Privacy
Last updated 30 September 2026
The short version: you can play without an account. There are no ads, no tracking cookies and no third-party analytics, and nothing is sold. We keep only what we need to run the site, count plays fairly and stop abuse, and we delete it when it's no longer needed.
Who we are
Voxel Party is made and run by Oliver, an independent developer in Sweden ("we" on this page). We are the data controller for the personal data described here. Questions, requests or complaints: privacy@voxelparty.io.
What we collect, why, and for how long
When you play (no account needed)
| What | Why | How long |
|---|---|---|
| Your IP address, as a keyed hash | To count plays and play time per game fairly (a cap per address per day, trending, creators' stats). We never store the address itself, only a one-way hash made with a secret key, so it can't be turned back into your address. | 35 days |
| The name and character you pick, and your party's game state | To run the party. Everyone in your party sees your name, and an invite link you share shows it in the link preview ("Ann invited you"). | Deleted 6 hours after the party room was last used |
| Your IP address, briefly | Rate limits (for example, how many games one address can upload a minute), to stop abuse. | Not stored: counted in memory for about a minute |
If the site is full
On a very busy day new visitors can join a waitlist: we keep the email address you give us only to send you one invite when there's room (through our email provider, Resend), and delete it once the invite is sent (at most a week later), or sooner if you ask us at privacy@voxelparty.io.
When you sign in with Discord
Signing in is only needed to publish games, vote, report and send creators feedback. We ask Discord for the identify permission only:
no email address, no servers, no messages, no friends list.
| What | Why | How long |
|---|---|---|
| Your Discord user id, display name and avatar picture link | Your account. Your name and avatar are shown publicly on games you publish and on your creator page. | Until you ask us to delete your account |
| A sign-in session (a cookie and a record on our server) | To keep you signed in. | 30 days, or until you sign out |
| Which games you've played, your votes, and reports you send (with the reason you write) | Only players can vote; "because you played" suggestions; moderation. Reports are seen only by moderators. | Until you ask us to delete your account |
| Feedback you send a game's creator (the note, your name, the game and when), with a keyed hash of your IP address | So the creator can read it on their page: only they and our moderators see it. Links and contact details are taken out. The IP hash enforces the daily limit. | Until your account or the creator's is deleted (the IP hash: 30 days) |
| Takedowns of games you published (a "strike"), with the reason and the notice | Our repeat-infringer policy (see copyright). You see your own on your page. | Until you ask us to delete your account |
| Keyed hashes of the IP addresses you use while signed in | So a creator's own plays don't count toward their own games. | 90 days after we last see it |
When you upload or publish a game
| What | Why | How long |
|---|---|---|
| The game package (code, title, description, tags) and, if you're signed in, that it's yours | To host the game and show it to players. Published games are public. | Until you or a moderator removes it |
| A keyed hash of the uploading IP address | To spot abuse (many uploads from one place) without keeping the address. | As long as the package |
| Screenshots and a short video of published games | Our server plays the game with computer players in a headless browser and records the pictures for the store. | As long as the game |
When you write to us
| What | Why | How long |
|---|---|---|
| What you send through the contact form or by email: your email address, the topic and your message | To answer you, and to act on what you tell us (a bug, a takedown notice). | Until we've dealt with it, then up to a year |
| A keyed hash of your IP address, with each message from the form | To limit how many messages one address can send (spam). | 2 days |
If the form shows a "verify you are human" check, that's Cloudflare Turnstile: it looks at your browser to tell people from bots, without cookies for tracking you.
Server logs
Our hosting provider, Cloudflare, logs requests and errors for us (the address requested, time, your IP address and browser type). We use them to fix bugs and deal with attacks. Cloudflare keeps these logs for a few days (at most 7). When something breaks on the page or in a game, your browser also sends us an error report (the error message and where in the code it happened, the screen you were on, the game, and your browser and system type, like "Chrome on Android", but no IP address or id), which we keep for 14 days to fix the bug.
On your own device
The site keeps some things in your browser's storage (local storage and IndexedDB), never on our server: your name and character, settings (graphics, sound, mouse), your party's line-up, games' saved progress, games you're making ("My Games"), and replays you record. Replays can include your microphone or desktop sound only if you turn that on, and they stay on your device unless you share them yourself. You can remove all of this by clearing the site's data in your browser.
Cookies
We only use cookies that are needed for signing in and letting you back in. No tracking or advertising cookies, so there's no cookie banner.
vp_seen: remembers that this browser has been here before, so you get in even on a busy day (400 days; it holds only the date of your first visit).vp_session: keeps you signed in (30 days).vp_oauthandvp_back: used for 10 minutes while you sign in with Discord (a security check, and the page to return to).
No ads, no trackers
- No ads, no advertising or social media trackers, no third-party analytics. We don't sell or rent data to anyone.
- Fonts are hosted by us, so loading the site doesn't contact Google.
- Community games run in a locked-down sandbox with no network access: a game can't send anything about you anywhere.
- Profile pictures of creators load from Discord's image server (
cdn.discordapp.com), which sees your IP address like any image host. - We may later add Cloudflare Web Analytics to count visits. It uses no cookies and doesn't track you across sites. If we do, we'll say so here. We do count, per day, how many visits get into a party, play a game, play a second one, and come back on a later day: plain totals with no id, using only the date of your last visit, kept in your browser (not a cookie).
Who else handles your data
- Cloudflare, Inc. hosts the site, the game servers and the storage, and protects it from attacks. It processes data on our behalf under its data processing terms (Cloudflare's privacy policy).
- Discord Inc., only if you sign in: you log in on Discord's own page, and Discord tells us your id, name and avatar (Discord's privacy policy).
Both are US companies, so data may be processed outside the EU. They are covered by the EU–US Data Privacy Framework and the EU's Standard Contractual Clauses. We don't share data with anyone else, unless the law requires us to.
Legal basis
- Your account, publishing, voting and reporting: to provide the service you asked for (GDPR Art. 6(1)(b)).
- Messages you send us: our legitimate interest in answering you and acting on them (GDPR Art. 6(1)(f)).
- Play counting, rate limits, logs, moderation and security: our legitimate interest in running a fair, safe site (GDPR Art. 6(1)(f)). We keep this to hashed data and short retention where we can.
Children
Voxel Party is for ages 13 and up. You must be at least 13 (or older if your country requires it, the same as Discord) to sign in. We don't knowingly collect personal data from children under 13. If you think a child under 13 has signed in or shared personal information here, email us and we'll delete it.
Your rights
You can ask us to show you, correct, export or delete your personal data, and you can object to or ask us to limit how we use it. Email privacy@voxelparty.io from anywhere, and include your Discord name if it's about your account. We'll answer within a month. Deleting your account removes your account, sessions, votes, reports, feedback you sent or received and play history, and your games if you ask. Play counts are stored only as keyed hashes with no link to you, so we usually can't find yours; they are deleted after 35 days anyway.
If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.
Changes
If we change what we collect, we'll update this page and the date at the top.