Privacy Policy — SLOP AI GAMES

This policy explains what SLOP AI GAMES, operated by JSM Digital Engineering, collects and what we do with it. It is written to be read, not to be survived.

The short version: we collect an email address, a password we cannot read, and your game saves. We do not run analytics, we do not use tracking cookies, and we never sell or share your data.

What we collect

Data	Why	Kept for
Email address	Identifies your account, lets us contact you about it	Until you delete the account
Password	Signing in. Stored only as a salted PBKDF2 hash — we cannot read or recover it	Until you delete the account
Game saves	So paid accounts can play across devices	Until you delete the account or overwrite them
Session record	Keeps you signed in. Stored hashed, so a database copy cannot be used to impersonate you	60 days, or until you sign out
Failed sign-in attempts, with IP address	Rate limiting, so nobody can brute-force your password	15 minutes

If you submit a game through the submissions form, we keep what you typed into it so we can read and reply to it.

What we do not do

No analytics or tracking scripts. The site deliberately blocks third-party scripts, including our own host's optional analytics.
No advertising, and no advertising identifiers.
No selling, renting or sharing your data with anyone for marketing.
No profiling, and no automated decisions that affect you.

Cookies

One cookie, ss_session, set only after you sign in. It keeps you signed in and nothing else. It is marked HttpOnly (scripts cannot read it), Secure (HTTPS only) and SameSite=Strict (never sent to other sites). It is strictly necessary for a feature you asked for, so it does not require a consent banner. Signing out deletes it.

Games also store progress in your browser's local storage. That stays on your device and is never sent anywhere unless you have cloud saves.

Who else is involved

Cloudflare hosts the site and database and provides network security. Data is stored in the Oceania region.
A payment provider will process payments if and when paid plans launch. They handle card details directly; we never receive or store them.

We do not send your data anywhere else.

Your rights

Under the Australian Privacy Principles you may ask us to show you the personal information we hold about you, correct it, or delete it. Email jsm.de@hotmail.com and we will action it. Deleting your account removes your email address, password hash, sessions and saves.

If you are unhappy with how we have handled your information, contact us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

Passwords are salted and hashed. Session tokens are stored hashed. Everything is served over HTTPS. No system is perfect: if a breach ever affects your data, we will tell you and notify the OAIC where the law requires it.

Children

Accounts are not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, email us and we will remove it.

Changes

If this policy changes materially we will say so on the site before it takes effect. The date at the top shows when it last changed.

Contact

jsm.de@hotmail.com

See also: Terms of Service · Refund Policy