Privacy Policy

In short

We count how many people play each game. We do it with our own software on our own servers. We set no cookies, we do not store your IP address, we do not follow you between sites, and we do not sell or share anything with advertisers.

The rest of this page says the same thing at length, and tells you how to opt out.

Who this covers

Merchants of Play Inc. ("we", "us", "our"), publishing as Big Head Club, operates bhc-arcade.fly.dev, bhc-rack.fly.dev, bhc-hundred-days.fly.dev and the games listed on those pages.

It applies wherever you are. We aim to meet the Personal Information Protection and Electronic Documents Act in Canada, the General Data Protection Regulation in the European Union and the United Kingdom, and the California Consumer Privacy Act.

What we collect automatically

Every page of ours loads one small script that reports to our own analytics service. For each visit it records: which game, which page, the hostname that linked you to us, any campaign tag in the link, your screen size, whether you are using a touch screen or a mouse, and your browser’s language.

It also records what you do: clicks on buttons and links, named by the words on them; how long the page was open and visible; any JavaScript error the page throws; and events the game itself reports, such as starting a run, winning, losing, or sharing.

To tell one visitor from another we take your IP address and browser user-agent string, mix them with the game’s name and a secret that changes every day, and keep only the resulting short hash. The IP address and user-agent are never written down. The hash cannot be turned back into them, and tomorrow the same person produces a different hash, so we cannot follow you from one day to the next or from one game to another.

We drop traffic that identifies itself as a bot or crawler, and the script does not run in an automated browser.

What we do not collect

We set no cookies of our own.

We do not store IP addresses.

We do not build profiles, and we have no advertising, no ad network, no tracking pixels, and no third-party analytics.

We do not know your name unless a game asked you for one and you typed it.

What your browser keeps

Some of our pages store small values in your own browser. They stay on your device, we never receive them, and clearing your site data removes them.

"tally_ignore" remembers that you asked us not to count your visits. "tally_ab" remembers which version of a page you were shown, so you keep seeing the same one.

On the cartridge rack, "carts.stream" remembers which games you kept and "carts.view" remembers whether you were looking at all carts or only yours. The tray inside a game stores "carts.sub." values for the same reason.

Individual games may save your progress in your browser in the same way. Each game’s own page is the place that tells you what it saves.

What you give us

A few games ask you to type something: a display name, a room code, a message to another player, and in one or two cases an email address. We store what you type for as long as that game needs it to work.

Games that run inside Telegram receive the account identifiers Telegram passes to them, and we store those to keep your progress attached to you. Telegram’s own privacy policy governs what Telegram does.

Why we use it

To see which games people play, so we know which ones to keep working on.

To find and fix faults, which is what the error reports are for.

To run the game in front of you, including saving progress and connecting you to other players.

To keep the Services working and to stop abuse.

Where the law requires a legal basis, ours is our legitimate interest in understanding and improving games we give away, and, for anything you type into a game, performing the service you asked for.

Who else sees it

Nobody buys it, and we do not share it with advertisers or data brokers.

Our analytics data sits on our own servers. The companies that host those servers can necessarily store it for us: Fly.io and Railway, in the United States. Some games keep saved data in a hosted Postgres database (Neon).

The hundred-days calendar loads a web font from Google Fonts, so Google receives your IP address when that page loads. The arcade and the calendar load an embedded YouTube player only after you press play, at which point YouTube may set its own cookies. Both are governed by Google’s privacy policy, not ours.

We may disclose information if the law requires it, or to protect our rights or someone’s safety.

Cookies

We set none. There is nothing to consent to and no banner to dismiss.

A third party can still set one: press play on an embedded YouTube video and YouTube will. Your browser settings control that.

How long we keep it

Analytics events are kept indefinitely at present, because they are counts attached to a hash that stops being meaningful after a day. We will say so here if that changes.

Data a game saves for you lasts as long as that game runs. These are experiments; many will be retired, and their data goes with them.

Opting out

Open any of our pages with ?tally=ignore on the end of the address and we will stop counting that browser. It is remembered on your device. Use ?tally=track to turn counting back on.

A browser set to "do not track" or an ad blocker will usually stop the script loading at all, and we do not work around either.

Your rights

Depending on where you live you may ask us for a copy of what we hold about you, ask us to correct or delete it, object to or restrict how we use it, withdraw consent, or ask for it in a portable form.

We will be straight with you about a limit here: because the visitor hash cannot be reversed, we usually cannot find "your" analytics rows from an email address. Where a game holds something identifiable, such as a Telegram account or an email address, we can find it and act on it.

Write to officialstuff@merchantsofplay.com. We answer within thirty days. If you are not satisfied, you may complain to your data protection authority, or in Canada to the Office of the Privacy Commissioner.

Children

The Services are not directed at children under 13, or under 16 where local law sets that age, and we do not knowingly collect their personal information.

If you believe a child has given us personal information, write to officialstuff@merchantsofplay.com and we will delete it.

Security

Our sites are served over HTTPS, analytics data is stored on servers we control, and access to it is limited to the people who run the fleet.

No system is perfectly secure, and we cannot guarantee that these ones are.

Where the data goes

Our servers are in the United States and the company is in Canada, so your information is processed outside your country if you live elsewhere. Where the law requires a transfer mechanism, we rely on the European Commission’s standard contractual clauses.

Changes

We will post any change here and update the date at the top. Keep an eye on it, or write to us and ask.

Contact

Merchants of Play Inc.. Write to officialstuff@merchantsofplay.com.