Privacy Policy
What we collect
Creators (signed in): when you sign in with GitHub we receive your GitHub id, login, and display name (and email only if you provide it). We store the projects, API keys, and deployments you create.
Players: players need no account. A game assigns a per-room player id and a display name (which you choose, default "Guest N"); these are tied to the room, not to a personal profile. Scores you submit are stored for the game's leaderboard.
Operational data: we process IP addresses transiently for rate limiting and abuse prevention, and to derive an approximate country (used only as an aggregate count to plan server locations — the IP itself is not stored against it). We keep aggregate, non-identifying counters (page views, traffic source, country, rooms, concurrent players) for capacity, billing, and understanding usage. Our own counters are daily aggregate totals.
We use Google Analytics (client-side, via the standard gtag.js snippet) to
understand page traffic: it sets first-party _ga cookies to recognize returning
browsers. We configure it analytics-only — ad storage, ad user data, and ad personalization
are all explicitly denied, and Google Signals is off. Our server additionally mirrors
selected product events (deploys, room lifecycle, sign-ins) to PostHog and
Google Analytics; these server events carry no browser identity, no IP, and no user agent —
pseudonymous, HMAC-derived identifiers only. PostHog is configured to build no per-person
profiles. There is no session recording anywhere.
Cookies
The only cookies on this origin are Google Analytics' _ga measurement cookies
(see above). Authentication never uses cookies — it uses a bearer token held in your
dashboard's local storage — and games you host or play cannot read analytics cookies from
their sandboxed frames. Hosted games remain served without any tracking injected into the
game itself.
Why we process it (legal basis)
To provide the service you asked for (performance of a contract), and for our legitimate interest in keeping it secure and abuse-free. We do not sell your data or use it for third-party advertising.
Who we share it with (sub-processors)
We use service providers strictly to run antics: GitHub (sign-in), MongoDB Atlas (database hosting), Amazon Web Services (server & file hosting), PostHog, and Google Analytics (privacy-preserving product analytics). They process data on our behalf under their own terms.
Our mobile apps (currently SIDE OUT on the App Store and Google Play) additionally use RevenueCat to process in-app purchases. RevenueCat receives a purchase record and an app-generated anonymous user id so it can tell the app what you have bought; it never receives your name or payment details. Your card is handled by Apple or Google under their own privacy policies — we never see it.
Where & how long
Data is hosted in the United States, so if you are in the EEA your data is transferred outside it. For those transfers we rely on appropriate safeguards — our hosting providers (Amazon Web Services and MongoDB Atlas) offer Standard Contractual Clauses through their data-processing agreements.
Keyless rooms and their data expire (currently after 24 hours). Account data (projects, keys, leaderboards) is kept until you delete it or close your account.
Your rights
If you are in the EU/EEA (or a similar regime), you have the right to access, correct, delete, export, or object to the processing of your personal data. Sign-in account data can be removed by deleting your account in the dashboard, or email [email protected]. You may also complain to your local data-protection authority.
Requesting deletion of your data
This applies to antics (antics.gg) and to our apps, including SIDE OUT for Android and iOS, all published by AGE OTORI PTE. LTD.
How to ask. Email [email protected] with the subject "Data deletion request". Tell us the display name you played under and roughly when you last played, so we can find your rows — the apps have no accounts, so that is the only way we can identify what is yours. If you signed in to the website with GitHub, say so and we will use that instead; you can also delete that account yourself from the dashboard at any time. We will confirm within 30 days.
What we delete. Your leaderboard entries (display name, score, and the per-room player id attached to them), any projects, API keys and deployments on a signed-in account, and our correspondence with you about the request.
What we keep, and why. Records of purchases made in our apps are kept for as long as tax and accounting law requires us to keep them; these sit with Apple, Google and RevenueCat as the processors of the transaction, and we cannot delete a store's own receipt. Aggregate counters (how many rooms opened, how many players were concurrent) are not personal data and are not linked to you; they stay. Room data expires on its own — keyless rooms and everything in them after 24 hours — and IP addresses are processed transiently for rate limiting and abuse prevention and are not stored against you.
Children
antics is not directed at children under 13, and we do not knowingly collect their personal data. Our apps are rated for players aged 13 and over.
Changes
We may update this policy; we'll change the "last updated" date above and, for material changes, give notice where appropriate.