Privacy Policy

Last updated November 4, 2026

Onceworlds runs onceworlds.com, where people play and publish browser games. This policy explains what we collect and why.

What we collect

• Account. If you sign up with just a username, your username and password; we keep only a salted hash of the password, never the password itself, and without an email a forgotten password can't be reset. If you sign up with email, your email address and password (held by our sign-in provider, never by us in readable form). If you sign in with Google, your Google email address and account id (we never copy your Google name or picture, but our sign-in provider keeps what Google sends; see below). If you sign in with GitHub, your GitHub user id, username, avatar, email address, and the ids of the GitHub organizations you belong to, which help find candidate games; repository permissions decide which games you can manage.
• Profile. Your display name, @username, the About text you write, your avatar, your friends and friend requests, the games you favorite and your likes and dislikes. Your profile (display name, @username, avatar, About and badges) is public. Your friends list and favorites are visible to you and your friends. Which game you're in (and its server) is shown only to your friends; game pages show how many people are in each server, not who.
• Playing. A random player id (for guests) or your account id, your display name, the progress games save for you, the badges you earn, your leaderboard scores (shown to everyone with your display name) and ratings, the list of games you have played, and the chat messages you send. Scores, ratings and the list of games are kept until you delete your account (or the game is deleted). In ranked games, the matches whose results you disputed are kept 30 days, and how many rated matches you played against each opponent 2 days, so nobody can veto their losses or farm wins. Chat is delivered to players in the same room (direct and group messages only to their recipients, never to the game's own code); the last 50 public messages stay in the room while it's open. Messages with blocked words are dropped or masked; a short count of recent blocked messages is kept on your account, and repeated ones pause your chat for a few minutes.
• Played with. When two signed-in players are in the same server we remember the pair for 30 days, so Onceworlds can suggest them to each other as friends. A suggestion says "Played together", never which game. A player who hides when they're online, or turns off "Suggest me to people I've played with" in Settings, isn't suggested.
• Connected tools. If you connect an AI tool on Upload so it can build games for you, we keep the kind of computer (Mac, Windows or Linux), when you connected it and when it last pushed a draft, until you disconnect it or delete your account. A login code also keeps the country it was asked from for ten minutes, so the page that approves it can say where it came from. We keep only a one-way hash of its token, and the token can't publish anything.
• Notifications. If you turn notifications on for a device, we keep that device's push address and keys until you turn them off or log out there, or 30 days after the device was last used. When a message, friend request or invite arrives while you have no Onceworlds page open, we send it through your browser's push service, encrypted so only your device can read it. Notifications show the sender's name (and a message's text) on your lock screen; turn off "Show names and text in notifications" in Settings and they only say what happened ("New message", "New friend request").
• Analytics. When you play we record when the play started, how long the game was on screen, whether you pressed a key or tapped in the game (never which key, or where), your country (from our host), your device type and the referring website's domain. We don't store IP addresses. We delete these records after 30 days. Opening a game's page or its play page adds one to that game's count for the day, with nothing about you. Errors from games (message and stack trace) are kept for 30 days.
• Safety. For each player, a keyed hash of the networks (IP addresses) they used in the last 90 days, never the addresses themselves, so we can block people who abuse Onceworlds. These are kept for up to 90 days even if the player's account is deleted, so a ban can't be dodged by deleting the account. To slow down password guessing and automated sign-ups we keep keyed hashes (never the values) of sign-in names and networks after wrong passwords, and of the proofs of work a browser solved, for a day; the ids of ended sessions for up to 31 days; and the counts of new guests, accounts, free games, friend requests and email requests per network for two days. Rooms keep hashed networks in memory while a server is open, to enforce seat limits and removals.
• Reports. When you report a player or a game we keep the report: who reported, who or what, the reason, and for a player their display name, @username and About at that time, and the message you quoted. Only Onceworlds staff read it. Answered reports are deleted after 90 days, unanswered ones after 180.
• Copyright notices. If you send a copyright notice or counter-notice, what you write in it, your contact details and signature, and a keyed hash of your network (never the address). The item's seller sees a notice's name, company and what it says about the work, never its contact details; a counter-notice, contact details included, goes to whoever sent the notice, as the law requires. Kept as a record of the takedown.
• Creators. Repository names, deploy details (branch and commit), the files you publish, images and videos you upload, badges, variables and secrets. We keep the creator's GitHub id with new-game timestamps for two days to enforce the creation limit. Secrets are encrypted and only ever sent to the API you bind them to.
• Credits and purchases. Your plan, your credit balance and its history (credits given, bought, used and taken back, with the AI model and tokens each request used), whether you said you're 18 or older or a parent or guardian when you bought, and the id Stripe gives you as a customer. Your card and billing address go to Stripe, never to us. Kept until you delete your account.
• Cookies. ow_sid keeps you signed in, or remembers your guest player. During sign-up and GitHub or Google sign-in our sign-in provider sets a short-lived cookie, connecting GitHub to your account sets ow_link for 10 minutes, a password reset link sets one for 15 minutes, and signing up or asking for a sign-in link by email sets ow_pending for a day so the link only signs in that browser. We don't use advertising or third-party tracking cookies.

Games are made by other people

Each game runs in an isolated, opaque-origin frame on onceworldsusercontent.com. A game can see your player name and id and what you do in it, but cannot use browser cookies or storage while embedded. It can save progress through Onceworlds and cannot read your Onceworlds cookie. Games can load code from public libraries (such as jsDelivr, unpkg and esm.sh) and Google Fonts, which see your IP address when they do. When a game calls an AI or media service through Onceworlds, what the game sends, which can include what you type, goes to that service (for example Anthropic or OpenAI) under the creator's account.

Who processes data for us

• Cloudflare hosts Onceworlds and processes IP addresses and request details to deliver and protect it.
• Supabase handles sign-in, passwords and account emails. If you sign in with Google or GitHub, it keeps the name and picture they send, even though Onceworlds does not copy them.
• GitHub provides sign-in and, if you import a repo, the GitHub App integration.
• Google provides sign-in with a Google account.
• Resend delivers our emails: the ones Supabase sends for us (confirmations and password resets), and the game creation guide Pro members get.
• Stripe processes payments (your email, card and billing address) and works out tax.
• OpenRouter runs the AI that builds your games, on a model company it picks: what you write to it, and the files and pictures of your project it reads, go to OpenRouter and that company.
• Push services (Google, Mozilla, Apple and Microsoft, whichever your browser uses) carry notifications to your devices. They receive the encrypted notification and your device's push address.

How we use it

To run Onceworlds, keep it secure, prevent abuse, show creators aggregate stats about their games, and fix problems. We don't sell personal information or use it for advertising.

Your choices

Request account deletion any time in Settings. Your platform sessions end immediately; if our sign-in provider is temporarily unavailable, deletion is retried automatically. To get a copy of your data, use Download my data in Settings: a JSON file with your account, saves, scores, friends, messages you sent and more (once an hour). In Settings you can also stop being suggested as a friend and choose what notifications show. Email support@onceworlds.com to correct your data or ask about it. Signing out removes the cookie from your browser.

Children

Onceworlds isn't directed to young children. If you think a child has given us personal information, email us and we'll delete it.

Retention

Account data is kept until deletion. A request in Settings signs you out immediately and removes your data; provider or database failures are retried automatically. A keyed hash of a deleted account id is kept for 30 days so an already-issued sign-in token cannot recreate it. Guest players nobody has used for 60 days are deleted with their saves and badges. Analytics are deleted after 30 days, game errors after 30 days, and API-call counters after two days. To limit sign-up attempts, new guests, friend requests, API calls and visits counted from one network we keep a keyed hash of the IP address (not the address) for one to two days. The hashed networks kept for safety are deleted after 90 days. A deleted account's @username stays reserved for 30 days (a changed one for 14) so nobody can pose as its owner.

Some things outlive an account on purpose, so a ban can't be dodged by deleting it: the ban itself (the banned account's id and GitHub id, and the reason), and any report about the account, which is kept for 90 days once answered and 180 days if not. A direct chat with a deleted account is deleted for both people. Games published from your GitHub account are not deleted with your account: they become private and stay on Onceworlds until you delete them from your Library, so do that first if you want them gone. Games you uploaded from the dashboard are deleted with your account.

Records of sales, bought or sold, are kept after an account is deleted, as tax and payment law requires.

Changes

We'll post changes here and update the date above.

Contact

support@onceworlds.com