Privacy Policy

This policy covers back2oldgames.com, the Back2OldGames mobile API, and their account, game, community and email-update features. The operator is:

Back To The Old Games NFP
1155 Kelly Johnson Blvd
Colorado Springs, Colorado, United States

Privacy questions and requests: use our contact form. You may also write to the postal address above. This policy is written for a U.S. audience; mandatory protections in other applicable jurisdictions still apply.

Information and purposes

We collect account identifiers and activity directly from you and your use of the service: a username, passkey public credentials or a limited social-sign-in identifier, account dates, preferences, saved games, play history and submitted scores. Optional profile details, avatars, comments and likes are used to provide the features you select. Optional email contact details and consent records support our own news and game updates. Contact and copyright-request details let us respond, manage reports and meet legal obligations.

Internet activity and technical data, including network addresses, browser information, requested pages, time and security counters, support delivery, abuse prevention and troubleshooting. Optional analytics helps improve the site; hosting sponsorships support its operation. We do not request sensitive identity documents, precise location, a date of birth, payment details or biometric templates for signup. Device biometrics used for a passkey are handled by your device, not sent to us. Do not put sensitive information in public profiles or comments.

We use these categories only for the described service, security, communication and legal purposes. We do not use the email field to recover or authenticate an account, and subscribing does not authorize unrelated third-party marketing. The detailed sections below describe storage and retention for each feature.

Privacy

Our full Privacy Policy explains these practices and your choices. We do not sell personal information or rent our mailing list.

Advertising

We display hosting sponsorships served directly by this site. These do not load third-party advertising code.

You can change your analytics cookie choice in Cookie settings. Your choice is stored in this browser until you change it or clear site data.

Analytics

We use Google Analytics to understand how the site is used and to improve it. Analytics cookies are set only if you accept them, and you can change your choice at any time in Cookie settings. Until you accept, and if you decline, Google Analytics receives only cookieless measurements that store nothing on your device. We also use Cloudflare Web Analytics, which counts visits without cookies.

Delivery and server logs

The site is delivered through Cloudflare. Like most websites, our web server keeps standard access logs (IP address, page requested, browser and time) to keep the service secure and working. They are deleted after 30 days.

Analytics events record actions such as playing, rating, searching or submitting a score, never your account name.

In this browser

The games you played recently, My list, your Daily Pixel progress, your ratings, your settings and your save states in ClaBa Player are kept in this browser, on this device. Finished daily challenges are also recorded on the server to calculate scores and shared results; signed-in results follow your account. You can clear My list and your recent games from the home page, or everything by clearing this site's data in your browser. When you sign in, the games already in My list and your recent games are added to your account; when you sign out, they are removed from this browser and stay in your account.

Accounts

Accounts are optional. You can sign in with a passkey or, where offered, with Google, X, Facebook or GitHub. If you create an account, we store:

• your account name, when you created the account and when you last used it;
• for each passkey, its public part, a device label such as “Chrome on Windows”, and when it was added and last used — never a password or biometric data;
• a one-way hash of your recovery code, if you have one;
• for each service you sign in with, a one-way identifier derived from your account with that service, and when you linked it;
• My list, Favorites, the games you played with dates and play counts, and your high scores;
• only if you choose email updates: the address you enter, the time and source of your consent, the consent wording, the Terms and Privacy Policy versions you accepted, and any withdrawal.

No email address is required to create or use an account. You may optionally provide one for Back2OldGames news, new games and site updates after affirming you are at least 13, accepting the Terms of Use, acknowledging the Privacy Policy and separately opting in to updates. These choices are unchecked by default. Email is private, never a sign-in method, never displayed on your player card, and never shared with advertisers. You can change it or unsubscribe in Settings. Every marketing email must include a working unsubscribe link and our postal address. Email opt-in is separate from your analytics cookie choice. Existing accounts are not subscribed automatically. Your address is not verified as part of passkey registration; use an address you own.

If you sign in with another service, we never see your password for it, we do not import or store the email address, name, profile photo or posts from that service, and we never post on your behalf. You can unlink a service at any time in Settings, as long as another way to sign in remains.

Two cookies keep you signed in: a secure session cookie, and one that holds your account name so pages can show it. Both expire 90 days after your last visit, and signing out removes them. During a sign-in with another service, two short-lived cookies are used: one protects the sign-in (up to 15 minutes) and one tells our statistics whether it succeeded (5 minutes). To prevent abuse, sign-ins, sign-ups, account changes and Score Attack runs are counted against a keyed hash of your network address or account, and these counts are deleted after two days.

In Settings you can download your data or delete your account. Deletion is immediate. Copies in our backups are deleted on their regular schedule, within five weeks.

Email updates and withdrawal

We use the optional email only for the updates you request. It remains stored while subscribed. Unsubscribing stops inclusion in future recipient lists immediately and removes the readable address from the live account database. We retain the consent versions, wording and dates and a withdrawal date with your account to document your choice; deleting the account also deletes that record. Account Settings can remove an address without deleting your account. Unsubscribe links do not require an account login. Links open a confirmation page to prevent email scanners from unsubscribing you by accident. Our own messages do not add email-open tracking pixels. We do not treat a privacy-policy update as permission to subscribe you.

For requested email updates, we retain the message, campaign date and delivery-attempt status for up to 12 months. The delivery ledger uses a private identifier rather than a second readable copy of your address. Your account-data download includes your campaign records; deleting your account removes the player references from delivery records while retaining anonymous campaign totals. A transport acceptance does not prove that a message reached your inbox.

Deleting your data

You can delete your Back2OldGames account and all of its data at any time: sign in, open Settings and choose Delete my account. Deletion takes effect immediately and removes your account name, your passkeys, the services linked to your account (such as Facebook, Google, X or GitHub), your lists, your play history, your high scores and your optional email subscription and consent record. If you can no longer sign in, write to us through the contact form. You can also remove Back2OldGames from the apps connected to your Facebook account in your Facebook settings.

High scores

High scores need an account. When you start a Score Attack, the site issues a random run code for that game. While you play, ClaBa Player reads the score from the game in your browser; nothing about your run is sent until you choose to submit it. Each submitted run is stored with your account, the game, the date, the score, its length (play time and frame count) and how the score rose during the run, so that records can be checked. A run whose score rises faster than the game allows is held for review and appears on the board only once confirmed. Your best score for each game is public, with your account name and the date, on the game's page and on the High scores page. Run codes that are never submitted are not linked to you and are deleted after two days. Your scores and runs are included when you download your data, and deleting your account deletes them.

Ratings and plays

Ratings and play counts use no cookies. When you rate a game, a random identifier kept in this browser lets you change your rating later. A play is counted after a minute of play, once per game and day for each network. To prevent abuse we keep keyed hashes of your network address, never the address itself: for two days for rate limits, and with each rating so that a shared connection counts as one voice in the charts. Daily play records are added up into totals after 31 days.

Messages

Messages sent through the contact, request and DMCA forms are kept so they can be answered, for up to 12 months. Our replies and private follow-up notes are also kept for up to 12 months. Email replies are delivered through Google’s email service. With each message we store what you entered, the identification string your browser sends (browser, version and operating system), and a keyed hash of your network address to stop spam.

Comments

Memories are public and show your account name and chosen avatar. We store your memory text, replies, likes and posting date with your account. You can delete your own memories, and deleting your account removes them and their replies. Avatars are presets or an image you upload; uploaded images are resized and stripped of metadata before storage. Your profile, memories and likes are included in your data export. Your account name and avatar are public wherever you post; do not upload an image you want to keep private. Public player cards are optional and off by default. If you enable yours, it shows your account name, avatar, bio, favorite system, join date, public memory count and likes received. A separate setting lets you display up to six Favorites. Your My list, play history, passkeys and linked sign-in services stay private. Making your player card private hides it immediately; memories you have posted remain public until you delete them. We may remove comments that are abusive, off-topic, spam or that infringe someone else’s rights.

Your rights

You can access, correct, download or delete your data, mostly directly in Settings, or ask through the contact form. You can change your analytics cookie choice in Cookie settings. Your email-update choice is managed separately. Applicable privacy laws may provide further rights; see the U.S. privacy-rights section. Providers may process data in the United States and other countries. This policy does not remove mandatory protections under the laws that apply to you.

For any privacy question, use the contact form.

Daily challenges and offline copies

Daily Pixel and Time Warp results are checked and recorded on our server. A random device identifier is hashed to prevent duplicate daily results; signed-in results also follow your account. We store scores, guess counts and result tiles, and use completed results for optional passport quests. Guest guess text is cleared after two days, and guest device hashes are detached from results after thirty days; non-identifying result totals remain for comparison. Account results stay until account deletion. Public result links are signed and show the score and tile pattern without the puzzle answer. A result can be shared only through an action you choose.

Offline copies are available only for games and firmware with recorded permission and an audited local player. Download links expire after fifteen minutes and are bound to your account, app integration and session. We retain a per-session list of reported offline copies until removal, session expiry or account deletion; daily download counters are cleared after two days. A withdrawal is reported at the next inventory sync so the app can delete the local copy. Export includes account results and offline inventory. These functions are separate from optional email and analytics consent.

Your optional retro passport

If you choose to start a passport, we store qualified play dates, games and systems explored, XP awards and badges with your account. A play counts after a visible minute and a server-timed play proof; these rewards recognise exploration, not game completion or verified high scores. Play proofs expire after thirty minutes and are removed within two days. Passport progress is private. Only a separately confirmed share card publishes your player name, level, XP, earned badge names and chosen quest. A shared-card invitation can record that another participating account accepted it after playing; clicking a link alone earns no reward. Community discovery totals contain no player names.

Progress and award records stay until you delete the passport or account. You can revoke all shared cards from the passport page; their links then stop working. Account export includes passport records. Playing remains available without joining or sharing, and email and analytics choices remain separate.

Mobile app connections

When you connect a mobile app, we store its name, the device label you provide, a player identifier, connection dates and hashed session tokens. Approval requests expire after ten minutes; one-use transfers to the game player expire after one minute. Expired requests and transfers are removed daily. Mobile sessions follow the account’s 90-day sliding expiry and can be closed from the app; signing out of all sessions closes both website and mobile access. Expired session records are removed daily. Per-network API security counters use keyed hashes, are kept for up to 24 hours and do not store raw network addresses. Deleting an account removes its mobile connection records. Downloading account data includes connected-device labels and dates.

Saved games and emulator states stored locally in a WebView remain on that device, like browser-local saves. The API does not upload or synchronize those save files. Mobile app access uses the same optional email consent, profile visibility and comment rules as the website.

App distribution counters (added October 27, 2026)

The Android download buttons pass through our own download route. We count qualifying download starts, not completed transfers, unique people or installations. We keep aggregate counts by day, app version and button used. We also count clicks on the homepage and game-page app banners, and download starts attributed to those banners. A signed link carries the banner origin for up to 30 minutes and is checked against the requesting browser/network and app version. It uses no cookies or browser storage and is not tied to a player account. Without a valid referral, a download is counted without a banner origin. These figures are aggregate requests, not unique visitors or verified installations. Known automated and prefetch requests are filtered where possible. To reduce repeated counts and abuse, we temporarily store keyed network/browser hashes rather than raw network addresses or browser strings in this statistics database. These hashes rotate by reporting day and are removed on expiry or daily maintenance within two days. This counter sets no cookies and sends no information to an advertising or third-party analytics service. Ordinary delivery/security logs remain subject to the practices described above.

When implemented in an app build, a first-open report contains a random installation UUID, the Android platform and app version. Our server stores only a keyed digest of that UUID, the first reported version and receipt time for up to 400 days to prevent duplicate reports; it does not link the report to your player account, email, advertising identifier or hardware identifier. The installation UUID and acknowledgement stay in app-local storage excluded from backup; updates retain them, while reinstalling or clearing app data may create a new installation. Daily aggregate counts are kept without these identifiers for long-term distribution statistics. These figures describe first opens reported by the app, including any existing installations first observed after integration, and are not proof of a completed installation or a link to a particular download.

Native Apple and Google sign-in

When offered in the mobile app, Apple or Google supplies an ID token that we verify before issuing a player session. We retain the same one-way service identifier used for linked accounts. A verified email is used only to detect an existing-account collision; we never automatically link accounts by email or import that address for marketing. Registration grants are valid for ten minutes; expired grants and their associated keyed email hashes are removed by daily maintenance within a day. Replay-prevention hashes expire with the provider token and are removed daily. Security events record the provider, hashed service identifier, integration identifier, network hash and time for up to thirty-one days, with daily cleanup.

Apple connections additionally retain an encrypted refresh credential so we can revoke Apple access when you unlink the service or delete the account. That credential is never returned to the app or an account-data export. If Apple cannot confirm revocation, deletion is postponed and the account is kept so you can retry. Native registration requires acceptance of the Terms and acknowledgement of this policy; optional emails require a separate choice. Google ID tokens and raw provider credentials are not retained in security logs.

Who receives information

Authorized personnel and service providers receive only the information needed for their roles. Hosting and Cloudflare deliver and secure the site. Google handles optional analytics and delivery of email replies. Google Analytics can receive cookieless measurements even when analytics cookies are declined, as explained above. Sign-in providers handle your authentication with them when offered. Their independent processing is covered by their own policies: Cloudflare, Google.

If an email-delivery provider is used for requested updates, it receives the destination address and message for delivery on our behalf, not permission to sell the list or market its own services. We may disclose information when reasonably necessary to comply with law, protect rights and safety or investigate abuse. Public posts and enabled player cards are visible to other visitors. We do not represent that a third-party website follows this policy. Following an external link is your choice.

U.S. privacy rights and browser signals

Depending on your state of residence and whether its law applies to the operator, you may have rights to know and access personal information, obtain a portable copy, correct inaccuracies, delete information, and opt out of sale, certain sharing, targeted advertising or qualifying profiling. We do not sell account records or email lists, and we do not use personal information for decisions producing legal or similarly significant effects. We do not offer payment or a discount in exchange for personal information. Declining optional email or analytics cookies does not reduce your account features.

Use account Settings or the contact form to make a request, including through an authorized agent. We may ask for information reasonably needed to verify the request and authority, proportionate to the information involved; we do not require a marketing subscription. We respond within the time required by applicable law and explain any lawful refusal or extension. If an applicable state law grants an appeal, submit it through the same form with “Privacy appeal”; we will explain the outcome and any further complaint options. We will not retaliate for exercising applicable rights.

A general Do Not Track signal does not automatically alter your analytics cookie choice. You can change that choice through Cookie settings. Other services linked from this site may collect activity over time and across websites under their own policies. Email consent is independent of all browser signals and cookie settings.

Children and teenagers

The account, community and email-update features are intended for people aged 13 or older. Do not register or submit an email if you are under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us through the form or postal address so we can investigate and remove it as required. The optional email form asks only for confirmation that you are at least 13, not a birth date. Teenagers who have not reached the age of legal majority should use account features with a parent or guardian’s permission.

Security and retention limits

We use HTTPS, access restrictions and other safeguards appropriate to the service. No online service or transmission is completely secure. Do not share recovery codes or passkeys. Account deletion removes live account data; isolated backups expire on their normal schedule, within five weeks. Information may be retained longer where required by law or a specific legal hold; it is restricted to that purpose. If backups are restored, deletion and unsubscribe requests must be reapplied before marketing use.

Changes to this policy

We post updates here with a new effective date. Material changes are brought to users’ attention through an appropriate notice, and we request new permission where required. A policy change does not resubscribe an address or broaden an earlier email opt-in. The version and consent wording shown when you subscribe are recorded with your account. You can review the Terms of Use and contact us at any time.