Cassette Privacy Policy
Last updated: TODO: publish date
This policy explains what personal data Cassette (cassette.gg) uses, why, who else receives it and what you can do about it. In short: we don't run ads or third-party tracking, and our servers never receive your email address. We count visits with our own statistics, which use no cookies. What you own is recorded on a public blockchain, where anyone can see it and nobody can delete it. Games send us play statistics, which developers see only as totals.
Who is responsible
Delegas Labs, S.L. (NIF B27530849, Paseo de la Castellana 257, 28046 Madrid, Spain) is the controller of the personal data described here. Contact: [email protected].
Public blockchain data
Your wallet is an address on the Polygon blockchain. These records are written to the blockchain and linked to that address:
- your @username;
- the licences and items you get or transfer;
- your purchases from developers' storefronts, with their prices, and any refunds;
- if your wallet is ever restricted in our self-refund abuse registry: the address, the end date, a rule number and a case reference;
- if you are a developer, your profile, game pointers, storefront, listings and payout address.
Anyone in the world can read them, and nobody, including us, can change or delete them. The blockchain doesn't contain your name or email address. But if you tell people your address or @username, or link them to your identity elsewhere, those records can be tied to you. Think about that before you share them.
What we use and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Wallet address and @username | Created when you sign in and claim a name | Your account, sign-in, purchases, profile pages | Contract |
| Blockchain records (above) | Read from the public blockchain by our indexer | Show your library, receipts, ownership and stats | Contract |
| Sign-in sessions: a signed sign-in message, then a session token valid for 7 days | You, when you sign in | Keep you signed in to our services | Contract |
| Play sessions: wallet address, @username, game, a fingerprint of a key held in your browser, start and last-active times | Your browser while you play | Tell the game who you are; stop copied sessions working on another device | Contract |
| Play statistics: session start and end, load time, a heartbeat every 30 seconds while the game is visible, pauses, error messages (up to 500 characters) and events the game defines | The game and the Cassette player | Statistics for developers, trending and recommendations, "playing now" counts, fixing errors | Legitimate interest in running and improving the store |
| Site statistics: pages viewed (the address and campaign tags only), the site that sent you, browser and device type, screen size, language, country, and what you do on Cassette: starting and leaving a game and for how long, signing in, claiming a @username, publishing, searching (the search text) and opening a game on its own website | Your browser, while you use Cassette | Understand how Cassette is used, which pages and links bring people, and what to improve | Legitimate interest in running and improving the store |
| Technical data: IP address, browser and device type | Every request | Deliver pages, prevent abuse (rate limits), security | Legitimate interest in a secure service |
| Developer data: profile details, operator keys, game pointers and build hashes, storefront addresses, game and item metadata, documents' addresses and hashes, agent link codes | You or your agent, and your public storefront | List your games on Cassette | Contract |
| Developer seller details: whether you sell as a business or a private individual; for a business, legal name, address, email and VAT number; a contact for buyers | You, before selling paid content | Show buyers who the seller is, as consumer law requires; pass on buyers' requests; reporting where the law requires | Legal obligation; contract |
| Player reviews: whether you recommend the game, your text, the dates and whether you edited it, your playtime in the game (in hours) and whether you own or bought it, when you wrote it; helpful votes you give other reviews | You; playtime from our play sessions; ownership from the blockchain | Publish your review under your @username, check that you can review the game, show helpful counts and work out the game's score | Contract (you choose to post it) |
| Claims: the listing, your address, the claim code and method | You | Verify and record a claim | Contract |
| Reports and notices: what you report, why, and your contact details if you give them | You | Handle reports and legal notices, and answer you | Legal obligation; legitimate interest in a safe store |
| Self-refund abuse cases (see criteria): your wallet's purchases and self-refunds from the blockchain; for rule 2, your play time in the game before a self-refund; for rule 3, wallets linked to yours by a shared browser key or the same first-funding address; the reviewer's decision and any appeal | Public blockchain data and our play sessions | Prevent self-refund abuse for the developers who use the registry | Legitimate interest in preventing fraud (GDPR recital 47). We think it is balanced: a restriction only removes a self-service convenience, never buying, playing or your rights against developers; a person decides; each restriction lasts at most 90 days and is renewed only after a new review; links between wallets are never published; and you can appeal |
| Messages: emails you send us, including purchase questions, cancellations and refund requests | You | Answer you, and pass purchase requests on to the developer who sold to you | Legitimate interest; contract where it concerns a purchase |
| Community listing data (see below) | Public websites | List browser games found on the open web | Legitimate interest |
When you play signed in, statistics are linked to your wallet address. When you play without signing in, they are linked to a random identifier for that play session only, which is not stored on your device.
Reviews are public. You need a @username to post a review. Anyone can see, on Cassette and through our public API: your @username, your review, your playtime in the game, whether it's marked as a purchase, its dates, and how many people found it helpful. We don't show your wallet address with reviews, and we don't show who voted on which review. Note that @usernames are recorded on the public blockchain, so anyone can look up the address that holds yours. Deleting a review removes it from Cassette, but not from copies others may have made.
Site statistics are not linked to your wallet address. To count visits without cookies, our server works out a code from your connection (your IP address and browser). The code changes every day and can't be traced back to you, and nothing is stored on your device. We don't keep your IP address with it. Search text is stored in lower case and cut to 64 characters, so please don't type personal details into search.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Trending lists and recommendations are automated, but they rank games, not people.
What we don't receive
- Your email, Google or Apple account. Sign-in happens directly between your browser and Polygon's wallet service. The email or account name you signed in with is kept only in your browser, to show it to you.
- Your purchases, beyond the blockchain. You buy from developers' own storefronts. We don't keep our own records of what you buy or try to buy; Cassette's library and receipts read the public blockchain.
- What games collect themselves. Games are made by independent developers. If a game has its own accounts, cookies, ads or analytics, the developer is responsible for them, and its privacy policy applies.
Who else receives data
- Polygon OMS Wallet (Polygon Labs) provides sign-in and the wallet. It processes your email or Google/Apple sign-in and your wallet keys under its own terms and privacy policy.
- Google or Apple, if you choose to sign in with them, under their own policies.
- Cloudflare (Cloudflare, Inc.) provides our domain name service, content delivery and security. All traffic to Cassette passes through it, and it tells us which country a request comes from.
- Hetzner Online GmbH hosts our servers in Germany.
- Polygon node providers. Our servers and your browser read the blockchain through Polygon network node providers, which see the requests and, for your browser's requests, your IP address.
- Game developers and their hosts. Games are hosted by their developers, for example on Cloudflare Pages, Netlify, Vercel or GitHub Pages. When you play, your browser loads the game from the developer's host, which sees your IP address. A game you play signed in receives your @username and wallet address (see our Terms). Developers see aggregated statistics about their games, never the statistics of individual players. Developers sell to you directly from their own storefronts, so they see your purchases, and they receive any purchase question, cancellation or refund request you ask us to pass on. For your purchases, your play on their site and anything their game collects, the developer is a separate controller with its own privacy notice.
- Authorities, when the law requires us to share data.
We don't sell personal data, and we don't share it with advertisers.
International transfers
Some of these providers are based outside the European Economic Area, including in the United States. When personal data leaves the EEA, we rely on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or on the Commission's standard contractual clauses. Public blockchain data is copied by computers around the world by design.
How long we keep it
| Data | How long |
|---|---|
| Blockchain records | Permanently on the blockchain. Our database mirrors them for as long as Cassette runs, but we stop showing yours on request where possible. |
| Sign-in sessions | 7 days |
| Play sessions | 90 days |
| Self-refund abuse cases | 1 year after the restriction ends or the appeal is decided. Each on-chain restriction expires within 90 days unless renewed after a new review, but its record stays in the blockchain's history |
| Play statistics linked to an address or session | 13 months, after which only totals without identifiers are kept |
| Site statistics | 13 months, then deleted |
| Technical data | We don't store IP addresses in our database. For site statistics, an IP address is used to work out the daily code and then discarded. Our providers keep security logs under their own policies. |
| Developer data | While your profile is active, and up to 6 years afterwards for our accounting records |
| Developer seller details | While you sell on Cassette, then 5 years after your last paid sale (the general period for claims under Spanish law) |
| Player reviews and helpful votes | Until you delete them or your account. A review we remove is kept for 6 months, for appeals, then deleted |
| Claims | While the listing exists |
| Reports and notices | 1 year after the case is closed |
| Emails | As long as needed to answer you, then deleted, unless they relate to a purchase or a dispute |
| Community listing data | While the game is listed; removed when the author asks |
Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to its use;
- send it to you or another service in a portable format.
Where we rely on legitimate interest, you can object at any time. Write to [email protected]; we may ask you to prove you control the wallet concerned, for example by signing a message.
What deletion can and can't do. We can delete what we hold off the blockchain: sessions, statistics, claims, reports and emails. We can also stop showing your @username and profile on Cassette. We can't delete or change blockchain records, and we can't remove tokens from your wallet, because nobody can.
You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es, C/ Jorge Juan 6, 28001 Madrid), or to the authority where you live.
If your game is a community listing
We list browser games found on public sources: GitHub, Hacker News, js13kGames and Ludum Dare. A person at Cassette
approves each community listing before it is public. For each game we
keep its title, links, the author's public handle, its licence, a short description and a cover image (a link to
the page's own preview image, or one we generate). We do this in our legitimate interest in helping players find
browser games, and in authors' interest in reaching them. Our crawler identifies itself, respects robots.txt and
skips pages that carry <meta name="cassette" content="noindex">. To have a listing removed, use "Request removal"
on its page or write to [email protected]. To take it over, claim it (see the
Content policy).
Children
Cassette is for people aged 14 and over. If you believe a child under 14 is using it, tell us and we'll delete what we hold about them off the blockchain.
Security
Games run from their developers' own web addresses, in a sandboxed frame, so a game's code can't reach your Cassette session. Our services use encrypted connections, and access to our systems is limited to the people who run Cassette.
Changes
If this policy changes, we'll post the new version here with its date. For significant changes, we'll also tell you on Cassette before they apply.