Privacy Policy

HALLPASS ("we", "us") is a free arcade of browser games at www.hallpass.games. It is run from England. We are the "controller" of the personal data described here, which means we decide how and why it is used.

Operator: Ozan Kaygusuz
Address: [POSTAL ADDRESS]
Contact for anything in this policy: smartlizardpy@duck.com
ICO registration number (if registered): [ICO REGISTRATION NUMBER OR NOT REQUIRED]

Lots of our players are at school, and we have designed the site with that in mind: we try to collect as little as we can, profiles start friends-only, your real photo is hidden unless you choose otherwise, and we do not use your data for advertising.

• Accounts are for people aged 13 or over.Signing in uses a Google account, and Google has its own age rules. Many school Google accounts for under-18s are blocked from signing in to third-party sites; that is Google's setting, not ours.
• If you are under 13, you need a parent or carer's permission before using HALLPASS at all, and you must not create an account. Playing as a guest still involves the device storage and analytics described below.
• We do not ask your age and we do not check it: we rely on you telling the truth. We do not knowingly keep an account belonging to anyone under 13. If we learn we have, or a parent or carer tells us, we will delete the account. Parents and carers can contact us at smartlizardpy@duck.com to see, correct or delete their child's data.

Our approach follows the ICO's Children's Code (the UK "Age Appropriate Design Code"). We have written a draft Data Protection Impact Assessment (in our code repository at docs/dpia.md). [SOLICITOR / OWNER: DPIA sign-off, and the position on having no age check for a service that children use]

[SOLICITOR (IMPORTANT): this service is run by an individual who is under 18. Take advice on whether a minor can enter the contracts described in the Terms and be the "controller" of children's personal data with the duties that carries (registration and fee, responding to requests, breach reporting). Strong suggestion: a parent or guardian (or a company) acts as the legal operator, and this page names them in section 1.]

UK data protection law says we need a "lawful basis" for each use. Ours are in brackets.

If you only play as a guest

• Things saved on your device (favourites, recently played, your daily streak, theme, tab-disguise settings, which banners you closed, and a guest leaderboard name). These stay in your browser and are not sent to us, except as below. [Needed to give you the features you asked for.]
• Scores you submit.The guest name you used, the score, the time, and a scrambled ("hashed") version of your IP address, used only to stop spam and cheating. We do not store the IP address itself in our database. [Legitimate interests: running a fair leaderboard.]
• Analytics (section 6), on unless you switch it off. [Legitimate interests; see section 6 for the cookie-rule position.]
• Technical logs kept by our hosts when you load a page (such as IP address and browser type). [Legitimate interests: security and keeping the site running.]

If you sign in with Google

• From Google we store your account ID, email, name and a link to your Google profile picture. We do not get your Google password, contacts or anything else. [To run your account: contract.]
• We add: a display name ("handle") you can choose, an optional public username, a friend code, your profile visibility setting, your choice about showing your Google picture to friends, when you joined and last signed in, and the country your first sign-in came from (just the country, worked out from your IP address by our host, never your city or location). [To run your account: contract. Country: our legitimate interest in knowing roughly where players are from.]
• Your activity: scores, favourites, plays (for your profile and "friends who play this"), achievements, daily streak (with your device's time zone offset, so reminders arrive at a sensible time), friends and blocks, challenges and invites, notification settings, reviews you write, and reports you make about reviews or profiles (section 10). [To provide the features: contract.]
• If you turn on push notifications: a push address and keys for each device (up to 10). No device name or IP address is stored with it. [Consent: you tick the browser prompt, and can withdraw it at any time in your browser or your notification settings.]
• Games picked for you. When you are signed in, we put games you are likely to enjoy first in the games list. This is worked out in your browser, from the games you play and favourite on that device. It is not sent to us and not saved to your account. Nothing is recorded about you when you are not signed in, and signing out of a device deletes it. You can turn this off in settings (which also deletes what the device learned) or reset it at any time. This is a form of profiling, so we tell you about it here and in the games list itself. [Contract: a feature of your account; you can switch it off.] [SOLICITOR: confirm that signing in as the opt-in is acceptable for profiling of children under the ICO Children's Code (standard 12, profiling off by default)]
• Survey answers, if you answer one. They are linked to your account inside our database so that you can only answer once, but reports to our team show answers without your name or email. [Legitimate interests: improving the site.]

If you report someone(a review, or another player's profile from its Report button): we keep your report, the reason you chose, any note you write, who you reported, and which account made the report, so that our team can look at it in a moderation queue and so that one person cannot send a flood of reports (there is a limit per hour and per day). The person you report is not told who reported them. [Legitimate interests: keeping the site safe. Where a report is about a child at risk we may have a wider duty to act.] See section 10 for how long we keep reports.

Reports about profiles, in particular.When a profile is reported, our team is sent a notification (in the site's bell, and as a push notification if they have turned that on). It says only that a profile was reported and the reason, with a link to the moderation page; it names nobody. The moderation queue shows the reported player's public name, username and public ID, the reason, the note and the time. It does notshow who made the report, and the reported player is never shown that either. (The reporting account is kept in the database for the limits above, but it is not displayed to moderators.) If a moderator decides a profile broke the rules, they can reset it: the player's chosen display name and username are cleared (so they appear under a generated name and their public profile page goes away), their Google photo stops being shown, and all open reports about them are marked as dealt with. They can choose a new name afterwards, but not the same username again for 90 days. This does not delete the account, scores or friends.

If you are in the beta testing programme (invite only) see section 8.

We do not use your data to make automated decisions about you, and we do not build advertising profiles.

• Never shown to other players: your email, your real Google name, your Google account ID, your IP address.
• Your display name (your handle, or your @username, or a generic name) appears on leaderboards, reviews, friends lists, challenge links and invites.
• Avatars.Everyone gets a default cartoon ("meme") avatar, chosen from your public ID, so it is not a photo of you. That is what appears on leaderboards, reviews, friends lists and profile lookups by people who are not your friends.
• Your real Google profile picture (often a real photo) is shown only if you tick "Show my Google profile picture to friends" in your settings. It is off by default. If you tick it, only your accepted friends see it. It is never shown on leaderboards, reviews, profile lookups by people who are not your friends, challenge links, invite links or in co-op rooms. Untick the box and it stops being shown.
• Profile visibilitystarts at "friends": people who are not your friends see only your name and default avatar. You can change it to public or private. Profile pages are marked so search engines should not list them.
• Challenge links and invite links show your display name and a score or game to anyone who gets the link. Anyone can open them, so only share them with people you trust. Invite links expire after a short time (30 minutes by default).
• Reviews are public. Leaderboards are readable by other websites too.

UK rules (PECR) say we must tell you about, and sometimes ask permission for, anything we store on your device or read from it.

• Sign-in cookie. If you sign in, our sign-in system sets a session cookie to keep you signed in (about 30 days). Needed for the service you asked for, so no permission is needed.
• Settings and features, stored in your browser (local storage, session storage and a small database): favourites, recent games, streak, theme, tab-disguise, catalogue sort and view, closed banners, a guest leaderboard name, and notification preferences. Strictly for features you use.
• Games picked for you (signed in only). A small record in your browser of how many times you played each game (up to 60 games) and when, used to order your games list. It never leaves your device. Signing out, or turning the setting off, deletes it. See section 3.
• Service worker. HALLPASS can be installed like an app and works offline. A service worker saves copies of public pages and games on your device. It is set up not to save pages that show your account, friends or profile.
• Analytics device ID.Unless you switch analytics off, our analytics tool stores a random ID, and which link brought you here, in your browser (PostHog's default is a cookie plus local storage). We use it to tell a returning visitor from a new one. It does not name you. Switching analytics off in settings clears it. See section 6. [CONFIRM the exact PostHog storage settings at runtime once the final code is merged]

You can clear all of this in your browser settings at any time. Some features will then reset.

We use PostHog(servers in the EU) to see which pages and games are used, how people find us, whether people come back, and what breaks. It records page views, clicks, the games you start and stop, what you type in the game search box, favourites, whether you use a challenge or invite link, your device's daily-play streak, and website errors.

• It is on by default. It stores a random device ID in your browser so we can count returning visitors rather than counting every visit as someone new. We chose this design ourselves: it is on unless you switch it off, and we tell you about it, rather than asking first. The first time you visit we show a short notice explaining what is collected and why.
• You can switch it off with the Analytics switch in your settings. Switching it off stops us capturing anything and clears the stored ID from your browser. Data already sent is not tied to your name; ask us if you want us to look into removing it.
• No session recording. We do not record or replay what you do on the screen. This is switched off in our code, so it cannot be turned on from the PostHog dashboard by accident.
• Events go through our own address (/ingest) so they pass through HALLPASS first. We do not link them to your account: the site never tells PostHog who you are, so the data is about a browser, not a named person. On a shared school computer, that browser may be used by many people.
• We do not use PostHog for advertising and we do not sell or share this data with advertisers.
• Our legal reason is legitimate interests: knowing whether the site works and is used, so we can fix it. Because this reads and writes an ID on your device, UK cookie rules (PECR) also apply. [SOLICITOR: PECR position. The owner has chosen on-by-default with a notice and an opt-out. The intended basis is the statistical-purposes exemption added by the Data (Use and Access) Act 2025, which we have only confirmed from secondary sources (not the legislation or ICO guidance itself), and whether it covers a device ID used to count returning visitors, for a service used by children. The alternative is an opt-in banner with analytics off until accepted. Decide before finalising.]

We do not use Google Analytics, advertising pixels or social media trackers. Trailers load from YouTube (privacy-enhanced mode) only after you press play on one. The site shows a small number of advertising links; they are plain links, and clicking one is counted in our analytics.

Some games let you play with someone else online. This connects your device directly to theirs(called peer-to-peer, or WebRTC). To do that, devices must learn each other's network addresses. That means the other players in your room may be can see your IP address, which can show roughly where you are and who your internet provider is. The first time you use co-op on a device we show a short notice saying this before anything connects.

• There are no public rooms. Nobody can browse or search for rooms. To join you need a room code or an invite link from the host, so only people you share it with can get in. Do not share a code or link with strangers.
• Other players see your display name, not your Google name or email. We do not send your profile picture to them.
• To set the connection up we use our database to pass short setup messages (these contain network addresses) between devices. They are deleted within minutes. Rooms disappear about three minutes after the host goes quiet. We store a hash of your player ID or IP address, not the address itself, to limit abuse.
• Your browser asks free "STUN" servers run by Cloudflare and Google what your public address is, so those two providers see your IP address. We do not use a relay (TURN) server, so if a direct link between two devices is not possible, co-op will not connect. Some school and home networks block direct connections, so co-op may not work for everyone.
• Game data goes directly between players and does not pass through our servers. We do not record it. Games can use your microphone for voice only if the game asks and your browser permission prompt is accepted; you can mute. [CONFIRM whether any live game uses voice]

If you do not want other players to see your IP address, do not use online co-op.

A small invite-only group of testers try unreleased games and report bugs. If you are one of them:

• A bug report can include what you typed, a rating, your browser and device description, the game's error messages, and a screenshot or a short clip of the game.
• Clips and screenshots are only taken when you press a button. The browser asks you to choose what to share, and we only keep the game window, not your whole screen. We do not record your microphone or camera. A separate "record gameplay" button saves a video to your own device only; nothing is uploaded.
• A clip can show a child playing, so it is treated carefully: it is only played back to you and to our team, and the page is not listed by search engines. Files are stored with a hosting provider (Vercel) at a hard-to-guess address. Our team may use software tools, including AI assistants, to read bug reports so they can fix them.
• You earn XP for useful reports. Your rank is shown to you. After you finish testing a game, your display name may be shown as "Tested by" on that game's public page.
• Clips and screenshots are deleted automatically 30 days after you send them if the report is still unresolved, straight away when the report is fixed or closed, and when you delete your account. The text of the report stays (it is cut loose from your account if you delete it).

[SOLICITOR: parental permission and age rules for under-18 testers; the code has no age or consent step]

We do not sell personal data. These companies help us run HALLPASS:

• Vercel (hosting, and file storage for game files and beta clips). [region]
• Neon (our database). [region]
• PostHog (analytics, EU).
• Google (sign-in; it hosts your Google profile picture, which is only loaded for your friends if you chose to show it; and it runs a STUN server and the optional review translation described below).
• Cloudflare (a free STUN server that tells your browser its public address for co-op; it sees your IP address).
• Push servicesrun by your browser's maker (Apple, Google, Microsoft or Mozilla) if you turn on notifications. They deliver our message; it is short and does not include your email.
• GitHub runs our scheduled job that triggers streak reminders. It does not receive player data.

If you press "translate" on a review, the text of that review (not who wrote it) is sent to Google's translation service.

We may also share data if the law requires it, or to protect someone from serious harm.

International transfers. Some of these companies are based in or process data in the USA or elsewhere outside the UK. Where that happens we rely on the safeguards UK law allows, such as the UK extension to the EU-US Data Privacy Framework or standard contract terms. [SOLICITOR: confirm transfer mechanism for each provider]

• Your account until you delete it. Deleting removes your profile, friends, reviews, favourites, achievements, streak, push devices, notifications, challenges and invites.
• Scoresstay on leaderboards after you delete your account, but with your name replaced by "Deleted" and no link to you.
• Bug reports (the text) and survey answers you made stay but are cut loose from your account when you delete it.
• Reports about profiles are kept while we look at them, and are then deleted 90 days after we close them (whether we acted on them or dismissed them). This runs automatically once a day. Reports about reviews are kept in our moderation queue while we look at them, and afterwards as a short record of what we decided, so that repeat problems are noticed. [OWNER: set a retention period for resolved review reports (the code has no deletion rule for them yet)]
• Invite links: removed about an hour after they expire. Co-op setup messages: minutes. Notifications: your latest 100.
• Analytics: kept by PostHog for [PostHog retention setting]. Deleting your account does not delete analytics, which are not tied to you. Switching analytics off clears the ID in your browser; ask us if you want us to look into removing data already sent.
• Beta clips and screenshots: 30 days if unresolved, deleted at once when the report is fixed or closed, and when you delete your account (section 8).
• Challenge links do not expire on their own. You can switch yours off.
• Some small records (such as who blocked whom, a review ban, or a record that a report was made) are kept after deletion to keep other people safe. If you delete your account, profile reports you made stay (without a link to you) until they are deleted under the rule above, and profile reports about you are deleted with it.

Under UK data protection law you can ask to:

• see the personal data we hold about you;
• correct it (you can change your handle and username in settings);
• delete it (use Delete account in your settings, under Your account, or ask us);
• restrict or object to our use of it;
• take a copy in a usable form (we do not yet have a download button, so ask us);
• withdraw consent (for example, push notifications) at any time.

Email smartlizardpy@duck.com. We may need to check it is really you. We will reply within one month. It is free. A parent or carer can make a request for a child.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you live in the EU or elsewhere you may have extra rights and can contact your own regulator.

We use encrypted connections, keep email addresses and Google names out of anything public, give other players a random ID instead of your Google account ID, store only hashed IP addresses, and limit who on our team can see reports. No system is perfectly safe. If something goes wrong that puts you at risk, we will tell you and the ICO as the law requires.

We will update this page when we change what we do, and change the date at the top. For big changes, we will try to tell players on the site.

Also see our Terms of Service.