Privacy Policy

Chillgame is a hub of browser-based party games (such as Mafia, Spy, Shelter and TheHat) that you play with friends, with real-time voice and video built in. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), Chillgame is the data controller of the personal data described here, except for payment data, which is controlled by our payment provider (see “Who we share data with”).

You can contact us about privacy at any time at support@chillgame.online.

• We only collect what we need to run your account, save your game progress, process payments and keep the service secure.
• We sign you in through providers you choose (Google, Discord, GitHub, an email magic link, or Telegram). We never see your password for those providers.
• Payments are handled by Whop as merchant of record — we do not store your card details.
• Voice and video chat is streamed live between players and is not recorded by us.
• We do not sell your personal data.
• You can view, export or delete your data — see “Your rights”.

Account & identity. When you sign in we receive, from the provider you choose, your name or username, email address and avatar image. If you sign in with Telegram we receive your Telegram ID and username. We store the connection between your account and each provider so you can sign in again.

Profile data you provide. An optional public username (handle), display name, short bio, chosen avatar (and, on paid tiers, a custom uploaded avatar), and your privacy preference (whether your profile is public).

Gameplay data. Level, XP, prestige, per-game statistics (games played, wins, time played), achievements, daily/weekly tasks, login streak, badges, in-game currency balance, owned cosmetics and pets, and a ledger of currency movements. This is tied to your account so your progress follows you across games.

Billing & donation data. Your subscription tier and status, add-ons, renewal dates, and totals used for the donors leaderboard. The payment itself (card number, billing address, tax data) is collected and stored by our payment provider, not by us — we receive only confirmation events and identifiers needed to apply your plan.

Communications. In-game chat messages, and any message you send us by email or on our community channels.

Technical & usage data. IP address, browser/device type, approximate region, and server and error logs (including crash reports). We also keep anonymous, aggregate counters such as total site visits. We do not use these to build advertising profiles of you.

Fair-play signals. Levels, achievements and invite rewards are worth something, so we check that two accounts sitting at the same table are not one person collecting twice. For that check our game servers use three things: a random device identifier stored in a cookie; a deliberately coarse summary of your browser's hardware — screen size and colour depth, processor cores, memory, timezone and graphics card name, combined into a short one-way hash; and the IP address the connection came from. The hash is blunt by design — many unrelated people produce the same value — so it cannot identify you on its own, and we never act on it unless the IP address agrees with it and both accounts are in the same match at the same time. We store the device identifier and the hash against your account. The IP address used in this check is only compared between players of one match and is not saved as part of it; IP addresses may still appear in ordinary server logs, as described above.

Analytics. If you accept optional cookies, we use Google Analytics 4 and Yandex.Metrika to measure how the site is used — pages viewed, games opened, rough location (country/city level), device and how you found us. Metrika's Webvisor also records a replay of the session — mouse movement, scrolling and clicks — so we can see which pages confuse people. Each provider receives a randomly generated identifier stored in a cookie, never your name, email or account details. Without your consent no Metrika script runs at all, and the Google Analytics tag, while present on the page, is told to store nothing and sets no cookie. See “Cookies” and our Cookie Policy.

Cookies & similar technologies. See our Cookie Policy for the full list.

• To create and operate your account and sign you in.
• To save your progress and apply the features of your plan across every game.
• To run real-time multiplayer sessions, including voice and video.
• To process subscriptions, add-ons and donations through our payment provider.
• To power public features you opt into — your public profile, search and leaderboards.
• To keep the service secure, prevent fraud and abuse, debug problems and enforce our Terms of Service.
• To keep rewards fair — checking that two accounts at one table are not the same person (see Fair-play signals above).
• To respond to your requests and send essential service emails (such as sign-in links and billing notices).
• To understand aggregate usage and improve the games.

Where the GDPR applies, we rely on the following legal bases:

• Contract. Running your account, saving progress and providing the games you ask for.
• Legitimate interests. Securing the service, preventing abuse, debugging, and improving our games — balanced against your rights.
• Consent. Non-essential cookies (such as advertising) and any optional features that ask for it. You can withdraw consent at any time.
• Legal obligation. Keeping records we are legally required to keep (for example, tax records held by our payment provider).

Several games include live voice and video, delivered through our real-time infrastructure provider, LiveKit. Audio and video are streamed between players in real time to let you play together. We do not record, store or transcribe your camera or microphone streams. Your browser will ask for camera/microphone permission before any stream starts, and you can mute, disable video, or leave at any time.

We do not sell your personal data. We share it only with service providers (“processors”) that help us run Chillgame, and only as needed:

• Whop — payment processing and merchant of record (billing, card data, tax). They are an independent controller of your payment data under their own privacy policy.
• Sign-in providers (Google, Discord, GitHub, Telegram) and Resend for sending sign-in and service emails.
• LiveKit — real-time voice/video transport (not recorded).
• Hosting & infrastructure — our cloud hosting, database and cache providers that store and serve the data above.
• Sentry — error and crash reporting, to diagnose problems.
• Google — Google Analytics (traffic measurement) and Google AdSense (advertising). AdSense loads only after you accept optional cookies; the Analytics tag loads for everyone but stores nothing until you do. To see how Google uses this data, read How Google uses information from sites or apps that use our services.
• Yandex — Yandex.Metrika (traffic measurement and session replay), processed on servers in the Russian Federation. Nothing loads and nothing is sent until you accept optional cookies. See the Yandex Privacy Policy.
• Advertising partners — only where ads are shown and only with your cookie consent (see the Cookie Policy).

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (in which case we will notify you).

Our providers may process data in countries outside your own, including outside the European Economic Area. Where that happens, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to protect your data.

One transfer is worth naming on its own: Yandex.Metrika processes analytics data on servers in the Russian Federation, a country with no European Commission adequacy decision. It runs only for visitors who accept optional cookies, and refusing them — or later withdrawing consent from the Cookie Policy page — means no data reaches Yandex at all.

We keep your account and gameplay data for as long as your account exists. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (for example, billing and tax records held by our payment provider, or data needed to resolve disputes or comply with law). Aggregate, anonymised statistics that no longer identify you may be kept indefinitely.

The fair-play signals described above follow the same rule: the device identifier and hardware hash are kept while your account exists and are deleted along with it. The IP address used in that check is held only for as long as the game room itself, and is never written into your account record.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”).
• Restrict or object to certain processing, including profiling.
• Port your data to another service.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

You can manage much of this yourself from your profile — editing your details, unlinking connected accounts, or making your profile private. To exercise any other right, email support@chillgame.online. We will respond within the time required by applicable law (usually within one month). If you are in California, we do not sell or share your personal information as those terms are defined under the CCPA/CPRA.

We protect your data with encryption in transit (HTTPS), httpOnly and secure session cookies, scoped access to our systems, and reputable infrastructure providers. No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and the relevant authority of a breach where required by law.

Chillgame is not directed to children under 13, and you must be at least 13 years old to create an account. If you are under the age of majority in your country, you may only use Chillgame with the involvement of a parent or guardian. If we learn that we have collected personal data from a child under 13 without proper consent, we will delete it. If you believe a child has provided us data, contact support@chillgame.online.

We use cookies and similar technologies for sign-in, preferences, and — with your consent — analytics and advertising. Analytics is Google Analytics 4 and Yandex.Metrika; advertising is Google AdSense. None of them sets a cookie until you accept optional cookies in the banner. The AdSense and Metrika scripts do not load at all before that; the Google Analytics tag does load, but under Google's Consent Mode it is told to store nothing and to send no advertising identifiers until you agree. You can change or withdraw that choice at any time from the Cookie Policy page, and withdrawing also clears the analytics cookies already on your device. For details of how Google handles the data, see How Google uses information from sites or apps that use our services. For a full breakdown of each cookie, its purpose and how to control it, see our Cookie Policy.

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you in the product. Your continued use of Chillgame after a change takes effect means you accept the updated policy.

Questions, requests or complaints about privacy? Email us at support@chillgame.online or reach us on our Discord community. We read every message.