Privacy Policy

ZetaGames ("we", "us", "our") operates the free online games portal at zetagames.net. We act as the data controller for the personal data described in this policy.

This policy explains what we collect, why we collect it, who we share it with, and the control you have over it. We have tried to write it in plain English rather than legalese — if anything is unclear, email us and we will explain it.

You can browse and play most games without signing in. If you never create an account, we hold no account record for you at all. The categories below apply once you sign in or interact with the site.

Account data

When you sign in with Google, Supabase Auth passes us your email address, your display name, and a link to your Google profile picture. That is the entire set. We never receive your Google password, your contacts, or anything else from your Google account.

Profile & gameplay data

• Your XP, level, points, daily-login streak, and unlocked achievements.
• Saved game progress and playtime, so you can pick a game back up where you left off.
• Play history — which games you opened, when, your score, and how long the session lasted.
• Scores you submit to leaderboards, and your rank.
• Battle-pass tier, seasonal challenge progress, and in-game currency balances.
• Your display preferences — theme, sound on/off, reduced motion.

Things you choose to create

• Comments and ratings you post on game pages.
• Favourites, collections, and playlists you build.
• Friend requests and friendships, and the resulting activity feed.

Comments, your username, avatar, and leaderboard scores are visible to other users. Please don't put anything in them you wouldn't want to be public.

Gameplay analytics events

Games can report events through our Zeta SDK — for example "level started" or "level completed" — which we use to understand which games and levels work well. When you are signed out these events carry no user identifier, and they are only recorded if you accepted non-essential cookies (see section 5).

Technical data

• IP address — used in-memory to rate-limit abusive traffic. We do not store IP addresses in our database. Our hosting providers see it in their standard server logs (see section 4).
• Error diagnostics — if something breaks, our error monitor records the error and the page you were on. See section 4 for the optional session replay that can accompany it.

What we never collect

• ✕Passwords — sign-in is delegated entirely to Google.
• ✕Precise or GPS-level location.
• ✕Biometric data, contact lists, or your microphone or camera.
• ✕Your browsing activity on other websites.
• ✕Advertising identifiers — we run no ad network and no advertising cookies.

We do not use your data for automated decision-making that produces legal effects, and we do not build advertising profiles.

Payments

ZetaGames does not currently sell anything or process any payments. We hold no card numbers, billing addresses, or payment records. If we introduce paid items in future, we will update this policy first, and card details would be handled entirely by a regulated payment processor — full card numbers would never reach our servers.

We share data only with the service providers that run the platform for us. Each is bound by contract to process data only on our instructions. We do not sell your data, rent it, or share it with advertisers or data brokers.

We may also disclose data where we are legally required to — for example in response to a valid court order — or to protect the rights and safety of our users. If ZetaGames is ever involved in a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.

We use a deliberately small set of cookies. None of them are advertising cookies, and none of them track you across other websites.

Essential cookies

These are required for the site to work and cannot be switched off.

• session_token — keeps you signed in for 7 days. It is HTTP-only, so scripts cannot read it. Only a hashed copy is stored on our servers.
• csrf_token — protects your account against cross-site request forgery.

Local storage (stays on your device)

These never leave your browser and are not sent to our servers. Clearing your browser data removes them.

• recentlyPlayed — powers the "Recently Played" row.
• soundEnabled, sidebarVisible, zg_v4_reduced_motion — your interface preferences.
• zetanotif_last_check — avoids showing you the same notification twice.
• zetagames_cookie_consent — remembers your choice on the cookie banner.

Individual games may also store their own saved data — such as your high score — in your browser's local storage. That data stays on your device.

Your choice, and what it changes

The banner offers "Accept all" or "Essential only", and closing it counts as essential-only. Your choice is enforced in two places, not just one: the site stops sending non-essential events, and our server independently rejects them if they arrive anyway. Choosing essential-only therefore means gameplay analytics are not recorded and no session replay is ever captured.

One narrow exception: an end-of-session marker is recorded either way, because we need it to detect abuse and keep leaderboards honest. It records that a play session ended — nothing about what you did in it.

To change your mind, clear your site data in your browser and the banner will ask again. Clearing cookies and local storage also signs you out and resets your local preferences.

Our Cookie Policy lists every cookie and storage key individually, with lifetimes and per-browser instructions for clearing them.

Some games on ZetaGames are made by third-party developers. They run inside a sandboxed frame, which restricts what they can reach and prevents them from reading your ZetaGames session.

Games receive only what they need to function: your public display name and avatar when you are signed in, plus any progress you have saved in that particular game. They do not receive your email address.

A game may save your progress or high score to your own browser storage, and may send gameplay events (such as "level completed") back to us through our SDK. We review the games we host, but a game developer's own practices are outside our direct control — if you have concerns about a specific game, contact us and we will investigate.

Depending on where you live — including the UK, the EU/EEA, and US states such as California — you have some or all of the following rights:

• Access — get a copy of the personal data we hold about you.
• Correction — fix data that is wrong. Most profile fields you can edit yourself.
• Deletion — have your account and associated data erased.
• Portability — receive your data in a structured, machine-readable format.
• Objection and restriction — object to processing we carry out under legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Complain — lodge a complaint with your local data protection authority. In the UK that is the ICO.

For California residents: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We will never discriminate against you for exercising your privacy rights.

To exercise any of these rights, email support@zetagames.net with the subject "Data request", from the email address on your account. We respond within 30 days, and free of charge.

• Account data — kept while your account is active.
• After you ask us to delete — your profile, comments, friendships, favourites, collections, ratings and saved progress are removed within 30 days.
• Sessions — sign-in sessions expire after 7 days.
• Anonymised gameplay statistics — once detached from your account, aggregate figures such as total plays per game are kept indefinitely. They can no longer identify you.
• Server and error logs — retained on our providers' standard schedules, typically 30 to 90 days.

• All traffic is encrypted in transit with HTTPS/TLS.
• Sign-in is delegated to Google — we never handle or store your password.
• Session tokens are stored only as irreversible hashes, so a database leak cannot be replayed to impersonate you.
• Sign-in cookies are HTTP-only, and state-changing requests are protected against cross-site request forgery.
• Third-party games run inside a restrictive sandbox.
• Developer API keys are stored only as hashes and shown to you once.

No online service can promise perfect security, but if a breach ever affects your personal data we will notify you and the relevant regulator as required by law.

Our providers operate data centres in the United States and the European Union, so your data may be processed outside your home country. Where data leaves the UK or EEA, our providers rely on recognised safeguards such as the European Commission's Standard Contractual Clauses to give it an equivalent level of protection.

ZetaGames is not directed at children under 13, and under 16 in the EU/UK. We do not knowingly collect personal data from children in those age groups, and signing in requires a Google account subject to Google's own age rules.

If you are a parent or guardian and believe your child has given us personal data, email support@zetagames.net and we will delete it promptly.

We update this policy as the service evolves. The "last updated" date at the top always reflects the current version. If we make a material change — such as collecting a new category of data or adding a new provider — we will give notice on the site before the change takes effect.

Questions about this policy, or about how your data is handled, go to support@zetagames.net. We aim to reply within a few days, and within 30 days for formal data requests.

See also our Terms of Service.