary ID or name so we can act on it. If you include a picture of the game with your report, we keep it until the report is dealt with and delete it within 30 days.

Games

Games run on a separate domain and can't see your account, email or cookies. Our content rules don't allow games to ask for your personal details.

Some games run online play on their developer's own servers, named in the game's menu. Those servers see your connection address, as any website you visit does, and what the game sends them. They never get your email or your age.

Buying in games

When you buy something in a game, payment goes through Stripe. When you save a card, Stripe keeps it and Zaisma keeps its brand, its last four digits and the email for receipts; the developer you buy from gets the payment, never a card they can charge again. We keep what you bought and when, so it stays yours on any device.

If you make games

What you and your API keys do to your games (uploads, publishes, database and save changes, secrets and the rest) is kept in each game's history for as long as the game, with who did it and from where, so you can see it. Each change also keeps its connection address for 90 days, shown only to you, so a report of illegal material can be traced to whoever uploaded it. Keep where my account is used from turns that off, except for uploads: a version's or an image's upload keeps its address for 90 days either way. To tell you when a key is used from somewhere new, we keep a fingerprint of each network and country it's used from, never shown, until it's gone unused for 90 days.

Backups

Every night Zaisma copies what it keeps to a backup at Backblaze, in the United States, so a disaster at our servers loses nothing. Nobody can change or delete a copy for 28 days, not even us, so for up to 30 days after something is deleted here, a copy of it can still be in the backup; then it's gone. We only read the backup to bring Zaisma back after a disaster, and a restore never brings back what was deleted.

Who helps us run Zaisma

• Cloudflare runs our servers, stores games, sends the email codes you ask for, and checks that a real browser opened a game's page, made an account, typed a password on a new device or asked for an email code. It sees your connection address to deliver pages and stop abuse; we keep it only where this page says. The check is Cloudflare Turnstile, covered by its Turnstile Privacy Addendum.
• Supabase handles sign-in: it checks your password, keeping only a hash, and holds your email if you added one. When you sign in, we pass it your connection address, so its limits on tries count you and not everyone at once, and it keeps that address with each sign-in. Your browser never talks to it directly.
• Stripe takes payments when you buy something in a game, and keeps the cards you save. The developer you buy from gets the payment through their own Stripe account, with the email for receipts.
• Anthropic reviews uploaded games for safety. It sees game files, never players.
• Backblaze keeps Zaisma's nightly backup, in the United States. It only stores the copies, encrypted.

We never sell your data, and there are no ads on Zaisma.

Downloading your data

Go to your account page and choose Download your data. You get one .zip with everything we keep about your account, your game saves as files, and a note saying what each file holds.

Deleting your account

Go to your account page and choose Delete account. Your username, password, any email, game saves, recently played games and everything else on your account are deleted straight away. Their copies in our backup are gone within 30 days. If you made games, they're deleted too, with their files, database and players' saves. Games you played and sites you signed in to with Zaisma are told, so their developers can erase what they kept about you.

Questions

Email privacy@zaisma.com.