Privacy Policy

CLI-Games honors Global Privacy Control and Do Not Track signals. Terminal users can run privacy analytics off at any time.

• Account data: email address, username, authentication records, and preferences you choose.
• Referral data: the issuing account, hashed code, expiration, and the account identifiers and times associated with reservation and redemption. New self-shared codes do not copy the recipient's email into the referral record. A limited set of legacy email-bound invitations may retain their original address for audit and redemption.
• Game and community data: saves, scores, achievements, messages, friendships, and other features you use.
• Payment data: subscription or donation status and processor identifiers. Payment processors handle card or wallet details.
• Usage analytics: page routes, feature and game identifiers, command names without arguments, outcomes, timings, coarse campaign tags, the bounded kind of ad-click parameter present (never its opaque value), a coarse device class derived from (never stored as) the User-Agent header, whether the event came from the iPhone app or the website, and referring domain.
• Ad click data: if you arrive from an ad we placed, the ad platform's opaque click identifier and the time you arrived.
• Entry surface: a coarse bucket for the kind of page (home, catalog, a specific game, terminal, or other) your session first landed on, recorded on the account at signup.
• Signup door: a separate coarse bucket for the kind of page where you chose to create an account. It is not used as a substitute for your session's first landing page.
• Link tag: a short code from the specific link you followed, if one was present (for example, a link posted in a discussion elsewhere), recorded on the account at signup — distinct from Referral data above, which is the Founder program specifically.
• Operational data: limited request, security, and error information needed to run, protect, and debug the Service.
• Forge contributions: if you are invited to contribute to the CLI-Games forge, we create a forge account under your username and keep its access token encrypted; you never receive a forge password. Commits you push carry your username and an address at noreply.forge.cli-games.com, never your email address, and we record the date you declared you are 13 or older and accepted the forge rules.
• Clide and support messages: what you ask Clide, the in-terminal assistant, together with the recent commands, current directory and last command output it reads for context; its replies; short summaries of past conversations; and email you send to our support address. Before any AI model writes a reply, a safety check reads the message. If it flags one, we keep the flagged text, the kind of content and the time as a moderation record, and repeated flags can lock an account out of Clide.

• Anonymous analytics sessions use a random identifier kept in memory for the current page session, not a cookie or browser storage.
• After a catalog card is opened, that tab temporarily keeps only the requested and launched game identifiers, random view and exposure identifiers, and open time in session storage. This makes a new tab or reload joinable to the same funnel for up to 30 minutes. The URL handoff is immediately removed, and opting out clears the record.
• Your session's first landing page is bucketed into the small set above and held in session storage the same way — never a cookie, never the raw path — so it can be included with an eventual signup on that same tab. Opting out clears it.
• When you explicitly create an account, we may include the same coarse bucket for the page where that request began. This is separate from first touch, never stores a raw path, and is collected only while optional analytics is enabled.
• If the landing URL carried a short link tag, it is held in session storage the same way — never a cookie — so it can be included with an eventual signup. Opting out clears it.
• Signed-in events use a one-way, keyed pseudonymous identifier rather than storing an account ID in the analytics table.
• For a paid landing, optional analytics may record only the bounded kind of ad-click parameter present (gclid, gbraid, wbraid, rdt_cid, or a UTM-only fallback). The opaque parameter value never enters product analytics.
• Analytics events do not store IP addresses or full user-agent strings.
• We do not collect terminal command arguments, message contents, save names, search text, form text, or full referring URLs as analytics.
• Our self-hosted Umami instance provides cookie-free site measurement. It stores event and session-level route, referrer-domain, coarse device, geography, and performance data; it excludes URL searches and fragments.

Pseudonymous data is not fully anonymous. We minimize it, restrict its use, and apply the retention limit below.

A signed-in account's keyed pseudonym can link its measured activity across visits. It is not an anonymous person count. CTF command analytics uses a fixed input label and can link submission timing to a scenario attempt; it does not store the command text, answers, or password-prompt responses.

• Operate accounts, games, saves, leaderboards, community features, and payments.
• Understand visitor intent, feature adoption, reliability, and where the product needs investment.
• Send authentication and security messages, rare notices about material service changes or durable benefits attached to your account, and marketing messages you explicitly request.
• Reserve a privately shared referral to the account that enters it and apply the benefit after that account confirms its email.
• Answer what you ask Clide or our support address, after a safety check for content our Terms prohibit.
• Prevent abuse, investigate failures, and secure the Service.
• Measure contextual in-terminal advertising without behavioral profiles.

Product analysis can describe observed progression through games. Any public aggregate findings require review to avoid identifying people or sessions; a report without names is not automatically anonymous. Optional analytics, saving a practice record, and sharing an achievement are not study consent. A separately recruited learning study would have its own notice and voluntary participation choice, without restricting ordinary play for declining.

Raw first-party product analytics and raw Umami events are automatically deleted after 90 days. Aggregate reports that no longer identify a person or session may be retained to compare long-term product health.

Commits pushed to the CLI-Games forge are public and permanent under their repository's open-source licence: deleting your account ends your forge access and unlinks the forge account, but does not erase published history or copies others made.

Clide conversations are deleted about a month after they were last active. Clide keeps up to 25 short summaries of past conversations until newer ones replace them or you delete your account. Safety-check records of flagged messages are kept for 30 days, or a year when they count toward a lockout. When a flag is reported to our moderator, the report keeps the flagged text until a year after it is closed. Support email is kept with its support ticket.

Account and game data is retained while needed to provide the Service. Security, payment, and transaction records may be kept longer for fraud prevention, disputes, tax, or legal obligations. Delete your account with deleteaccount.

Ads are text-based, stored in our database, and selected by game or page context—not a behavioral profile. They are not delivered by third-party ad networks. Anonymous visitors do not receive a durable browser or cross-session advertising identifier. With optional analytics enabled, a random token kept only for one browser tab may assign that tab to an advertising test; the server keeps only a one-way digest, coarse device class, and closed events such as opportunity, completion, dismissal, click, or departure for up to 90 days—not account identity, IP address, raw browser User-Agent, or input content. We do not share personal information with advertisers.

Browser storage supports features you request, including themes, shell settings, tutorial progress, local game state, offline support, and your analytics preference. The analytics preference is mirrored into a value-only SameSite cookie so server account routes honor the same choice. Optional analytics and anonymous ad frequency do not use cookies or durable identifiers to recognize a visitor. The advertising-test token uses tab-scoped session storage and disappears when the tab closes or optional analytics is disabled.

When you arrive from an ad we placed, the landing URL carries the ad platform's click identifier (such as gclid) or a paid-campaign tag (such as utm_source or a paid utm_medium). We keep the click identifier, a valid source tag, or only a coarse “paid source unknown” marker when no valid source was supplied, in one first-party cookie until you create an account, or for up to 90 days if you do not. If you then create an account, we record it on the account, clear the cookie, and for click identifiers report the identifier with the signup time back to the ad platform, so the platform can attribute the signup to its ad. Each exact Reddit click can create only one signup-conversion record, including after account deletion or a lost browser response. Reddit also receives a random unique conversion-event identifier so a retried report is counted only once; it is not derived from your account. This measures our own advertising: it identifies a click, not your browsing, we load no ad-platform scripts, and it is not used for profiling or shared beyond that report.

• Hetzner: application and database hosting.
• Cloudflare: delivery, DDoS protection, and aggregate web performance measurement.
• Umami: self-hosted, cookie-free aggregate analytics.
• Sentry: sampled error and performance monitoring; session replay is disabled.
• Resend: account, service-notice, and opt-in marketing email delivery.
• OpenRouter: relays Clide messages, support email and pseudonymous excerpts from invited playtester reports to the AI models below, and first runs the safety check (Meta's Llama Guard, hosted by a provider OpenRouter selects) on Clide messages and support email.
• Anthropic: its Claude models write Clide's replies and replies to support email, some of which are sent automatically, and cluster pseudonymous excerpts from invited playtester reports into advisory findings. Requests reach them through OpenRouter, which runs them at Anthropic or at a cloud provider it selects (Amazon Web Services, Google Cloud or Microsoft Azure).
• Google Gemini: answers Clide only when the primary model is unavailable.
• Stripe: payment processing when used.
• Pusher: real-time multiplayer and community updates.
• Google Ads: measurement of our own ad campaigns — receives only ad click identifiers and signup times; no emails, usernames, or activity.
• Reddit Ads: measurement of our own ad campaigns — receives only Reddit click identifiers, signup times, and random unique conversion-event identifiers; no emails, usernames, account IDs, or activity.

These providers process information only to supply their services. We do not authorize them to sell it for their own advertising.

Depending on where you live, you may have rights to access, correct, delete, or export personal data, and to object to or restrict certain processing. You can opt out of optional analytics above and manage optional marketing email with mailing. Authentication, security, and rare account-relevant notices do not depend on a marketing-list subscription. We keep those notices targeted and send them only when the information materially affects the account or the service it uses.

CLI-Games does not send referral invitations. A Founder receives a code and decides how to share it privately. Entering a code does not subscribe the resulting account to a mailing list.

We do not knowingly collect personal information from children under 13 without parental consent. Contact us if you believe a child has provided personal information.

We may update this policy as the Service changes. The date above shows the latest revision.

Privacy and data requests: [email protected]