Privacy policy
This page describes how Super Massive Games (supermasivegames.com) handles information when you play here. It covers the data that never leaves your device, the small amount you can choose to send us, the technical records our host keeps, and what advertising partners are able to see. Questions about any of it go to [email protected].
1. What we do not collect
Start with the absences, because they are the largest part of this policy. There is no registration on this site and no user database, so we hold no username, no password and no profile for you. We do not run analytics that follow individual players, we do not embed social network buttons or tracking pixels, and we do not attempt to fingerprint your device. We do not know your name, your score, how long you played or which game you chose, and none of the games report anything back to us while you play. We do not sell, rent or trade personal information, and there is no marketing list to be added to. Apart from the advertising described in section 5, the page you load pulls its stylesheet, its scripts and its icon from this domain only.
2. What the games save in your browser
Each game keeps a small record of your progress using your browser's localStorage,
under keys that all begin with the prefix bg:. Three categories are stored:
- Best results per game and per setting — a separate high score or best time for each difficulty, speed or mode, so that a run on Calm is never compared against a run on Silly.
- Your theme choice — whether you selected the light or the dark appearance.
- Your sound preference — whether game audio is switched on or off.
This is written by JavaScript running on your own machine and stays there. It is not transmitted to our server, it is not sent to any third party, it is not attached to an identifier of any kind, and we have no ability to read it. Because the storage belongs to one browser on one device, your records do not travel: a best time set on a phone will not appear on a laptop, and a different browser on the same computer starts from zero. Clearing site data, clearing your browsing history or playing in a private window removes it, permanently and with no way for us to restore it. You can inspect every value yourself through your browser's developer tools, and delete any or all of it whenever you like.
3. The contact form
The contact page is the only place on this site where you can send us anything. When you submit it, the following is delivered to our own inbox by email: the name you typed, the email address you typed, the subject you selected and the body of your message. Alongside that, the submission carries the technical context that any web request produces — the IP address the message came from, your browser's user-agent string, and the page you submitted from. Those three exist so that we can reproduce a bug you are describing and recognise automated abuse; they are not used to build a profile of you.
We use what you send solely to read and answer your message. Nothing goes on a mailing list, nothing is shared with an advertiser, and nothing is disclosed to a third party except where a law obliges us. Messages are retained while the conversation and any related fix are still useful and are deleted afterwards; in practice that means most are gone within twelve months, and none are kept beyond twenty-four. Ask us and we will delete yours sooner.
Two anti-spam measures run on submission. The form contains a hidden decoy field that a human never sees and automated software usually fills in; a submission that fills it is discarded. Separately, a short-lived counter on the server limits how many messages one IP address can send in a fifteen-minute window. Neither mechanism profiles you or survives beyond its purpose.
4. Server and delivery-network logs
Like every web server, ours records a line for each file it serves: the requesting IP address, the timestamp, the URL asked for, the HTTP response code, the referring page and the user-agent string. These logs exist for security, abuse prevention and diagnosing faults, they are rotated on the provider's ordinary schedule, and they are never used to construct visitor profiles. Requests may also pass through a content delivery network, which processes the same categories of technical data in order to deliver the page quickly and to absorb attacks.
5. Advertising, Google AdSense and the DART cookie
Hosting is paid for with advertising served by Google, including through the Google AdSense programme. Everything in this section applies whenever advertising is active on the site.
- Third-party vendors, Google among them, use cookies to serve advertisements based on your previous visits to this website or to other websites.
- Google's use of advertising cookies — the mechanism long known as the DART cookie — allows Google and its partners to serve advertisements to you based on your visit to this site and other sites on the internet.
- You can switch off personalised advertising from Google at google.com/settings/ads. Doing so does not remove advertising; it makes what you are shown less specific to you.
- Google explains its advertising technologies in full at policies.google.com/technologies/ads, which is the authoritative description of what those cookies do.
- To opt out of many vendors at once, use aboutads.info/choices or, in Europe, youronlinechoices.com. Most browsers can also block third-party cookies outright in their settings.
Advertising is kept physically apart from the playfields. Nothing is placed inside a game board, where it could pass for a target, a control or part of the score, and nothing is placed where it would interrupt a round you have already started.
6. Third parties and third-party cookies
Any cookie or similar identifier set by an advertising partner belongs to that partner, not to us. We cannot read it, we cannot edit it and we cannot delete it on your behalf, which is why the controls in section 5 point at the vendors themselves and at your browser. Advertising partners may collect technical information of their own, typically the IP address, device and browser characteristics, the pages on which their advertisements appeared and how you interacted with them; that processing is governed by their privacy policies rather than this one. Beyond hosting, the content delivery network and the advertising described here, no other third-party service is embedded in these pages. If that ever changes, this policy will be updated to say so, and the date at the top will change with it.
7. Consent and legal bases (EEA, UK and Switzerland)
Where the law requires consent before non-essential cookies are set — the European Economic Area, the United Kingdom and Switzerland — advertising and measurement cookies are only set on the basis of the consent gathered through the consent notice shown to visitors in those regions, and you can change or withdraw that choice at any time through the same notice. For the limited processing we carry out ourselves, the legal bases are your consent when you choose to write to us, and our legitimate interest in keeping the site secure and functioning for the server logs and anti-spam measures. We are the controller for that processing; advertising partners act as controllers for their own.
8. Your rights under the GDPR
If the General Data Protection Regulation applies to you, you have the right to ask whether we hold personal data about you and to receive a copy, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting what was lawful before. You may also complain to your national supervisory authority. In our case the only personal data we hold about a visitor is whatever they chose to write in the contact form, plus server logs, so requests are usually settled in days. Write to [email protected]; we reply within one month at the latest.
9. California residents (CCPA/CPRA)
Under the California Consumer Privacy Act as amended by the CPRA, California residents may request disclosure of the categories and specific pieces of personal information collected about them, request deletion or correction, and be free from discrimination for exercising those rights. The categories we handle are identifiers and internet activity information, as described in sections 3 and 4, collected directly from you or from your device's request. We do not sell personal information and we do not share it for cross-context behavioural advertising as those terms are defined by the statute. Advertising cookies belong to the vendors named in section 5, and Google publishes its own controls for California residents. To make a request, email us; we may need to confirm that you control the email address in question before acting.
10. Brazil (LGPD)
For data subjects covered by the Lei Geral de Proteção de Dados (Law No. 13.709/2018), the rights are equivalent in substance: confirmation that processing exists, access, correction of incomplete or outdated data, anonymisation or deletion of unnecessary data, portability, information about entities with which data has been shared, and revocation of consent. Requests reach us at the same address and are answered on the same timetable. As above, the practical scope is a contact message and technical logs.
11. International transfers
This site is served by hosting and delivery infrastructure that may handle requests outside your country, including in the United States, and advertising partners operate internationally by nature. Where personal data crosses a border, it does so under the transfer mechanisms available to the provider concerned, such as standard contractual clauses.
12. Children
Super Massive Games is built for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13, consistent with the United States Children's Online Privacy Protection Act (COPPA) and with the equivalent age rules in other jurisdictions. The games require no registration and collect nothing at all, so the only route by which a child could send us personal information is the contact form. If you are a parent or guardian and believe that has happened, write to us and we will remove it promptly.
13. Security
Every page is served over HTTPS. The best security property this site has is architectural: with no accounts, no passwords and no stored player data on our side, there is very little for an attacker to take. Contact messages live in an ordinary mailbox protected by strong authentication. No system is perfectly secure, however, so please do not send passwords, payment details, identity documents or other sensitive material through the form.
14. Links to other sites
Tip sheets occasionally link to external pages, and advertisements link wherever the advertiser directs them. Once you follow a link off this domain you are subject to that site's own privacy practices, which we neither control nor monitor. A link is not an endorsement, and we are not responsible for what happens on the other end of one.
15. Changes to this policy
When this policy changes, the revised text replaces what is on this page and the date beneath the title is updated. Substantive changes — adopting a new category of third-party service, for example — will be described here in plain language rather than slipped in. Continuing to use the site after a change means the current version applies to you.
16. How to reach us
For any privacy question, request or complaint, including the rights described above, email [email protected] or use the contact form. Say which right you are exercising and we will handle it from there.