In short
- You can play every game without an account. We then keep nothing about you except a web server log that is deleted after 30 days.
- Analytics run only if you say yes, and you can change your mind at any time.
- An account stores what you give it. You can download all of it, or delete it yourself, at once, from your profile.
- Questions and requests: privacy@helixgames.io.
Who runs this site
Helix Games is a hobby arcade site. For anything in this notice, write to privacy@helixgames.io. We answer within 30 days.
When you just play
Our web server writes a line for each page you open and each request to the application (most images, fonts, styles and scripts are not logged): your internet address, your browser's name, the page or file asked for, including any search text, and the page you came from. We use it to keep the site secure and to fix faults. Log files are deleted after 30 days.
The application behind the site keeps its own log of the requests it handles: your account number if you are signed in, what was asked for and the result. It holds no internet address except in rare fault reports, and it is limited by size, not by age.
Your browser keeps a few things on your own device: your theme, whether sound is muted, your local high scores and your privacy choice; and, once you sign in, your session, a copy of your profile's basic details (not your email address) and, if you ask for one, a remembered-device token. A 2048 game you have not finished is kept there too, with a token our server signed when the game began, which carries the number of the account that was signed in then, if one was. Your browser also keeps an offline copy of the site's own pages and scripts, so the games work without a connection; it holds nothing about you. We set no cookies unless you accept analytics.
Analytics, only if you say yes
If you choose "Accept analytics", the homepage and the game pages load Google Analytics. Google then receives which of those pages you visit, your browser and device type, and an approximate location worked out from your internet address, which Google says it does not store. It sets two cookies, _ga and _ga_DJTE7HLB8V, which last 6 months. Advertising features are switched off. Google Ireland Limited processes this for us and may transfer it to the United States under the EU–US Data Privacy Framework. Google keeps it for 2 months.
Analytics never load on any other page: not the leaderboards or achievements, not your profile or a public player page, not this page.
If you decline, or your browser sends the Global Privacy Control signal, nothing is sent to Google. Your choice is remembered for 6 months. Change it at any time with "Privacy choices" at the foot of every page.
When you make an account
We store your username, your email address, your password as a one-way hash (we never keep the password itself) and a display name if you give one; your scores, game statistics, achievements, completed challenges and points; who you follow; when you joined, when you last signed in and your sign-in streak. For 7 days after each run we also keep the run's identifier, so the same run cannot be submitted twice.
Anyone can see your username, display name, join date, statistics, scores and achievements. A player you follow can see that you follow them. Your email address is never shown to other players; administrators can see it.
We use your email address only for account recovery and security notices. No newsletters, no marketing. We keep account data until you delete the account.
Signing in
Every account uses an authenticator app. We store its secret encrypted, and your recovery codes and remembered devices only as keyed hashes. A remembered device also stores your browser's name and lasts 30 days. A sign-in lasts 7 days and lives in your browser's session storage.
Security events on your account — setting up the authenticator, using a recovery code, forgetting a device, an administrator's action — are recorded with your internet address and browser name. Both are erased from the record after 90 days; the record of the event stays.
We send mail through Amazon SES (Amazon Web Services, Ireland): a confirmation link when you register or change your address, a password reset link when you ask for one, notices about security changes on your account, and a last message when you delete it. A confirmation link works for 7 days and a reset link for 1 hour. An address that has not been confirmed receives only the confirmation message. If you received one and did not register, ignore it, or write to us and we will remove the address.
Backups
We back the database up every night. Backups stay 30 days on the server, and encrypted copies may be kept off-site at Amazon Web Services in Ireland for up to 120 days. Our hosting provider keeps daily backups of the whole server for 7 days. When you delete your account it leaves the live site at once and every backup within 120 days.
Who else handles your data
Hetzner Online GmbH hosts the site, in Finland. Amazon Web Services sends our email and may store the encrypted backups. Google provides analytics, only if you accept. Our status page, status.helixgames.io, is run by Better Stack; we send them nothing about you, and visiting it is visiting their site under their notice. We sell no data and show no ads.
Your choices
From the Account panel of your profile you can download everything we hold about your account as a file, correct your display name, change your email address, and delete your account. Deleting removes your account, scores, statistics, achievements, challenge history, follows, recovery codes and remembered devices at once, and your username becomes free for anyone to register. The record of security events stays, with your name, internet address and browser removed. If you are an administrator, hand the role to someone else first.
You can withdraw your analytics consent under "Privacy choices". You can ask us for any of this by email, and you have the right to complain to your data protection authority.
Under EU law we rely on the agreement to run your account for account data, on our legitimate interest in a secure, working site for logs and security records, and on your consent for analytics.
Children
Helix Games accounts are for people aged 16 and over. If you believe a younger person has made an account, write to us and we will delete it.
Changes
We update this page when what we do changes, and change the date at the top. If the analytics section changes in a way that matters, we ask for your choice again.