Privacy Policy

Last updated 15 October 2026

The short version. We collect what's needed to run your account and the games, and nothing else. No tracking, no analytics, no ad cookies, and we don't sell data. Your username, profile, games, comments and scores are public. You can download your data or delete your account in Settings whenever you like.

1. Who's responsible

Alex runs Snackbar and is the data controller for your personal data. For anything privacy-related, email [email protected].

2. What we collect

If you just play, without an account, we store nothing that identifies you. We count plays per game, but anonymously. Your IP address passes through Cloudflare and our server so pages can be delivered and protected (see section 5). Our app keeps it in memory for a short time for rate limiting, and doesn't write it to its database or logs.

If you make an account, we store:

  • your username, display name, avatar and bio;
  • your password, stored only as a salted scrypt hash. We can't see it;
  • what you do on the site: games played (by day), scores, likes, ratings, comments, XP, badges and streaks;
  • games and covers you upload, and their details;
  • when you agreed to these terms.

If you send a report, we store the reason, your message and, if you give it, your email address, plus your username if you were signed in.

We don't ask for your real name, email (unless you report something), location, birthday or phone number.

3. What's public

Your username, display name, avatar, bio, level, XP, badges, the games you've uploaded, your comments, the rating you gave a game (shown next to your comment), your leaderboard scores and your Hall of Fame placings can all be seen by anyone, including search engines. Don't put anything in your bio or comments you wouldn't want public.

4. Why we use it (legal bases)

  • To provide the service you signed up for (contract): your account, profile, uploads, XP, scores, ratings and comments.
  • Legitimate interests: keeping the site secure, stopping spam, cheating and abuse, handling reports, and keeping backups.
  • Legal obligations: responding to valid legal requests and takedown notices.
  • Consent: only if we ever add optional things like ads or analytics, and we'll ask first.

5. Cookies and storage

We set one cookie, __Host-snk_session, and only when you sign in. It keeps you logged in, lasts up to 30 days, and is strictly necessary, so it doesn't need a consent banner. Your theme choice (light or dark) is saved in your browser's local storage and never sent to us. No analytics, advertising or tracking cookies.

Games run on play.snackbar.games. Some games save progress in your browser on that address. Games uploaded by players, especially hosted-link games, can load content from other servers, which then see your IP address. That's outside our control. Each game page shows where it comes from.

6. Who we share it with

We don't sell or rent personal data, and we don't share it for advertising. We use a few service providers to run the site, who only process data on our behalf:

  • Cloudflare handles DNS, delivery, caching and security for every request, so it processes IP addresses and request details. See Cloudflare's privacy policy.
  • Oracle Cloud Infrastructure hosts our server and database, in its UK (London) region.

If a game you uploaded gets a copyright complaint, we may share the complaint with you, and your username and the game with the complainant. We'll disclose data to authorities only when legally required.

7. International transfers

Our server is in the UK, which the EU recognises as having adequate data protection. Cloudflare operates worldwide and may process data in other countries, including the US. It relies on recognised safeguards such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

8. How long we keep it

  • Account data: until you delete your account.
  • Login sessions: up to 30 days, or until you sign out.
  • Reports: while open, then one year after they're resolved, in case of disputes.
  • Backups: daily snapshots, kept for 14 days. Deleted data disappears from backups within that time.

9. Your rights

Depending on where you live (including under the EU and UK GDPR), you can:

  • see and download your data: Settings → Download my data;
  • correct it: edit your profile any time;
  • delete it: Settings → Delete account removes your account, games, comments, ratings and scores straight away;
  • object to or restrict how we use it, or withdraw consent you've given;
  • complain to a data protection authority. In Cyprus that's the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority where you live.

For anything you can't do in Settings, email [email protected]. We'll reply within one month.

10. Children

Accounts are for people aged 16 and over. We don't knowingly collect data from younger children. If you think a child under 16 has made an account, tell us and we'll delete it. If we ever show ads, they won't be personalised for anyone we believe is under 18.

11. Security

Everything is served over HTTPS. Passwords are hashed with scrypt. Uploaded games run on a separate address in a sandbox, so they can't read your login. We keep the server patched and backed up. No system is perfect: if we ever have a breach that affects you, we'll tell you and the authorities as the law requires.

12. Changes

If we change this policy, we'll update the date at the top. If a change is significant, for example adding ads or analytics, we'll put a notice on the site before it takes effect.