Last updated 23 September 2026
This policy explains what SLOP AI GAMES, operated by JSM Digital Engineering, collects and what we do with it. It is written to be read, not to be survived.
| Data | Why | Kept for |
|---|---|---|
| Email address | Identifies your account, lets us contact you about it | Until you delete the account |
| Password | Signing in. Stored only as a salted PBKDF2 hash — we cannot read or recover it | Until you delete the account |
| Game saves | So paid accounts can play across devices | Until you delete the account or overwrite them |
| Session record | Keeps you signed in: the public half of a key your browser made when you signed in, with a hashed session id. On its own it cannot be used to impersonate you — that takes the private half, which never leaves your browser | 60 days, or until you sign out |
| Recent request codes | Each signed-in request carries a one-use code, remembered briefly so a copied request cannot be sent again | 15 minutes |
| Failed sign-in attempts and password reset requests, with IP address | Rate limiting, so nobody can brute-force your password or flood an inbox with reset emails | 15 minutes |
| Password reset link | Only if you ask for one: a hash of the one-time code in the link we email you, and when it was made. The link works once, for 30 minutes | Deleted when used, and within an hour regardless |
| Download link | Only if you download a Free Bin program that needs an account: which file, your account ID, and a hash of the link's one-time code. The link lasts 12 hours so a stopped download can pick up again | 12 hours |
| Active game session (signed-in players) | Account ID, game, which of your signed-in browsers holds it, hashed random session token and expiry; prevents conflicting online sessions and cloud-save overwrites. No IP/DNS matching or fingerprinting. | One current record per account/game, valid for three minutes unless renewed. Replaced by the next session, or removed with the account. |
| Orion: Tactical Protocol commander | Only if you play Orion. The game keeps your account ID (never your email address), the display name you chose, if any, and your commander: its name, planets, fleets, crew, battles and reports, the empire it belongs to and its chat settings. Other commanders see your commander's name and empire tag, and what you hold within their sensors' range; members of your empire also see your population and planet count. Orion signs you in with its own session record, of the same kind as the site's | Until you delete the account. Backup copies of the galaxy are kept for up to 12 months |
| Orion chat messages | Only if you use Orion's chat: what you wrote, when, and your commander's name and empire tag. Galaxy messages are shown to every Orion player, and Empire messages to your empire's members. Slurs are masked before a message is stored | A week at most, and never in backups. Deleted with your account |
| SpaceScape realm chat | Only if you use SpaceScape's chat: what you say is relayed to the players near you, with your display name (chosen or made up, never your email address) | Not stored, unless somebody reports it (next row) |
| Player reports | If you report another player's chat, or somebody reports yours: the message, the display names and player ids on both sides, the reason and any note, so the operator can act on it. Each report is also emailed to the operator | A year, whatever happens to the accounts in it |
| Block list | Only if you are signed in and block another player in a game: their player id and display name, so the block follows you between devices. As a guest the list stays in your browser | Until you unblock them. Deleted with your account |
| Scraphold yard | Only if you play Scraphold, signed in or not: your yard, its level, a display name (chosen or made up, never your email address) and when it was last raided, published so other players can raid it | Until a month after you last open the game |
If you submit a game through the submissions form, we keep what you typed into it so we can read and reply to it, and the IP address it came from, to stop the form being flooded.
None. The site sets no cookies, for signing in or for anything else.
Signing in instead makes a key pair in your browser. The private key is kept in your browser's storage (IndexedDB) in a form that no script — ours included — can read or copy out; the browser will only use it to sign requests to this site. Only the public half is sent to us. Signing out deletes the key from your browser and the session from ours.
If your browser still has a cookie from before the site stopped using them, the site tells your browser to delete it the next time it is sent.
Games also store progress in your browser's local storage. That stays on your device and is never sent anywhere unless you have cloud saves, with two exceptions: Orion keeps your commander on our servers, and Scraphold publishes your yard so that other players can raid it (both are in the table above).
A browser lock helps prevent duplicate game tabs. A random game-session token in session storage lets a signed-in tab reconnect after a reload; it is sent to our session service, not to advertisers. It does not identify you across accounts, devices or websites.
We do not send your data anywhere else.
Under the Australian Privacy Principles you may ask us to show you the personal information we hold about you, correct it, or delete it. Email jsm.de@hotmail.com and we will action it. Deleting your account removes your email address, password hash, sessions, saves and block list, and your Orion commander and chat messages if you have them.
If you are unhappy with how we have handled your information, contact us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Passwords are salted and hashed. A session is bound to a key your browser cannot export, and every signed-in request is signed with it. Everything is served over HTTPS. No system is perfect: if a breach ever affects your data, we will tell you and notify the OAIC where the law requires it.
Accounts are not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, email us and we will remove it.
If this policy changes materially we will say so on the site before it takes effect. The date at the top shows when it last changed.
See also: Terms of Service · Refund Policy