Privacy Policy

1. Who is responsible for your data

1.1 Controller. TheMeanOne Developments, the United States business that operates Oddshelf ("we", "us"), is the controller of the personal data described in this policy. Postal address: [Postal address to be added]. Email: [email protected].

1.2 EU and UK representatives. Where Article 27 of the GDPR or the UK GDPR requires us to appoint a representative, their details are:

• EU representative: [EU Article 27 representative to be added]
• UK representative: [UK Article 27 representative to be added]

1.3 Data protection contact. We are a small business and have not appointed a statutory Data Protection Officer because we are not required to. All privacy questions are handled by the person responsible for data protection at [email protected].

1.4 Creators as independent controllers. When you buy a Product, the Creator who sells it receives limited information needed to complete the sale (see section 6). For that information, and for anything a Creator collects inside their own game or on their own website, the Creator is an independent controller responsible under their own privacy notice.

1.5 Scope. This policy covers oddshelf.io and its subdomains, the separate domain used to run browser games, Oddshelf Rooms, and our emails. It does not cover third-party sites you reach through links, including PayPal, GitHub, Lemon Squeezy and external download hosts.

2. The personal data we collect

2.1 Account data

• Username, display name and email address.
• Password, stored only as a salted PBKDF2-SHA256 hash. We never store your password in readable form and cannot recover it.
• Age and consent confirmation. At sign-up you tick a box confirming you agree to the Terms and this policy and that you meet the age requirements. We record that you did so and when.
• Optional profile data: a bio and, if you sign in with GitHub, your GitHub avatar.
• Creator payout data: if you sell Products, the PayPal email address buyers pay you through.
• Settings and preferences, such as whether you have opted in to see 18+ content.

2.2 Sign in with GitHub (optional)

If you choose to sign in with GitHub, GitHub sends us your GitHub user id, username, name, avatar URL, bio and primary verified email address. We do not receive your GitHub password or access to your repositories. You can also revoke Oddshelf's access in your GitHub settings.

2.3 Content you create

• Creator content: game pages and Listings, files uploaded to Oddshelf Vault, External Links, cover images, screenshots, descriptions, prices, licence choices and optional Made with AI badges.
• Community content: comments, 1 to 5 star ratings, forum threads and replies.
• Reports you send about content or users, and appeals.
• Messages you send us by email.

2.4 Purchases and Library

For each purchase or claim we keep a record of the Product, the amount, the date and the payment provider's reference (for example a PayPal transaction id), and add the Product to your Library. We do not receive or store card numbers or bank details. For Pro, Pro+ and Boosts, Lemon Squeezy tells us the subscription status, plan, renewal date and an order reference.

2.5 Security logs

Our hosting provider, Cloudflare, keeps server logs that include your IP address, user agent (browser and device type) and timestamps of requests. These are used only for security, abuse prevention and fixing errors, and are kept for up to 30 days.

2.6 Session data

When you sign in we create a session. Your browser holds the session token in the os_session cookie; we store only a SHA-256 hash of that token on our side, with its expiry date. See the Cookie & Storage Policy.

2.7 Rooms (multiplayer browser games)

When you play a multiplayer browser game that uses Oddshelf Rooms, your game messages pass through our relay servers to other players in real time. They are relayed live and not stored. As with any connection, your IP address may appear in the security logs described in 2.5.

2.8 What we do not collect

We do not use analytics tools, advertising networks, tracking pixels, fingerprinting, social media plugins or third-party ad cookies. We do not collect precise location, contacts, biometric data or payment card data. We do not ask for sensitive data such as health, religion or ethnicity; please do not post it.

3. Why we use your data and our legal bases

Under the GDPR and UK GDPR we must have a legal basis for each use of personal data. The table below sets out each purpose and the basis we rely on.

3.1 Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your rights and concluded that the use is expected and proportionate. You can object at any time (see section 9).

3.2 Consent. We do not currently rely on consent for any processing, apart from parental consent for young users where required. If we ever add optional analytics, they will be switched off until you opt in, and you will be able to withdraw that consent at any time.

3.3 No marketing emails without permission. We will not send you marketing emails unless you have opted in, and every marketing email will have an unsubscribe link.

3.4 No automated decisions with legal effects. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use automated tools (such as malware scanning and spam filters) to flag content for review; a person makes final moderation decisions on accounts.

3.5 No AI training on your data. We do not sell your content to, or use it to train, AI models.

4. What is public

Some information is visible to everyone by design:

• your username, display name, bio and (if you use GitHub sign-in) avatar;
• your Listings and everything on them, if you are a Creator;
• your comments, ratings and forum posts, with your name;
• if you are a Creator selling paid Products, buyers are shown your PayPal payee name or email during checkout, because they pay you directly.

Your email address, purchases, Library and reports are not public.

5. Service providers (processors)

We use a small number of service providers who process data on our behalf under contracts that require them to protect it and use it only on our instructions.

We will update this list before adding a new processor that handles personal data, and will name the email provider once chosen.

6. Independent controllers and other sharing

6.1 Legal requests. We may disclose data when we believe in good faith it is required by law, a court order or a valid request from authorities, to protect the safety of any person, to prevent fraud or abuse, or to protect our rights. Where lawful, we will tell you about requests for your data.

6.2 Child safety. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as required by US law, and may share related data with law enforcement.

6.3 Business transfers. If Oddshelf is sold, merged or reorganised, data may transfer to the new operator, which will be bound by this policy (including the Library guarantee) and must tell you before making material changes.

6.4 No selling, no ad sharing. We do not sell personal data and do not share it for cross-context behavioural advertising (as those terms are used in the CCPA/CPRA), and do not process it for targeted advertising (as used in US state privacy laws).

7. International transfers

7.1 We are based in the United States, and our data is processed in the US and on Cloudflare's global network, so data from users in the EU, EEA, UK and elsewhere is transferred outside their country.

7.2 For transfers from the EU/EEA, UK and Switzerland we rely on:

• the EU-US Data Privacy Framework (and its UK Extension and Swiss counterpart) where the recipient is certified under it; and
• the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data) where it is not, together with supplementary measures such as encryption in transit and at rest.

7.3 Transfers that are necessary to perform our contract with you (for example, delivering a Product to you) may also rely on Article 49(1)(b) GDPR. You can ask for a copy of the relevant safeguards at [email protected].

8. How long we keep data

8.1 Account deletion. When you use "Delete my account" in Settings: your personal data is erased; your comments are deleted; your forum posts are kept but shown as "[deleted user]" with their text removed; purchase records are kept anonymised where the law requires; and if you are a Creator, your Listings are delisted but buyers keep access to what they bought. We may keep minimal data longer where we must for legal reasons, for example an unresolved legal claim or a record of a ban to prevent ban evasion.

9. Your rights

9.1 Self-service tools. In Settings you can:

• Download my data - a machine-readable JSON export of your Account, profile, content, purchases and Library;
• Delete my account - permanent deletion as described in section 8.1;
• edit your profile, and edit or remove your own content using the controls on the site (or ask us to).

9.2 EU, EEA and UK (GDPR and UK GDPR)

You have the right to: access your data; rectify inaccurate data; erasure; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time where we rely on it; and not be subject to solely automated decisions with legal or similarly significant effects. You also have the right to complain to a supervisory authority, in particular in your country of residence (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.

9.3 California (CCPA as amended by the CPRA)

To the extent the CCPA applies to us, California residents have the right to: know what personal information we collect, use and disclose; access a copy; delete it; correct it; opt out of sale or sharing (we do neither); limit use of sensitive personal information (we use account login credentials only to sign you in, which is a permitted purpose); and not be discriminated against for exercising these rights. You may use an authorised agent.

Notice at collection - categories in the last 12 months: identifiers (username, email, IP address, GitHub id); customer records (PayPal payout email); commercial information (purchases and subscriptions); internet activity (security logs); and account login credentials (password hash). Sources: you, GitHub (if you use it), PayPal and Lemon Squeezy, and our host's logs. Purposes: those in section 3. Disclosures for business purposes: to the processors in section 5. Retention: section 8. We have not sold or shared personal information, and we do not knowingly sell or share data of consumers under 16.

9.4 Other US state privacy laws

To the extent a US state consumer privacy law applies to you, you have the right to confirm whether we process your data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling with legal or similarly significant effects (we do none of these). If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal"; we will respond within 60 days. If the appeal is denied, you may contact the Attorney General of your state.

9.5 How to make a request

Use the Settings tools, or email [email protected] from the address on your Account. We may need to verify your identity before acting, and will not ask for more information than needed. We respond within one month (GDPR/UK GDPR, extendable by two months for complex requests) or 45 days (US state laws, extendable by 45 days), and free of charge unless a request is manifestly unfounded or excessive.

10. Children

10.1 Oddshelf is not directed at children under 13, and you must be at least 13 to create an Account. In the EU, EEA and UK, users under 16 (or the lower digital-consent age in their country) need the consent of a parent or guardian. Minors may not make purchases without a parent or guardian.

10.2 We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an Account, or a child in Europe has done so without required consent, email [email protected] and we will close the Account and delete the data.

10.3 We do not profile minors or show them 18+ content, which is hidden unless an adult user opts in.

11. Security

We protect your data with measures appropriate to the risk, including:

• HTTPS everywhere, with Secure, HttpOnly and SameSite cookies;
• passwords stored only as salted PBKDF2-SHA256 hashes; session tokens stored only as SHA-256 hashes;
• CSRF protection, including the short-lived os_oauth state cookie during GitHub sign-in;
• browser games isolated in a sandbox on a separate domain;
• encryption at rest provided by our hosting provider, and access to production data limited to people who need it;
• malware scanning of files (being introduced) and DDoS protection.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant authority and you without undue delay, as the law requires.

12. Cookies and local storage

We use one strictly necessary session cookie (os_session), a temporary security cookie during GitHub sign-in (os_oauth), and two local storage entries (os-theme and os-consent). Full details are in the Cookie & Storage Policy.

13. Changes to this policy

We will update this policy when our practices change, for example when we choose an email provider or start malware scanning. For material changes, we will give at least 30 days' notice by email or on the Service. The version number and date at the top always show the current version.

14. Contact

Privacy questions and requests: [email protected]. Post: TheMeanOne Developments, [Postal address to be added]. Other topics: see the Legal hub.