What we keep, and what we don't

When you sign up we store the username you chose, the display name you chose, and a scrambled form of your secret word. It is scrambled in a way that cannot be turned back, so nobody here can read it, including us. That is why losing both your secret word and your recovery code means the account cannot be recovered.

We ask for the month and year you were born, never the day. If you are under 18 we keep the month and year so we can keep the right safety settings. If you are 18 or over we only keep the fact that you are an adult.

We never ask for your real name, your school, your address or your phone number. We don't ask for your email address.

When someone under 13 signs up, we ask for a grown-up's email address and send one email asking for their OK. Until a grown-up says yes, the child's projects stay private, they cannot comment, and nobody can find or message them.

If nobody says yes within 30 days of the first time we asked, the account and everything made in it is deleted. Asking again sends another email but does not change the date. The child's home page shows the date, and the reminder email does too.

If a grown-up says no, or says yes and later changes their mind, the account and everything made in it is deleted 7 days later. During those 7 days the same link in the email still works, so a grown-up who pressed the wrong button can say yes instead and nothing is lost.

Deleting the account removes the account itself, its projects and rooms with all their saved versions and pictures, its comments, loves and favourites, its messages and notifications, any Discord link, and the grown-up's email address. Safety notes about something the child wrote lose the text and the name. If someone else remixed one of the child's projects, their remix stays but no longer names the child.

You can see what we hold about your child, have it deleted, or take back your yes at any time, and we will not ask why. The link in our email lets you say no or take back a yes, and keeps working for as long as the account exists. To see what we hold, or for anything else, write to privacy@squigglegames.app and a person will answer.

Projects you make are saved on our server so you can come back to them, and so the people in your room see the same thing you do. A room keeps a short history of recent versions so a mistake can be undone.

A private project is visible to you. A room's project is visible to the people in that room. Anything you mark public is visible to anyone with the link. That is what public means, so only mark something public when you want strangers to see it.

When you delete a room, its files go to a bin first, in case it was a mistake. The bin is emptied after 30 days.

Text people type on Squiggle, like comments, project names and things sprites say, is checked automatically for bullying, unkind words and attempts to share contact details. When something is caught, a short note with the text is kept so a person can look at it. Notes that have been looked at are deleted after a year. Notes nobody has looked at yet are kept until someone does.

We want to know whether anyone is out there: how many people came today, whether they stayed, whether the site works on phones. We do that without recording who anyone is.

The mechanism, for anyone who wants it: to count people rather than clicks you need some way to tell two visits apart. We make one by mixing the visitor's address with a random secret and hashing the result, so the same person on the same day lands on the same meaningless string. Every night that secret is replaced and the old one is destroyed, which means today's strings can never be matched against tomorrow's or turned back into an address. The strings themselves are deleted after two days. What is left is a row that says 2026-07-30 · visitors · 14.

• Your account, projects and roomsUntil you delete them
• An under-13 account nobody has said yes to30 days
• An under-13 account a grown-up said no to7 days
• The grown-up's email address, if they never say yes30 days
• Internet addresses (IP), anywhere we wrote one down30 days
• Sign-ins that have run outWithin an hour
• Notifications you have read90 days
• Comments the filter refused (the text)90 days
• Chat messages in rooms and play sessions (unless someone reported one and it is still being checked)30 days
• Visit strings used for counting2 days
• Safety notes that have been looked at1 year
• The record of what the filter blocked1 year
• Closed reports and appeals1 year
• Rooms in the bin30 days
• Daily visit counts (just numbers)About 13 months

There is no advertising network here, no analytics company, no tracking pixel, and no social widget. The only cookies are the one that keeps you signed in and a short one that remembers your age answer during signup. Nothing about you is sold or shared, because there is no one to sell it to and nothing worth selling.

The site is delivered through Cloudflare, and the signup form uses Cloudflare's check that you are a person and not a robot. Cloudflare sees the connection in order to deliver the page. We do not send it anything about your account.

If your browser sends Do Not Track or Global Privacy Control, we skip the counting step entirely. The visit is added to a plain tally with no identifier at all.

You can delete any project from your library at any time. To delete an account and everything in it, write to privacy@squigglegames.app or ask on Discord and it will be done. A grown-up can close an under-13 account from the link in our email at any time. The daily counts stay, because they are just numbers and contain nothing about you.