Privacy Policy

The short version

• You can use every game, the arcade and the tools without an account.
• An account (13+ only) keeps your email, a display name and your saved progress. That's it.
• No passwords: you sign in with a passkey or a one-time code we email you.
• We only email you sign-in codes and important account notices, plus news if you choose to join our mailing list.
• You can download or delete your account and its data yourself, any time, on the account page.

DeedzLabs accounts

An account is optional. When you make one we keep:

• Your email address, to send sign-in codes and important notices about your account (for example, that it was deleted).
• A display name you choose. It may be shown on the site, such as on leaderboards. It doesn't need to be your real name.
• That you confirmed you're 13 or older. We ask for your birth month and year once, on your device, and don't keep them.
• Passkeys you add: only the public half, which can't be used to sign in by itself. Your face, fingerprint or screen lock never leave your device and we never see them.
• Where you're signed in: a rough device label (like "iPhone · Safari"), how you signed in and when it was last used, so you can review and end sessions.
• Saved progress from apps that sync, today the Goose Arcade (points, stickers, best scores, items) and the Secret Box (codes you've found).

One cookie keeps you signed in. It's only for that: it's sent only to deedz.org over HTTPS, scripts can't read it, and it ends 30 days after your last visit (or when you sign out).

Children

Lots of our visitors are kids, and we built the site so they can play without giving us any personal information. Accounts are only for people 13 and older. If someone tells us they're younger, we don't create an account and don't keep what they typed. Kids' progress in the arcade and games saves only on their own device.

Some features ask for contact details for a specific purpose, like entering the Costume Contest (an adult or a parent or guardian enters) or adding your name and email to feedback (13+). Each one says so where you use it.

We don't knowingly collect personal information from children under 13. If you're a parent or guardian and think your child gave us information, contact us and we'll delete it.

What each part of the site uses

Contact form

Your name, email and message, emailed to our team so we can reply. If you tick the mailing list box, we also add your name and email to our mailing list.

Mailing list

Only if you ask to join. Every email has an unsubscribe link, or ask us to remove you.

HONK counter, Legends Board, game stats

We count honks and plays without knowing who made them. If you sign the Legends Board, the name you type is shown publicly.

Costume Analyzer and Costume Contest

Photos you analyze are checked and then thrown away; they're never saved. Contest entries (photo, name, email and optional details) are covered by the contest rules, which say how long they're kept.

Speedometer

Uses your location on your device to show speed. To show the weather, it sends your approximate position to Open-Meteo, a free weather service. We don't store it.

FlightWatch

Uses your location on your device to show planes near you. If you save a spot for alerts, we keep that spot and your browser's notification address so we can send them; delete the spot to remove both.

Multi Chat (Twitch)

Connects your browser directly to Twitch. If you sign in with Twitch, that sign-in stays in your browser and is handled by Twitch's own privacy policy.

Like every website, our servers see your IP address when you visit. We use it briefly to stop spam and abuse (for example, limiting how many codes can be requested), and don't use it to track you.

Saved on your device

Many features save things in your browser's own storage, such as arcade progress, your light/dark theme choice and Secret Box finds. That stays on your device unless you sign in to an account that syncs it. Clearing your browser's site data removes it.

Who else handles data

We never sell or rent personal information, and we don't share it for advertising. A few services help us run the site and only handle data to do that job for us:

• Fly.io hosts deedz.org and stores account data (in the United States).
• Resend sends our emails (sign-in codes, contact messages, the mailing list).
• Cloudflare securely connects some of our apps (like the game and FlightWatch) to the internet.
• Open-Meteo, OpenStreetMap, Esri and Twitch provide weather, map pictures and chat to the pages that use them.

We'd only share information beyond this if the law requires it, or to protect people's safety.

How long we keep it

• Accounts: until you delete yours. Deleting it removes your email, name, passkeys, sessions and saved progress right away. Our hosting provider's encrypted backups roll over within a few days.
• Sign-in codes: 10 minutes. Sign-in sessions: 30 days after last use.
• Contact messages: as long as needed to answer you.
• Mailing list: until you unsubscribe or ask us to remove you.
• Costume Contest: see the contest rules (deleted by December 31, 2026).

Your choices and rights

Wherever you live, you can:

• See and download your account data: "Download my data" on the account page.
• Correct your display name there too, any time.
• Delete your account and its data yourself on the account page, or ask us to.
• Ask us what we hold about you, or to delete anything else (like a contact message or a contest entry), through the contact form. We'll answer within 30 days and won't treat you differently for asking.

These cover the rights in privacy laws such as those in California and other US states and the EU/UK GDPR. We don't sell or "share" personal information for advertising, so there's nothing to opt out of. Where the GDPR applies, we use your information to provide what you asked for (your account, a reply), with your consent (the mailing list), or for our legitimate interest in keeping the site safe. You may also complain to your local data protection authority.

Security

The whole site uses HTTPS. There are no passwords to steal: passkeys are phishing-resistant, sign-in codes work once for 10 minutes, and we store codes and sign-in tokens only in scrambled (hashed) form. Sign-in attempts are rate-limited. No system is perfect; if something ever goes wrong with your data, we'll tell you and fix it.

Changes

If we change this policy we'll update the date at the top, and for big changes we'll let account holders know by email before they take effect.