Privacy policy

Hackemist hosts browser apps, games and creator articles. Contact support@hackemist.com or use Contact and rights requests (/contact).

Scope and contact

This policy explains Hackemist's handling of personal information. Contact support@hackemist.com or use /contact for privacy questions, access, correction or deletion requests. Creator apps and external services may process information separately and must provide their own appropriate disclosures.

Information processed

Account records include email, username, display name, profile, age attestation, salted password hash and verification records. We process uploaded app versions, thumbnails, categories, tags, Journal drafts and articles, reviews, reports, appeals and support requests. Publication and visibility settings determine what visitors can see.

If you choose Google sign-in, we receive an identity identifier, email address, verification information and display name. We retain the account link and necessary trust records. Google tokens are checked during sign-in and are not retained as access to your Google services. Short-lived browser-bound records protect login and signup. Google provides its own information about its processing.

Authorized MCP clients can receive the account profile and app data permitted by their granted scopes. We retain connection metadata and hashed credentials for access control, renewal, revocation and security. Review your AI provider's privacy terms before authorizing access to confidential project content.

We keep sessions, scoped credentials, launch and qualified-play activity, moderation decisions and administrator audit records. Explicit saves contain information an app submits through the save SDK. Approved automatic saves contain that app's localStorage snapshot, including its browser cookie emulation. The platform does not automatically upload arbitrary in-memory state or all IndexedDB data. Network requests expose an IP address and request information to hosting infrastructure and permitted external services.

Payment and creator records can include subscription identifiers, provider statuses, receipts, refunds, disputes, applications, allocations and payouts. Card details are processed by provider-hosted checkout or secure fields and are not stored by Hackemist. Providers may conduct identity, banking, sanctions and tax checks. Bank-recipient forms send necessary information to the selected provider; the platform retains recipient references and encrypted contact or routing information where required for a payout route. Do not place identity documents or full payment credentials in public uploads or ordinary app saves.

Purposes and legal bases

We use information to provide accounts, hosting, publication, gameplay, saves, requested email, support, rights requests, moderation, authorized payments and creator accounting, and to protect the service. Applicable bases include providing the requested service, legal duties, proportionate security and service-operation interests and consent where required. Optional uses requiring consent do not rely on acceptance of terms alone. Consent can be withdrawn without affecting lawful earlier processing.

Cookies and app storage

A session cookie keeps you signed in; request-forgery tokens protect account actions. Browser storage may support interface recovery and requested checkout continuity. Approved apps use separate storage associated with the app and player. Clearing browser data can erase guest or browser-only saves. Cloud saves remain until deleted, subject to the app's save behavior.

The default platform does not install advertising trackers or sell personal information. Creators must disclose optional analytics, cookies and external collection and obtain any required consent. Added operator analytics or marketing requires appropriate notices and choices. Browser restrictions can affect sign-in and storage.

Visibility and recipients

Public profiles, listings, previews, reviews and published articles are visible to visitors according to their access rules. Private source files, unpublished articles and per-account cloud saves are restricted to the account and authorized platform administration. Creators are not given another account's password or another app's cloud saves. Administrators may access content as needed for support, moderation, operation or security.

Infrastructure, email, private object storage, backup and payment providers receive information needed for their services. Storage may be local or use a configured S3-compatible service, including Backblaze B2, with a separate private backup destination. Necessary information may be shared for valid legal demands, fraud, rights disputes or safety. Rights notices and counter-notices may be shared with the affected party; unnecessary personal details should be minimized. We do not sell your data.

External apps and international processing

Permitted app APIs, WebSockets, frames and forms can send data directly to the creator's providers. Read the creator's disclosures before using those features. A launch URL is a temporary access grant; do not share it publicly. Sandbox and origin isolation reduce risks but cannot guarantee every creator or external service's conduct.

Hosting and provider locations may differ from your location. Where international transfers require safeguards, the operator must implement those safeguards and legally required notices or permissions. Contact the privacy address for current hosting locations, processors and transfer arrangements. A global audience does not mean information remains in every visitor's country.

Retention and deletion

Active account and content records are kept while needed to provide the service. Account deletion clears platform progress, automatic saves and reviews, invalidates access and unpublishes owned content. Deleted app bundles and versions can remain in restricted archives for recovery, rights disputes or legal duties; they cannot be publicly launched. Request erasure of retained personal uploads through the privacy contact.

Financial, fraud, security, moderation and rights-request records may be retained for applicable accounting obligations, dispute periods, abuse prevention or legal holds. Retention follows those purposes and applicable legal periods, rather than an unlimited right to reuse information. Encrypted backups expire through the operator's rotation schedule; deletion may not immediately remove a copy from an isolated backup. Deletion requests must be reapplied if a backup is restored. Request the retention periods for a particular record from the privacy contact.

Controls and rights

Settings lets you edit your profile, export account data, manage subscriptions, revoke credentials and request deletion. Depending on applicable law, you may request access, correction, erasure, restriction, portability or objection, withdraw consent and complain to a competent authority. We may proportionately verify requests and explain lawful refusals or retained records. Responses follow applicable legal deadlines. Do not send a password or full payment credentials to make a request.

Security, age and updates

We use salted password hashing, account checks, scoped credentials, isolated runtime origins and encrypted service credentials and backups. No online system guarantees complete security. Report suspected exposure to support; incidents are assessed and legally required notifications provided.

The platform is intended for adults aged 18 or older. We do not knowingly provide registered accounts to children. Report a child's account or improperly exposed personal information through /contact. Material changes receive additional notice or consent where required.