I'm Todd Griffin, an individual developer in the United States. I build games, tools and websites as personal projects. This policy covers all of them, plus the shared account system at accounts.toddgriffin.me, which gives you one account for all my projects. It explains what I collect, why I collect it, and what you can do about it.
These are my personal projects. I build and run them on my own time, with my own equipment and my own money. They aren't affiliated with, sponsored by or endorsed by any employer of mine, past or present.
If anything here is unclear, email me at [email protected].
The short version
- I collect only what I need to run your account and keep it secure.
- I never sell your data, and I never share it for advertising. Today there are no ads and no ad trackers.
- I only email you about your account. No marketing, ever.
- You can see, fix or delete your data yourself, whenever you want.
What I collect
Your account
I run the account system myself, on my own servers. When you create an account, I store:
- Your email address.
- Your username. It's your public name across my projects, so other players can see it. You can change it anytime.
- A profile picture, if you choose to add one. Like your username, other players can see it.
- Your password, stored only as a secure hash. I can't see your actual password.
- Your passkeys, if you set any up. I store only the public key. The private key never leaves your device.
- Any sign-ins you link (Google, Apple, GitHub, Discord or Twitch), along with the basic profile info that service shares with me: your ID there, your name, your email address and your avatar.
- If you sign in with Twitch, the access tokens Twitch gives me. I store them encrypted and use them only for features you turn on, like connecting your channel to one of my games. You can cut off my access anytime in Twitch's settings (Connections). The tokens are deleted when you delete your account.
- Sign-in logs: when you signed in, how, your IP address and your browser's user agent. I use these to keep accounts secure, for example to spot and stop someone trying to break into yours.
The projects themselves
Each project keeps your account ID and username, plus whatever it needs to work, like your progress in a game. Projects never see or store your password: only the account system handles it.
Error reports
When something breaks, my projects send an error report to Sentry so I can fix it. A report may include your IP address and information about your browser.
Analytics
Some of my sites use Plausible Analytics to count page visits. Plausible doesn't use cookies, doesn't collect personal data and doesn't follow you around the web.
My sites also use Cloudflare Web Analytics, which measures page visits and how fast pages load. It doesn't use cookies either, and it doesn't track you across sites.
How I use it
I use your information to:
- Create your account and sign you in.
- Keep your account and my projects secure.
- Send you emails about your account.
- Find and fix bugs.
- See which pages people visit, in total, never tied to you.
That's it.
Emails
I only send account and security emails: verification codes, and notices when your account is created, your password is reset, your account changes, your account is locked, suspended or deleted. No newsletters and no marketing. Emails come from [email protected] and are sent through Amazon SES.
Cookies
I use only the cookies needed to keep you signed in and to keep things secure. Cloudflare may also set a security cookie to tell people apart from bots. There are no advertising or tracking cookies, and my analytics don't use cookies at all. Your browser may also remember small preferences, like light or dark mode, on your own device.
Who helps me run things
I don't sell or rent your personal data, and I don't share it for advertising. I use a few service providers that handle data only on my behalf, to run my projects:
- DigitalOcean hosts my servers and databases, in the United States.
- Cloudflare provides DNS, content delivery, security and cookieless page analytics, and forwards email sent to [email protected].
- Amazon Web Services sends account emails (Amazon SES) and stores encrypted copies of database backups (Amazon S3).
- Cloudflare R2 stores encrypted database backups and the profile pictures you upload.
- Sentry receives error reports.
- Plausible Analytics provides cookieless page analytics on sites that use it.
- Google, Apple, GitHub, Discord and Twitch, but only if you choose to sign in with them. Their own privacy policies cover what you share with them.
I'll also share information if the law requires it, or if I need to in order to protect someone's safety. My servers are in the United States, so if you live somewhere else, your data is stored and processed there.
How long I keep it
I keep your account data for as long as you have an account. When you delete your account, your account and your data in every project are deleted from my live systems right away. Encrypted backups that still contain it expire automatically within 90 days.
Some games keep anonymous statistics after you leave, like past match results and season rankings, so the history stays accurate for everyone else. Before that, I strip out your account ID, username and anything else that could identify you.
Sign-in logs and error reports are kept for a limited time, then deleted automatically.
How I keep it safe
- Every connection uses HTTPS.
- Passwords are stored only as secure hashes.
- Backups are encrypted.
- I'm the only person with access to the servers and the data on them.
No system is perfectly secure, but I take this seriously. If a breach ever affects your data, I'll tell you.
Your rights
No matter where you live, you can:
- See the data I have about you.
- Correct it.
- Delete it, along with your account.
- Get a copy of it.
You can see, correct and delete your data yourself in your account settings at accounts.toddgriffin.me.
Deleting your account
In your account settings, open Security and choose Delete account. You'll confirm it's you first. Deletion is permanent and can't be undone: your account, your username and your data in every project are deleted right away, and backups expire within 90 days. Anonymous game statistics that can't identify you may remain.
For a copy of your data, or anything else, email me at [email protected] and I'll take care of it within 30 days.
Laws like the GDPR in Europe and the CCPA in California give people these rights and a few more, like objecting to certain uses of their data or complaining to a data protection authority. I handle your data to provide the account and projects you asked for, and to keep them secure. I give everyone the same rights, wherever they live.
Children
My projects aren't directed at children under 13, and I don't knowingly collect data from them. If I learn that a child under 13 has an account, I'll delete it. If you think that's happened, please email me.
Changes
If I change this policy, I'll post the new version on this page and update the "Last updated" date at the top. If I ever add ads or paid features, I'll update this policy before they launch.
Contact
Questions or requests? Email me at [email protected].
Todd Griffin