Privacy Policy

Last updated: October 26, 2026

Whimcade is designed to need very little about you. You can play games without an account. If you make one, we keep what it needs to work: your email address, a scrambled form of your password (or your Google sign-in), and the name you show on your games. We never sell personal data. The only advertising is a small display ad on game pages, described in section 10. This page describes exactly what we collect and why.

1. What we collect

• Your account: if you create an account, we store your email address, a display name and profile handle (both public on your creator page), an optional profile picture you upload, and your password as a one-way salted hash (scrypt). We never store or see the password itself.
• Google sign-in: if you choose Continue with Google, Google tells us your email address, whether Google has verified it, your Google account ID and the name on your Google account. We use the name as your starting display name, which you can change. We do not get your Google password, contacts, files or anything else from your Google account.
• Your email address without an account: if you wish for a game as a guest, we keep the email address you enter with that game so we can tell you when it is ready.
• Your wish and refinement messages: the game idea you type and any follow-up instructions are stored with your game and sent to the AI build agent that creates it.
• What you post: comments, forum posts, game chat and lobby messages are public. Direct messages are visible only to the people in the conversation, and to us when we need to act on a report or keep the service safe.
• An anonymous visitor fingerprint: a one-way salted hash derived from your IP address and browser identifier. It lets us recognize "the same visitor" (your games, free-tier limits, play counts) without storing your raw IP address or browser details on those records.
• Play and page activity: when you play a published game we record which game, the session length, and the anonymous fingerprint above. We also record which pages and buttons people use (including search words, but never passwords, messages or anything else you type into a form) so we can see where the site is confusing and fix it.
• Payments: if you buy a plan, gems or coins, Stripe handles the payment. We keep a record of what you bought and when; your card details go to Stripe and never reach us.
• Operational logs: standard short-lived server logs (requests, errors) used to keep the service running and abuse-resistant.

2. What your email address is used for

We use your email address to sign you in, to confirm it belongs to you, to reset a forgotten password, to tell you when a game is ready or something happens to one of your games, and about purchases you make. We also send occasional updates, such as a weekly summary of how your published games are doing; every one of those has an unsubscribe link, and you can switch the weekly summary off on your account page. Your email address is never shown publicly and never given to advertisers.

3. Cookies

Whimcade itself does not use tracking cookies or third-party analytics scripts. When you sign in we set one cookie that keeps you signed in; it is removed when you log out. The one third-party script on the site is Google's ad loader, which may set advertising cookies as described in section 10. Games run sandboxed on a separate, cookieless origin, and a game cannot read anything about you.

4. How we use information

We use the data above only to operate Whimcade: building and delivering your game, emailing you about it, enforcing free-tier and abuse limits, ranking the arcade, and debugging the service. AI game generation runs on infrastructure we operate together with our platform provider; your wish and refinement text are processed by our custom generation pipeline, which uses a mix of third-party AI models from Anthropic and OpenAI to build your game.

5. Sharing

We do not sell or rent personal data. We share data only with the service providers that run Whimcade: cloud hosting (Google Cloud), email delivery, payments (Stripe), Google sign-in if you use it, and the AI model providers (Anthropic and OpenAI) that process wish and refinement text to generate games, and only as needed to provide the service, or if the law requires it. Our AI providers process this data under their commercial API terms, under which it is not used to train their models. Your published games, their titles, and descriptions are public by design; your email address never is.

6. Retention

Game records, wishes, and build history are kept while your game exists so you can keep iterating on it. Your account is kept until you ask us to delete it. A guest's email address is kept with the game it belongs to. Operational logs are kept briefly and rotated.

7. Deleting your account

To delete your account, email contact@whimcade.com from the address on the account, or use the contact form and choose "Privacy or my data". We remove your email address, password, Google sign-in link, profile and your games' content from the live service. Records of purchases may be kept where the law requires it for tax and accounting.

8. Your rights

Depending on where you live (including the EU/EEA under GDPR and California under CCPA), you may have the right to access, correct, delete, or export personal data we hold about you, and to object to or restrict certain processing. We honor these requests for everyone: email contact@whimcade.com from the address on your account or your wish, and we will verify and respond. We do not discriminate against you for exercising these rights.

9. Children

You must be at least 13 to create an account or give us an email address, and anyone under 18 should use Whimcade with a parent or guardian's permission (see the Terms). Whimcade is not directed to children under 13, and we do not knowingly collect personal information from them. Parents: if you believe a child under 13 has given us an email address or made an account, contact us and we will delete it.

10. Advertising

Whimcade shows a single display ad, served by Google AdSense, under the game on play pages when the visitor is not signed in or is on the free plan. Plus subscribers, and anyone who has bought a coin pack in the last month, see no ads. Every ad request from Whimcade is marked as child-directed and non-personalized: Google does not build an interest profile from your visits here, and the ads are not chosen using your browsing history. To serve an ad, count that it was shown, and limit how often you see the same one, Google may set a cookie or use similar technology; Google's use of that data is described at policies.google.com/technologies/ads. We never share your email address, your wishes, or anything else you give Whimcade with an advertising partner.

11. Changes

We will update this page if our practices change; the "Last updated" date above reflects the current version.

12. Contact

Privacy questions and deletion requests: contact@whimcade.com.