Privacy Policy

Bazoodle Privacy Policy

Effective date: October 31, 2026

Who we are: BAZOODLE LLC ("Bazoodle", "we", "us"). Contact: help@bazoodle.com

The short version

You can play without an account. If you are under 13, you play as a guest. Guests save nothing, and we do not ask guests for a name, email or any account details. Accounts are for people 13 and older. To make one we ask your birth month and year (not the day), and we keep only that. We never show your age to anyone. We collect very little. We do not ask for your real name, address, phone number or school. We do not store your email address when you use a sign-in link. When you sign in with Google or Microsoft, we get an ID number from them, not your name or email. There is no chat. You cannot send free-text messages to other players. You can send preset reactions like "wave" or "good game". We do not sell your personal data. Not ever. Ads: Bazoodle shows ads to pay for the site. Under-18s and anyone whose age we do not know only see ads that are not personalized (kids under 13 get child-directed ads). Only people who say they are 18 or older can get personalized ads, and in places where the law requires it, only after they say yes. You are in control. In Settings > Your data you can download your data or delete your account. You can also email help@bazoodle.com. If you report a player or a game, the report includes the last 2 minutes of the game replay so we can see what happened.

The rest of this page explains everything in detail.

1. What we collect, and why

1.1 If you play as a guest (no account)

A random ID in your browser so the game can keep you in your session (for example, if you disconnect for a moment and rejoin). It is not tied to your name or any account. Technical data that any website receives, such as your IP address and browser type. We use IP addresses to keep the service working and fair: to limit how fast one device can send requests, to prevent abuse and to connect you to a game session. Rate-limit counters use a scrambled (hashed) version of the address. When you play, your device may connect to other players through our relay servers (Cloudflare). Relays are used so that other players do not see your IP address. Guests earn no coins or levels and nothing is saved.

1.2 If you make an account (13 and older)

What, Why, Notes.

Birth month and year, To check you are old enough, and to unlock age-based game ratings at 13 and 17, We do not store the day. We never show it.. A sign-in ID, To let you sign in, Google or Microsoft: an ID number only (we ask only for the basic openid scope; we do not get your name or email). Passkey: a public key. Email sign-in link: see 1.3.. Your username, Shown to other players, Pick something that is not your real name. Free-text names are checked and changed on report if they look like real names.. Game saves, coins, levels, cosmetics you own, ratings, friends, blocked players, settings, To make the platform work, Saves are small and checked for fairness.. Games you make and publish, To host and show them, See the Terms of Service.. Login sessions, To keep you signed in (about 90 days on remembered devices), We store a scrambled version of the session token, not the token.. Moderation records, Reports, strikes, bans, See section 4.. Purchase status, If you subscribe to Premium, See "Payments" below..

1.3 If you sign in with an email link

You type your email so we can send you a one-time sign-in link. We use your address to send that email through Resend (our email service). We do not save your email address in our database. Your account is linked to a scrambled code made from it (a keyed hash), so we can recognize you next time but cannot read the address back. Resend handles the address while it delivers the message (see section 7). If you ask for notification emails in the future, we would need to keep an address to send them, and we would update this policy and ask first.

1.4 Payments (Premium)

Paying for Premium happens on Stripe's pages. We never see or store your card number. Stripe gives us a customer reference, the plan, and the subscription status. You must be an adult (or have a parent or guardian) to pay.

1.5 Reports

When you report a player or a game, we collect the reason you pick from a fixed list (cheating, being mean, a bad name or look, sharing personal info, or something else), the game and version, and the last 2 minutes of replay from your game, which can show what other players did and said in-game (through game actions, since there is no chat), their usernames and appearances. Reviewers use it to decide what happened. A report never contains a free-text message from you.

1.6 Things we do not collect

We do not collect your real name, home address, phone number, school, photos, precise location, contacts, or government ID. We do not use face scans or ID checks. We do not run chat or voice. Creators cannot add their own trackers, ads or links to outside sites inside their games, and games cannot read personal data about you.

2. How we use data

To run the platform: sign you in, host sessions, save your progress, show friends and levels. To keep players safe: moderation of games and usernames, handling reports, finding cheaters, banning accounts. To take payments and manage Premium. To show ads (see section 5) and to measure how many people see them. To keep the service secure and within our costs (rate limits, abuse prevention). To show you games you might like: the "For you" row uses only your play history on Bazoodle. It is never used for ads, and you can turn it off in Settings. To count how many people play a game (creators see totals only, never who played). To answer your email and obey the law.

We do not use your data to profile you for advertising. We do not use game or account data to train advertising systems. We do not make decisions with legal effects about you by computer alone; moderation decisions can be appealed (see the Terms).

3. Kids and COPPA

Bazoodle is open to everyone as a place to play, but accounts are for people 13 and older at launch.

Under 13: you can play as a guest. Guests do not have accounts and we do not ask for personal information. The platform has no chat. Guests see only kid-friendly games. Age question: when you start to make an account, we ask for your birth month and year. The question does not say what age is needed. If you say you are under 13, we do not make an account, and we set a small cookie that stops the sign-up from working in that browser for 24 hours (it records only that you were turned away, not the date you entered). We do not store what you typed. A passing age is saved for 30 minutes in a signed cookie so you can finish signing up. Ads and the first-visit age question: on your first visit we may ask a separate age question that is only used to choose which kind of ads to show. The answer stays on your device (it is not sent to your account, since guests do not have one). Under 13, skipped, or unknown means child-directed ads: no personalized advertising and no interest tracking. Parent or guardian: child profiles with parental consent may come later. Until then, a parent can contact us at help@bazoodle.com to ask about any data about their child, and we will delete it. If we learn that an account belongs to someone under 13, we will lock it and delete the account and its data (we may keep a basic record, such as a ban, to stop the same person from signing up again; see section 4). If you think this has happened, tell us at help@bazoodle.com. We do not knowingly collect personal information from children under 13. We do not sell or share it, and we do not show behavioral advertising to children.

4. Moderation and safety

Automated checks. Games that are shared (unlisted or public) are checked automatically before they appear: images are compared against lists of known child sexual abuse material (hash matching), and an AI classification checks images, audio, titles, descriptions and text for rule violations and for personal information. Private test builds are not checked. Reports. Reports are reviewed by AI first. People review only high-risk situations, such as account bans. Strikes and bans. Cheating and confirmed violations can earn strikes. A record of strikes and bans is kept. A ban record is kept even if you delete your account, so a banned person cannot simply sign up again. It contains no more than it needs to enforce the ban. Child safety. If our checks find child sexual abuse material, the account is banned, nobody at Bazoodle views the material, and we file a report with the National Center for Missing & Exploited Children (NCMEC) as US law requires, and keep the material securely for the legally required time. We may also share information with law enforcement when the law requires it, or when we believe a child or anyone else is in danger.

5. Ads

Ads pay for Bazoodle so that it can be free. We never show ads inside gameplay.

Who provides them: Google (AdSense and Google Ad Manager, including rewarded and video ads). As our traffic grows, we may add other ad partners, such as H5 Games Ads (Google), Clickio, Playgama Ad or AppLixir. We will update the list in section 7 when we do. If no paid ad is available, we may show an ad for Bazoodle Premium instead. What kind of ads you see: | Who you are | Ads | |---|---| | Under 13, skipped the age question, or age unknown | Child-directed, non-personalized, contextual ads | | 13 to 17 | Contextual (based on the page, not on you), non-personalized | | 18 and older | May be personalized, and where the law requires (for example, the EEA, UK and Switzerland), only after you accept in a consent banner | | Premium | No ads | Accounts use the age from the account. Guests use the answer to the first-visit age question, which stays on your device. Ad partners can use cookies and similar technologies to show and measure ads. For child-directed ads they do not use them to track you across sites. Google's advertising cookies. Third-party vendors, including Google, use cookies to serve ads based on a person's prior visits to Bazoodle or other websites. Google's use of advertising cookies enables it and its partners to serve ads to people who have chosen personalized ads, based on their visit to Bazoodle and other sites on the internet. We do not allow this for anyone under 18 or whose age we do not know. To learn how Google uses information from sites or apps that use its services, see How Google uses information from sites or apps that use our services. Opting out. Users may opt out of personalized advertising by visiting Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info. Rewarded ads. Players with accounts can watch an ad to unlock a cosmetic or an hour of double XP. We check that an ad was watched using a one-time token and the ad's completion signal. Rewarded ads never give coins. You can also opt out in the consent banner where it appears.

6. Cookies and local storage

We keep this short on purpose. These are the things the site stores in your browser:

Name or kind, What it is, How long, Type.

bz_session cookie, Keeps you signed in (stores a random token; the server keeps only a scrambled copy). Only set if you sign in, About 90 days on remembered devices, sliding, Needed for the service. bz_age_ok cookie, Signed pass saying you passed the age check (holds only your birth month and year), so you can finish signing up, 30 minutes, Needed for the service. bz_age_block cookie, Remembers you were turned away by the age check (holds only the value 1), 24 hours, Needed for the service. bzAdAge, The first-visit age answer (a group such as "kid", "teen", "adult" or "skipped", not your birthday). It only decides which type of ads to show and never leaves your device, Until you clear site data, Needed for the service / ads. bzTheme, bzMotion, bzLargeText, bzContrast, bzQuality, bzControls:<game>, Your look and accessibility choices (light or dark theme, reduced motion, large text, high contrast, play quality) and the keys you changed for a game, Until you clear site data, Preferences. bzRecent, Your recent searches, shown back to you in the search box, Until you clear site data, Preferences. bzTermsAgreed, bzAfterSignin, That you agreed to the Terms on this device, and the page to return to after you sign in, Until you clear site data (the second is removed as soon as you return), Needed for the service. bzAcademy, Your lesson progress in the Academy on this site, so it works without an account, Until you clear site data, Preferences. bzBase, A guest's character look (face shape, eye colour and skin colour), so it is still there next time. When you sign in it is copied to your account, only if your account has not picked a look yet, and then removed from this device, Until you sign in or clear site data, Preferences. bzGuestHostKey, A random key (not tied to your name) that lets a guest's browser keep its own place for the rewarded extras that need an ad, Until you clear site data, Needed for the service. bzGamesCached, A short list of which games are already downloaded on this device, so the download message is not repeated, Until you clear site data, Needed for the service. Cached game files (bz-builds-v1), Game downloads are saved in your browser so they load fast next time. In the editor, your own projects are saved in your browser's file storage, Until you clear site data or the game updates, Needed for the service. Push notifications (service worker), Only if you turn on browser notifications for game invites. Nothing else is cached by it, Until you turn them off, Optional, with your permission. Ad partner cookies, Used by Google and, later, others to show and measure ads. None are set while paid ads are switched off, Set by the partner, Advertising (see section 5). Consent choice, Remembers your answer to the consent banner, where it is shown (the EEA, UK and Switzerland). Not live until paid ads are switched on, Up to 12 months, Needed for the service.

Cookies and storage marked "Needed for the service" do not ask for consent because the site cannot work without them. Where the law requires consent for ads cookies, you will see a banner, and you can say no. You can also clear your browser's site data at any time, which signs you out and forgets guest settings.

7. Who we share data with

We use a small number of companies (service providers) to run Bazoodle. They may only use your data to provide their service to us, except where noted (Google ads partners are controllers of their own advertising data).

Company, What it does, What it may see.

Cloudflare, Hosting, database, file storage, networking and game relays, Everything the service handles: IP addresses, account records, game files, saves, report replays. Google (sign-in), "Sign in with Google", Your Google account signs you in; we get only an ID number (scope openid). Microsoft (sign-in), "Sign in with Microsoft", Your Microsoft account signs you in; we get only an ID number (scope openid). Resend, Sends sign-in link emails, Your email address and the message, while delivering it. Stripe, Premium payments, Your payment details and billing info. We get the status of your subscription only. Google (ads), Display, rewarded and video ads (AdSense, Ad Manager, and later H5 Games Ads and other partners), Your IP address, browser info, the page you are on, and the ad type your age answer allows. Ad cookies where permitted. AI moderation provider (named here once chosen), Checks games and usernames, Only content creators upload (images, audio, text), never account details.

We also share information: when the law requires it (for example, a valid court order, or a report about child sexual abuse material); to protect the safety of a person or the platform; if Bazoodle is sold or merged, with the new owner, who must honour this policy.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising for anyone under 18. (Under California law, "sell" and "share" have wide meanings that can include ad cookies. For adults who accept personalized ads, ad partners may collect data through their cookies. You can opt out; see section 9.)

8. How long we keep things

Data, How long.

Guest session data, Only while you play. Nothing else is saved for guests. Account (profile, saves, coins, ratings, friends, cosmetics, games), While your account is open. Deleted account, Hidden right away; permanently erased after a grace period of 30 days unless you sign back in to cancel. Ban records, Kept after deletion to stop repeat accounts, for up to 2 years. Sign-in links, Single-use, expire in minutes, then deleted. Sign-in handoff codes, passkey challenges, sign-in steps in progress, Minutes, then deleted. Sessions, Up to 90 days of inactivity on remembered devices; expired sessions are cleaned up daily. Magic-link email addresses, Not stored by us. Resend keeps delivery logs for a limited time under its own policy. Rate-limit counters (hashed IP), Minutes to an hour. Report records and replays, 90 days after the report is resolved. Flag and strike records (cheating), Strikes fade over time: guest strikes after 30 days; account strikes after 30 or 90 days, with a one-time clear after 365 days for the most serious. Child-abuse-material reports and the material, As required by US law, then deleted. Payment records, As long as tax and accounting law requires (up to 7 years), held by Stripe and by us in summary form. Backups, Rolled out within 35 days of deletion. Email you send to help@bazoodle.com, Up to 2 years.

9. Your rights and choices

Everyone can: Download your data: Settings > Your data > Download. Delete your account: Settings > Your data > Delete. Your games come down and your data is erased after the grace period in section 8. Sign in again before then to undo it. Fix your information: change your username (once per 30 days) and settings in Settings. For anything else, write to help@bazoodle.com. Turn off "For you" and manage who can add or invite you in Settings. Contact us at help@bazoodle.com. We aim to reply within 30 days (45 days where California allows).

We will check that a request really comes from you, by asking you to sign in to the account. We will not ask for ID. You can have an authorized agent make a request for you. A parent or guardian can ask about their child's data.

If you live in California (CCPA/CPRA) You have the right to know what we collect and why (this page), to get a copy, to delete, to correct, to opt out of sale or sharing, and to limit sensitive data use, and not to be treated worse for using these rights. We do not sell personal data. We do not knowingly sell or share the data of anyone under 16. The only possible "sharing" is ad cookies for people 18 and older who have chosen personalized ads; to opt out, choose "no" in the banner or use Google's ad settings. We do not collect sensitive personal information (such as government ID or precise location). You can also send an opt-out preference signal such as Global Privacy Control; we treat it as an opt-out of personalized ads.

If you live in the EEA, UK or Switzerland (GDPR / UK GDPR) Who is responsible: BAZOODLE LLC, help@bazoodle.com. Our reasons (legal bases): Contract: to run your account, save your progress and process Premium. Legitimate interests: security, rate limits, fraud and cheating prevention, moderation, counting plays and keeping the service running. You can object to these. Consent: personalized ads and the related cookies (you can withdraw it at any time), and any optional notification you turn on. Legal obligation: reports we must file and records we must keep. Your rights: access, correction, deletion, restriction, objection, portability (the download in Settings), and withdrawing consent. You can complain to your data protection authority (in the UK, the ICO). Age: in some EU countries the digital age of consent is higher than 13 (up to 16). If that applies to you and you are below it, a parent or guardian must agree. Contact us if you need to arrange this. Transfers: we use US-based companies. When your data moves outside the EEA, UK or Switzerland, we rely on the safeguards those companies offer, such as standard contractual clauses or the EU-US Data Privacy Framework.

Other places If your local law gives you other rights (for example in Virginia, Colorado or Canada), write to us and we will respect them as far as we can.

10. Security

Sessions and login codes are stored only as scrambled hashes, and sessions can be revoked from Settings. Sign-in uses standard secure methods: OAuth with PKCE, passkeys (WebAuthn), and one-time email links that need a confirming click. Traffic is encrypted (HTTPS). Games run in a sandbox, so a game cannot read your files or reach the internet. We keep personal data small on purpose, so there is less to lose. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

11. Links and other sites

Games cannot link to outside websites. Our pages may contain ads and our own links to other sites (like Stripe's payment page). Those sites have their own policies.

12. International use

Bazoodle is run from the United States. By using it, you understand that your data is processed in the US and other places where our providers operate.

13. Changes to this policy

If we make an important change, we will put a notice on the site and, for account holders, in the notification bell at least 30 days before it starts (sooner if the law or safety needs it). Old versions will be available on request. The date at the top shows the last update.

14. Contact

BAZOODLE LLC help@bazoodle.com