Preview draft for review. The individual operator’s legal identity, processing locations, detailed retention schedule, legal bases and response timing still need to be confirmed before public launch. Do not treat this draft as a complete privacy policy.
Data used for the service
GAMELET is operated by an individual developer. For privacy questions or requests, email support@kitt.tools.
Account data can include a username, display name, public account number, verified email, sign-in provider identifier, optional avatar and a password hash if you set a password. Security records can include session tokens stored as hashes, device summaries and protected network identifiers.
When you use the service, GAMELET can store favourites, likes, ratings, comments, game and comment reports, play history, cloud saves, creator follows, notification read status and creator uploads. A play session can include a game and version identifier, locale, load/ready/error signals and a protected visitor or network identifier. Guests may keep recent games and saves in this browser.
Why and how data is used
These records support sign-in, account security, game playback, saves, community features, publication, moderation and limited game performance summaries. Public profiles, published comments and creator information can be visible to others; your sign-in email and cloud saves are not shown as public profile fields.
The current product has limited operational play counts and return measures. It does not run a separate general-purpose product-event collector. The legal bases for each processing activity must be confirmed in the final reviewed policy.
Storage and other services
Structured service records are stored in Cloudflare D1. Uploaded game files and avatar media can be stored in Cloudflare R2. This browser stores preferences and, for guests, local play data. Authentication uses a session cookie.
If enabled and selected, Google or GitHub provides identity details for sign-in; Resend processes authentication emails when email sign-in is configured. Externally hosted games may contact their own host when played. The final policy must confirm the applicable recipients and processing locations. We do not claim that all data stays in one country.
Retention and account deactivation
You can delete an uploaded avatar and some game or save content through available controls, or deactivate your account. Deactivation revokes sign-in sessions and disassociates published comments from your account, but the comments can remain under an anonymous author label. Account, report, save and uploaded media records are not all physically deleted by deactivation. For further deletion requests, use the email below.
A field-by-field retention and deletion schedule has not yet been approved. It must be supplied before public launch. Clearing this browser may remove guest saves and preferences on this device.
Your choices and rights
Depending on applicable law, you may ask to be informed about processing and request access, a readable copy, correction or destruction of eligible personal data. Consent-based processing may be withdrawn where applicable. Send requests to support@kitt.tools with your account username or public account number, the action requested and a reply address. We may need to verify account control before disclosing or changing data; do not send passwords or sign-in codes.
For users in Saudi Arabia, the Saudi Data & AI Authority describes personal-data rights and complaint options. The response time and detailed process for requests still need to be finalized before public launch.