privacy policy.

the short version.

• we don't run ads, don't sell your data, don't sell our list, and don't run cross-site tracking.
• anonymous play stays anonymous. no account needed to browse or play.
• we use cookieless analytics (plausible) and cloudflare's privacy-respecting RUM beacon.
• the only cookie we set ourselves is the one that keeps you signed in if you choose to sign in.
• you can email hi [at] vibezilla [dot] games to access, export, or delete anything we have on you.

the rest of this page is the longer version of the same thing.

what we don't do.

because the absence of a thing is harder to see than its presence, here is the list of things we explicitly do not do — and commit not to do without re-asking you first:

• we don't sell your personal information to anyone, ever — and we don't "share" it for cross-context behavioral advertising as those terms are defined under California's CCPA / CPRA.
• we don't rent, trade, or syndicate our newsletter list to other publishers or marketers.
• we don't train AI models on your account data, your submissions, your uploaded images, or your newsletter address; we also don't pass any of it to third parties to train their models.
• we don't run advertising on the site — no ad networks, no affiliate trackers, no sponsored-content tracking pixels.
• we don't fingerprint you, build a cross-site profile, or use any "stateless" tracker that survives clearing cookies.
• we don't sell, embed, or call out to Google Analytics, Meta / Facebook pixel, LinkedIn insight tag, TikTok pixel, Hotjar, FullStory, or any session-replay tool.
• we don't use dark patterns to extract more data than we asked for. every form on the site asks for what's on it; nothing reads keystrokes, mouse movement, or clipboard contents.

if any of this changes in a way that affects you, we'll notify you and update this page before we start the new practice.

1. who we are.

vibezilla.games ("vibezilla", "we", "us", "our") is a small editorial publication and curated browser-game arcade. it is operated as a sole venture by Ori Iscovici (isco-tec), based in Israel. there is no company behind it, no investors, and no studio — just one person and an inbox.

for any privacy question, the email is hi [at] vibezilla [dot] games . this page covers everything at vibezilla.games and any subdomain we operate (e.g. api.vibezilla.games). it does not cover third-party games we link to or embed — those are run by their creators, who have their own policies.

2. what we collect, and where it goes.

we organize this by surface — the thing you actually do — rather than by category. it's easier to verify against your own behavior that way.

2.1 just browsing.

when you load any page on vibezilla.games without signing in or submitting anything, the only data we collect is what every web server gets by default and what privacy-respecting analytics needs to count page views.

• web server access logs — your IP address, user-agent string, the URL you requested, the referrer, and a timestamp. retained on the host (Cloudflare / our VPS) per their defaults (typically days, not months) and used only for security and debugging.
• plausible analytics — page-level metrics (URL, referrer, country, browser, OS). plausible is cookieless and does not build a profile of you across sites. data is aggregated and we cannot identify individual visitors from it.
• cloudflare web analytics (RUM beacon) — page-load performance metrics (timing, errors). cloudflare uses a session-scoped token at the CDN level for this; it is not used for advertising.

2.2 newsletter signup.

when you submit your email through any of the signup forms on the site, we collect:

• email address (required)
• source — a short tag identifying which form on which page you used (e.g. about, footer, press). this helps us understand which surfaces work; it is not personal data about you.

your email goes to two places: a notification email to the maintainer (so we know the form works), and — if a Resend audience is configured — the audience itself, which is what we use to actually send the newsletter. you can unsubscribe at any time from the link at the bottom of any newsletter we send. we will not contact you for any purpose other than the newsletter you signed up for.

2.3 submitting a game (or a creator profile).

the /submit form is the longest data surface on the site. depending on what you fill in, we can receive any of:

• your name (required) and email (required) — used to reply to you about your submission. that's it.
• creator profile fields — tagline, location, pronouns, site URL, other links, bio, and an optional avatar image (PNG / JPEG / WebP / SVG, up to 5 MB).
• game pitch fields — title, where to play it, optional video URL, one-line pitch, full description, why-it-fits paragraph, and an optional thumbnail image (up to 5 MB).
• "existing creator" toggle + optional profile slug, so we can match a returning creator to their existing record.

this data is sent to our own Cloudflare Worker, which:

• writes any uploaded image to a private R2 bucket (vibezilla-uploads), not exposed to the public web;
• generates a time-limited (default ~7 days) signed admin URL the maintainer can click to preview your image;
• sends the maintainer an email with all your fields and those signed image links via Resend.

once Supabase-backed submissions are live (currently rolling out), the same fields are also written to the submissions table in our Supabase project so we can keep editorial state on what's pending, approved, or rejected. the email becomes a notification on top of that, not the source of truth.

2.4 signing in (Google or email magic link).

you don't need an account to play games or read posts. an account is only needed for the high-value bits — submitting a game, saving favorites, and (eventually) joining the conversation. when you sign in via /sign-in, Supabase (our auth provider) creates an auth.users row and we automatically create a matching profile row in our database.

• via email magic link — Supabase stores your email and a record of the auth event. we store an empty profile keyed by your user ID, with a default display name derived from the local part of your email (e.g. jane from jane@example.com) until you change it.
• via Google OAuth — Google sends Supabase your name, email, and (when available) a profile picture URL. we store that as your starting profile. we do not receive your Google password and we cannot read your gmail, drive, or anything else.

any of the optional profile fields (slug, tagline, bio, location, pronouns, site URL, other links) are blank until you fill them in via the account page. your profile becomes a public creator page only once we accept at least one of your games — that's an editorial decision, not an automated one.

2.5 file uploads.

any image you upload through the submit form (avatar, game thumbnail) is validated server-side, sanitized, and stored in our private Cloudflare R2 bucket. we cap uploads at 5 MB and reject anything that isn't PNG, JPEG, WebP, SVG, or GIF. avatars stay private until your profile becomes a public creator page; only then is the avatar copied to a public bucket so it can be shown next to your work.

2.6 spam protection (the honeypot).

the submit and newsletter forms include a hidden field named _hp — a "honeypot" trap. it's invisible to humans (browsers and assistive tech leave it alone) but bots that fill in every field on the page tend to fill it in too. on our server, any submission with a non-empty _hp is silently dropped: we do not email you, do not write to the database, and do not log your other form fields. the honeypot does not collect data about you — its only job is to say "this submission was almost certainly automated".

we are telling you about it because hiding it would feel weird and bots don't read privacy policies. if you are a human filling out a form normally, you will never see or interact with this field.

2.7 game play tracking.

when you click play on a game, we record a small amount of first-party telemetry so creators can see how their games are doing and we can make better editorial decisions. specifically:

• the game's slug (e.g. neonix);
• the event type — play_started when you click play; a lightweight heartbeat sent approximately once per minute while you are actively playing (paused when the tab is hidden); play_ended when your play session ends; and game_milestone events that the game itself sends when something noteworthy happens (a level cleared, a high score, the round ending);
• a tab-scoped session identifier (a random UUID stored only in sessionStorage; it doesn't survive closing the tab);
• a per-play identifier (so multiple games played in the same tab don't get confused with each other);
• your profile ID — only if you are signed in; signed-out plays are stamped with an anonymous device ID stored in your browser, which you can clear at any time by withdrawing analytics consent;
• for play_started only, lightweight metadata: approximate device type (mobile / tablet / desktop); approximate screen-size category (small / medium / large); and — if the game was embedded on another site — the domain of that host page. we do not collect raw screen dimensions, full user-agent strings, or any data correlated with disability status (e.g. reduced-motion preference);
• for game_milestone events, a small set of game-specific gameplay numbers (e.g. golf stroke count, puzzle solve time, level reached) that the game declares in its source code. these are bounded — flat key/value pairs, max 10 keys per event, scalars only — and are purely about gameplay; no personal data, no cross-site identifiers;
• timestamps.

if you are signed in, we also compute a per-game engagement score from these events — a single number between 0 and 1 derived from how often you play, how long your sessions are, and whether you finish them. you can see this on your stats page. game creators see aggregate stats for their game (distribution shape, retention buckets) — they do not see individual scores tied to identifiable players. anonymous (signed-out) play does not get scored. the formula is documented in docs/operations/engagement-formula.md if you want to see how it works.

this is consent-gated. on your first visit you see a banner asking whether to allow analytics and confirming you are 16 or older; if you decline, no telemetry is recorded and no events are sent. you can change your mind at any time — see section 7 below for the manage-preferences control. legal basis: GDPR Article 6(1)(a), explicit consent.

if you have an account, withdrawing analytics consent also queues deletion of your linked play history from our servers. anonymous play sessions (where you were not signed in) cannot be retroactively purged because the session identifier used during play is temporary and cannot be tied back to you after the tab closes — but you can clear your anonymous device ID by withdrawing consent, which stops all future tracking.

we do not share this data with third parties, do not use it for advertising, and do not combine it with any external profile. it feeds creator stats, "this game has been played X times" social proof, and editorial decisions only.

2.8 your takes (comments).

every game page has a "takes." section where signed-in users can post short comments. anyone (signed in or not) can read what's already there. when you submit a take we store the body, your profile id, the game slug, and timestamps. that's it.

visibility. takes are public. they show on the game page to anyone who loads it. if you want to stay anonymous-ish, leave your display_name blank — non-creator profiles are already private, so you'll show up as a pseudonymous handle like player_a1b2c3. once we accept one of your games and you become a creator, your profile (and your display name on past comments) becomes public.

your display name updates live. changing your display name on /account updates how you appear on every past comment immediately. there is no "old name" cached on the comment row.

editing. within 5 minutes of posting you can edit a take. after that the row is locked. that's a server-side rule — client clocks don't get a vote.

deleting. you can delete your own take any time. deletion replaces the body text with [deleted] and marks the row as removed; the row itself stays so the thread's timeline still makes sense to other readers, but the words you wrote are erased. deleting your account cascades the entire row out (body included). a maintainer can also remove a take that breaks the rules — in that case the body is preserved as moderation evidence (Art. 17(3)(b)) but hidden from the public view; an audit row records who removed it and any reason given.

read-tracking. if you sign in and view a game page that has comments, we record one row per (you, game) noting when you last looked. it powers a "new takes" tile on /account/stats for creators so you find out when someone's responded to your work. that record is yours; it's kept until you delete your account, and it's exportable on request.

portability. Article 20 gives you the right to export your takes (and your read-tracking history). email hi [at] vibezilla [dot] games and we'll send you a CSV within 30 days.

2.9 legal basis under GDPR.

for visitors in the EU/EEA, UK, or Switzerland, GDPR Article 6 requires us to identify a legal basis for each kind of processing. in plain terms, here is the basis for each surface above:

• just browsing (access logs, plausible, cloudflare RUM) — Article 6(1)(f), our legitimate interest in keeping the site secure, debugging issues, and counting page views in aggregate without identifying you. you can object to this processing under Article 21.
• newsletter signup — Article 6(1)(a), your explicit consent. you withdraw it any time via one-click unsubscribe at the bottom of every issue.
• game submissions — Article 6(1)(b), to take steps at your request before entering into a possible editorial relationship (i.e. reviewing your pitch). storage of your contact email is also Article 6(1)(f) so we can reply.
• account creation + sign-in — Article 6(1)(b), to provide the account features you are asking for, plus Article 6(1)(a) where any optional profile field is concerned.
• file uploads (avatar, thumbnails) — Article 6(1)(b) where part of a submission, Article 6(1)(a) where part of optional profile editing.
• game play telemetry — Article 6(1)(a), your explicit consent via the analytics banner. you can withdraw consent at any time from section 7 below; declining or withdrawing stops all telemetry collection.
• comments — your authored take — Article 6(1)(b), to deliver the commenting service you've explicitly opted into. without storage there's no service.
• comments — public broadcast — Article 6(1)(f), our legitimate interest in operating the public comments surface. you submitted into a labelled, publicly visible compose box on a public game page; the obviousness of the broadcast context outweighs the residual privacy interest, and the 5-minute edit window plus self-delete tombstone path give you meaningful post-submission control.
• read-tracking (comment_reads) — Article 6(1)(b), to deliver the "new takes since you last looked" feature on /account/stats. it's your own behavioral data about your own reading; we don't use it for anything else.
• responding to legal requests — Article 6(1)(c), legal obligation, in the rare cases that applies.

we do not process special-category (sensitive) data under Article 9. if you volunteer it in a freeform field — bio, pitch, etc. — please don't, and we may redact or remove it.

3. who else sees this data.

the short answer: only the providers we actually use to run the site. we do not sell, rent, or trade any data. we do not share data with advertisers or data brokers. we do not feed your data into AI training.

the long answer is the table of providers below. each one is a sub-processor in GDPR terms — they handle data on our behalf under their own published terms.

• Cloudflare — DNS, edge caching, the Worker that handles /api/*, the R2 bucket your uploads land in, and the privacy-respecting RUM beacon. all browsing and submission traffic passes through Cloudflare's network. policy: cloudflare.com/privacypolicy.
• Plausible Analytics — anonymous, cookieless, aggregated page metrics. no cross-site profile, no advertising IDs, no fingerprinting. policy: plausible.io/privacy.
• Supabase — authentication and database. holds your user record, your profile row, and your submissions. project region: US East (N. Virginia). policy: supabase.com/privacy.
• Resend — transactional email and (when configured) newsletter audience. holds the email address you signed up with and delivery metadata. policy: resend.com/legal/privacy-policy.
• Google — only relevant if you sign in via Google OAuth. Google sends us your name, email, and profile picture URL, and gets the standard OAuth consent flow data on their side. policy: policies.google.com/privacy.

beyond these, we may disclose data when we are legally required to — e.g. a binding court order or a valid law-enforcement request. we will resist over-broad requests where we can, and notify you where the law allows us to.

4. cookies + similar tech.

we run a small consent banner — only for game play telemetry. the rest of the site is built so it doesn't need one. modern privacy practice splits cookies and similar trackers into four categories; here's our position on each:

• strictly necessary / functional — yes, one. when you sign in, Supabase sets an httpOnly session cookie so you stay signed in across pages. that is the only cookie we set ourselves. if you don't sign in, this cookie does not exist. no consent banner is needed for it under the ePrivacy Directive because it is strictly necessary for a service you explicitly requested.
• performance / RUM — yes, one beacon. Cloudflare's Real User Monitoring beacon may use a session-scoped token at the CDN level to measure page-load timing and JavaScript errors. it is not used for advertising or cross-site tracking.
• page-view analytics — yes, one tool, cookieless. Plausible counts page views and referrers in aggregate without setting a cookie or storing a device identifier. legal basis: legitimate interest. no banner needed.
• game play analytics — yes, consent-gated. on your first visit a small banner at the bottom of the page asks whether to allow first-party game telemetry (see section 2.7 for what this records). decline and nothing is collected. your choice is stored in three local-storage keys on your device: vbz_consent (your accept/decline choice), vbz_sid (a tab-scoped UUID, only if you accepted, only for the lifetime of the tab), and vbz_event_queue (a short outbox for events that haven't been delivered yet, also only if you accepted). these are strictly first-party — no other origin can read them.
• advertising / marketing / cross-site — no. none. not now and not on the roadmap. specifically, we do not run Google Analytics, Google Ads, Meta / Facebook pixel, LinkedIn insight tag, TikTok pixel, Hotjar, FullStory, or any other ad-network, retargeting, session-replay, or device-fingerprinting tag.

5. where the data lives.

• uploaded images live in Cloudflare R2 (Cloudflare's distributed object storage).
• auth + database live in Supabase, project region US East (N. Virginia).
• newsletter audience + transactional email live with Resend (US-based).
• analytics are aggregated by Plausible (EU-hosted).
• web server logs live with Cloudflare and our VPS host.

if you are in the EU/EEA, UK, or Switzerland, your data may be transferred to the United States as part of using these providers. each of them publishes its own safeguards (Standard Contractual Clauses, EU-US Data Privacy Framework certifications where applicable). we do not transfer your data to providers other than the ones listed above.

6. how long we keep things.

• game submissions — kept until acted on, and then archived as part of our editorial history. if you ask us to delete a submission you sent us, we will, except where we need to keep a minimal record for fraud or abuse reasons.
• accounts — kept until you delete them. you can delete your account from /account (when that page is live; until then, email us and we'll do it within a few days). on deletion, your auth row is removed from Supabase and your profile + submissions are cascaded out.
• uploaded images — kept while the associated submission or profile exists; removed when the parent record is removed.
• newsletter audience — kept until you unsubscribe. one-click unsubscribe is at the bottom of every issue.
• page-view analytics (Plausible) — aggregated and retained per the provider's defaults; not tied to an identified person on our side.
• game play telemetry — raw events kept for 14 days, then deleted. aggregated stats (per-game play counts, per-game daily totals) are retained indefinitely because they're not tied to individuals once aggregated. you can withdraw consent any time from section 7; that stops new collection but doesn't retroactively delete the existing rows — email us if you want those purged immediately.
• access logs — kept by the host (Cloudflare / VPS) per their defaults; we do not export or analyze them at the identified-user level.
• creator requests — when a creator files an update or removal request from /account/stats, we store the request (game slug, kind, the freeform reason text, status) so the maintainer can triage and the creator can track status on /account/requests. legal basis: Art. 6(1)(b) — performance of the creator service you've signed up for. the request is kept while it's still relevant; you can delete your own request rows under your right-to-erasure (it's a single-row delete on your account). deleting your account cascades the rows out automatically.
• comments ("takes") — kept until you delete the take or your account. self-deletion replaces the body text with [deleted] but leaves the row as a thread-continuity marker (see section 2.8). a take removed by a maintainer keeps its body as moderation evidence (Art. 17(3)(b)) but is hidden from the public view. account deletion cascades every comment row out entirely (body included).
• comment read timestamps — one row per game you've visited while signed in, recording when you last looked. powers the creator-side "new takes" tile. kept until you delete your account; you can also email us to clear it ahead of that.

7. your rights.

depending on where you live, you have some or all of the following rights over the data we hold about you. we honor them everywhere we can, regardless of jurisdiction:

• access — ask us what we have on you.
• correction — fix anything inaccurate.
• deletion — ask us to remove your data, subject to legal limits (e.g. an active fraud investigation we have to keep records for).
• portability — get a copy of what we have in a sensible machine-readable format.
• objection / restriction — ask us to stop or limit certain processing.
• withdraw consent — where we relied on your consent (e.g. newsletter, game play telemetry), you can pull it back at any time. one-click unsubscribe in any newsletter we send; analytics consent is managed by the control just below.

the easiest way to exercise any of these rights is to email hi [at] vibezilla [dot] games . we aim to respond within 30 days. we'll verify your identity (usually by replying from the email tied to your account) before acting on deletion or export requests.

if you are in the EU/EEA, UK, or Switzerland, the GDPR applies and you have the right to lodge a complaint with your local data protection supervisory authority. if you are in California, the CCPA / CPRA applies and you have the right to know, delete, correct, limit the use of sensitive personal information, and not be discriminated against for exercising your rights — and we again confirm that we do not sell or "share" personal information as those terms are defined under California law (including for cross-context behavioral advertising). since the operator is based in Israel, the Israeli Privacy Protection Law (5741-1981) — as amended by Amendment No. 13, in effect since August 2025 — also applies, and the Israeli Privacy Protection Authority is the relevant regulator on our end. Amendment 13 broadly aligns Israeli privacy law with GDPR; we treat the two as a single, GDPR-grade standard for everyone, regardless of residence.

8. children.

vibezilla is not directed at children. we do not knowingly collect personal information from anyone under 16 (the GDPR digital-consent threshold). to submit a game or create an account, you must be at least 16 years old, or — where local law sets a different threshold — the minimum age of digital consent in your country, with parental or guardian consent if your local law requires it. if you believe a child has given us personal information, email us and we will remove it.

to use game-play analytics features (see section 2.7), you confirm you are at least 16 years old (or the minimum digital-consent age in your country) when you click Accept on the analytics banner. declining the banner stops all telemetry collection.

9. security.

we use TLS for all traffic. uploads are validated for type and size before they hit storage. signed admin URLs use HMAC-SHA256 and expire in days, not forever. database writes happen via a server-only service-role key from our Worker — your browser never holds it. that said: no system is unbreachable, and we won't pretend otherwise. if you find a vulnerability, please email hi [at] vibezilla [dot] games and we'll respond.

10. data breach notification.

in the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we commit to:

• notify the relevant supervisory authority (e.g. an EU/EEA data protection authority, the Israeli Privacy Protection Authority, or the UK ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and Israeli Privacy Protection Law Amendment 13;
• notify the affected users directly, by email to the address we have on file, where the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34) — including a description of what happened, what data was involved, what we're doing about it, and what you can do to protect yourself;
• document every breach, regardless of whether external notification is required.

if you receive a breach notification email from us, we will never ask for your password or for payment in response. real notifications will simply describe what happened and what you should do.

11. respecting other people's rights.

we do our best to respect intellectual property and the privacy of the people behind the games we feature. if you find anything on vibezilla — a screenshot, copy, image, link, or any other content — that you believe violates your copyright, trademark, name and likeness, privacy, or other rights, email hi [at] vibezilla [dot] games with enough detail for us to find the content, and we'll act fast — usually within a couple of days. this complements the formal copyright/DMCA process described in our Terms of Service, but you don't need to file a formal notice to get our attention; a plain-language email is enough.

12. changes to this policy.

if we make material changes — adding a provider, changing what we collect, expanding retention — we'll bump the "last updated" date at the top of this page and, for changes that affect anyone with an account or a newsletter subscription, send a notice to the email address on file. small typo fixes and clarifications won't get an email. continuing to use the site after a material change means you accept the updated policy; if you don't, the unsubscribe and delete-account paths above are always open.

13. contact.

questions, requests, complaints, suggestions: hi [at] vibezilla [dot] games . we read every email. we always reply.