Privacy Policy
What we collect
Creators (signed in): when you sign in with GitHub we receive your GitHub id, login, and display name (and email only if you provide it). We store the projects, API keys, and deployments you create.
Players: players need no account. A game assigns a per-room player id and a display name (which you choose, default "Guest N"); these are tied to the room, not to a personal profile. Scores you submit are stored for the game's leaderboard.
Operational data: we process IP addresses transiently for rate limiting and abuse prevention, and to derive an approximate country (used only as an aggregate count to plan server locations — the IP itself is not stored against it). We keep aggregate, non-identifying counters (page views, traffic source, country, rooms, concurrent players) for capacity, billing, and understanding usage. Our own counters are daily aggregate totals.
We use Google Analytics (client-side, via the standard gtag.js snippet) to
understand page traffic: it sets first-party _ga cookies to recognize returning
browsers. We configure it analytics-only — ad storage, ad user data, and ad personalization
are all explicitly denied, and Google Signals is off. Our server additionally mirrors
selected product events (deploys, room lifecycle, sign-ins) to PostHog and
Google Analytics; these server events carry no browser identity, no IP, and no user agent —
pseudonymous, HMAC-derived identifiers only. PostHog is configured to build no per-person
profiles. There is no session recording anywhere.
Cookies
The only cookies on this origin are Google Analytics' _ga measurement cookies
(see above). Authentication never uses cookies — it uses a bearer token held in your
dashboard's local storage — and games you host or play cannot read analytics cookies from
their sandboxed frames. Hosted games remain served without any tracking injected into the
game itself.
Why we process it (legal basis)
To provide the service you asked for (performance of a contract), and for our legitimate interest in keeping it secure and abuse-free. We do not sell your data or use it for third-party advertising.
Who we share it with (sub-processors)
We use service providers strictly to run antics: GitHub (sign-in), MongoDB Atlas (database hosting), Amazon Web Services (server & file hosting), PostHog, and Google Analytics (privacy-preserving product analytics). They process data on our behalf under their own terms.
Our mobile apps (currently SIDE OUT on the App Store and Google Play) additionally use RevenueCat to process in-app purchases. RevenueCat receives a purchase record and an app-generated anonymous user id so it can tell the app what you have bought; it never receives your name or payment details. Your card is handled by Apple or Google under their own privacy policies — we never see it.
The mobile apps also use Google Firebase for two things, and it is worth being exact about which is which.
- Firebase Analytics — how the game is played, so we can fix what is broken and build more of what is played. Screens opened, matches started and finished, how long a round lasted, whether a room was joined or the join failed, frame rate and network latency, whether a purchase was started and whether it completed. It is tied to an app-instance identifier Firebase generates on your device, never to your name, your email or an advertising id. We do not send anything you type — not your display name, not a room code, not an invite link. Career totals and latency are sent as ranges (“10–49”, “under 100ms”), never as exact numbers, because an exact running total is itself a way to recognise a device.
- Firebase Crashlytics — what the app was doing when it crashed: the device model, OS and screen size, and the state of the match (phase, number of players, whether you were hosting). No behavioural profile, and again nothing you typed.
Your control over it. Options → Share usage data in the app turns analytics off, and turning it off also tells Firebase to delete the app-instance identifier everything collected so far is filed under. If you are in the EEA, the UK or Switzerland the switch starts OFF and nothing is collected unless you turn it on. Elsewhere it starts on and you can turn it off at any time. Crash reporting is not covered by that switch: a crash report says what broke, not how you play, and an app whose crashes cannot be diagnosed is its own problem for the people using it. Our legal basis for it is our legitimate interest in shipping a game that works.
Google processes this data on our behalf under the Firebase terms and its own privacy policy. We have not linked Firebase to Google Ads, we do not collect an advertising identifier, and none of it is used to track you across other companies’ apps or websites.
Where & how long
Data is hosted in the United States, so if you are in the EEA your data is transferred outside it. For those transfers we rely on appropriate safeguards — our hosting providers (Amazon Web Services and MongoDB Atlas) offer Standard Contractual Clauses through their data-processing agreements.
Keyless rooms and their data expire (currently after 24 hours). Account data (projects, keys, leaderboards) is kept until you delete it or close your account.
Your rights
If you are in the EU/EEA (or a similar regime), you have the right to access, correct, delete, export, or object to the processing of your personal data. Sign-in account data can be removed by deleting your account in the dashboard, or email [email protected]. You may also complain to your local data-protection authority.
Requesting deletion of your data
This applies to antics (antics.gg) and to our apps, including SIDE OUT for Android and iOS, all published by AGE OTORI PTE. LTD.
How to ask. Email [email protected] with the subject "Data deletion request". Tell us the display name you played under and roughly when you last played, so we can find your rows — the apps have no accounts, so that is the only way we can identify what is yours. If you signed in to the website with GitHub, say so and we will use that instead; you can also delete that account yourself from the dashboard at any time. We will confirm within 30 days.
What we delete. Your leaderboard entries (display name, score, and the per-room player id attached to them), any projects, API keys and deployments on a signed-in account, and our correspondence with you about the request.
What you can delete yourself, without asking us. Turning off Options → Share usage data in the app deletes the app-instance identifier that all of its analytics data is filed under, which unlinks that data from your device immediately and stops any more of it being collected. You do not need to email us for that one, and we cannot do it for you — the identifier only exists on your device.
What we keep, and why. Records of purchases made in our apps are kept for as long as tax and accounting law requires us to keep them; these sit with Apple, Google and RevenueCat as the processors of the transaction, and we cannot delete a store's own receipt. Aggregate counters (how many rooms opened, how many players were concurrent) are not personal data and are not linked to you; they stay. Room data expires on its own — keyless rooms and everything in them after 24 hours — and IP addresses are processed transiently for rate limiting and abuse prevention and are not stored against you.
Children
antics is not directed at children under 13, and we do not knowingly collect their personal data. Our apps are rated for players aged 13 and over.
Changes
We may update this policy; we'll change the "last updated" date above and, for material changes, give notice where appropriate.