# Glitchless privacy policy

> What Glitchless collects from players and developers, why, who else handles it and how long it's kept. Players are anonymous by default.

Website: https://www.glitchless.gg/privacy.html · Last updated 21 October 2026

Glitchless is game observability. An SDK in your game sends performance, error and gameplay events, and you read them in a dashboard or through your coding agent. This page says what we collect, why, who else handles it and how long we keep it.

It covers Glitchless Cloud (app.glitchless.gg and api.glitchless.gg) and this website. If you run the open-source Glitchless on your own server, your data stays there and we never see it.

Glitchless is an independent product. Write to support@glitchless.gg with any question.

## The short version

- Players are anonymous by default. The SDK sends no player ID, no names or email addresses, nothing a player types, and no cookies.
- When you sign in with Google or GitHub, we get your email address and name. We never get your password.
- Stripe takes your payments. We never see your card number.
- We don't sell your data or use it for ads.
- Your game's events are deleted after 14 days on Free, 90 days on Indie and 400 days on Studio.

## Who decides what

For your account, we decide what we collect and why. For the events your game sends, you decide: you pick the privacy mode and the events, and we store and show them for you. If you're a player, the game's developer is the first person to ask, and we'll help them answer you.

## Data from players

The web SDK (for Three.js and Phaser games), the Unity package and the Godot addon have two privacy modes, and the developer picks one.

**Anonymous mode** is the default. It sends:

- a random session ID, made fresh each time the game opens and kept in memory only;
- the kind of device: browser and its major version, operating system, phone or not, a GPU tier (low, mid or high), WebGL version, screen size and pixel ratio;
- performance: frame rate and frame times, hitches and their likely causes, load times, draw calls and memory use;
- errors, with query strings and fragments cut from any URLs in them;
- the page the game runs on, as origin and path only, and the referrer as an origin only;
- game events the developer adds, such as levels started and finished, deaths and their causes.

**Full mode** adds a random player ID, kept in the browser's localStorage as `glitchless.pid` so return visits link up. It also adds the full browser version, the GPU's renderer and vendor names, CPU core count, device memory, and positions in the game world (4 a second, and where deaths happen) for heatmaps and replays. Errors are sent as captured. The player ID is random and isn't tied to any account or advertising ID.

In a Unity or Godot game the device fields are the engine's own: operating system, a GPU tier, the renderer or graphics API, screen size and refresh rate in anonymous mode, and in full mode also the device model, OS version, GPU name, core count and memory. The full-mode player ID is saved in the game's data folder instead of localStorage.

In both modes the SDK never sends names, email addresses, account details, anything the player types, or cookies. Positions are places in the game's world, not where the player is. Our servers don't store the IP address a request comes from. Each SDK's PRIVACY.md lists every field: [web](https://github.com/glitchless-gg/glitchless/blob/main/packages/sdk/PRIVACY.md), [Unity](https://github.com/glitchless-gg/glitchless/blob/main/unity/Packages/gg.glitchless.sdk/PRIVACY.md) and [Godot](https://github.com/glitchless-gg/glitchless/blob/main/godot/addons/glitchless/PRIVACY.md).

Developers: the events and attributes you add are yours to choose. Use your game's own words, never anything that identifies a player, and say in your game's privacy policy that it uses Glitchless and in which mode. If your game is made for children, keep anonymous mode.

## Data about you

You sign in with Google or GitHub. Auth0 handles that sign-in and passes it to AWS Cognito, which signs you in to Glitchless. We receive your email address, your name and an account ID from Google or GitHub. We never get your password, and we don't ask for your repositories, contacts or files.

For your workspace we store your email address, name and sign-in provider, your workspaces, games and roles, and the invitations you send, including the invited person's email address. We keep your secret API keys only as hashes, so we can't read them back. Datadog and OpenTelemetry export settings are encrypted with AWS KMS.

Stripe handles billing. You enter your card on Stripe's page, and we never see or store the card number. Stripe tells us your plan, whether payments went through, and your invoices.

We send email through Amazon SES, and only about your account: invitations, usage and spike-protection alerts, and billing. If you email support, we get your email address and whatever you choose to include. We use it only to reply, and we'll delete it if you ask. Support mail arrives through Amazon Web Services and is passed on to our mailbox; the copy held by the mail system is deleted after 30 days.

## Cookies and browser storage

This website sets no cookies, runs no analytics and shows no ads. Its fonts come from Google Fonts, so your browser asks Google for them and Google sees your IP address.

The app at app.glitchless.gg sets two cookies, both needed to sign in. One keeps you signed in for 12 hours. The other lasts 10 minutes while you sign in and blocks forged sign-ins. Auth0, Cognito, Google and GitHub set their own cookies on their own sites while you sign in. The dashboard remembers your view settings, such as the time range and the game you picked, in your browser's localStorage.

In games, anonymous mode stores nothing about the player, and full mode stores the random player ID. The developer overlay, off by default in production, remembers whether it was open.

## What we use it for

- Running Glitchless: signing you in, storing your game's events, showing them in the dashboard, answering your coding agent and sending the exports you set up.
- Counting play sessions and billing you.
- Emailing you about your account.
- Keeping the service secure and stopping abuse, for example with rate limits on each key.
- Finding and fixing bugs in Glitchless.

We don't sell or rent your data, use it for ads, or train AI models on your game's data.

## Who else handles it

These companies run parts of Glitchless for us:

| Company | What for |
| --- | --- |
| Amazon Web Services | Hosting, databases, sign-in (Cognito), email (SES), encryption keys (KMS) and the network that serves this site |
| Auth0 (Okta) | Sign-in with Google and GitHub |
| Google or GitHub | The account you sign in with |
| Stripe | Payments, invoices and tax |
| Google Fonts | This website's fonts |

Some data goes where you send it. If you set up an export, we send your game's events to the Datadog account or OpenTelemetry backend you chose. If you connect a coding agent with a secret key, the agent reads your game's data, and the AI provider behind it gets what the agent reads, under that provider's terms. The SDK's optional Datadog bridge loads Datadog's own SDK in your game, which collects data under Datadog's terms. Teammates you invite can see the workspace's games.

We also share data when the law requires it. If Glitchless is sold or merged, your data moves with it and this policy still applies.

## Where it's stored

In AWS's us-east-1 region, in Virginia in the United States. If you're outside the US, your data is transferred there.

## How long we keep it

- Game events: 14 days on Free, 90 days on Indie, 400 days on Studio. If you move to a plan with a shorter period, events older than that period are deleted.
- Your account: while it's open. Ask us to delete it and we'll delete the account and its games' data within 30 days. Copies in database backups are gone 35 days after that.
- Sign-in sessions: 12 hours. Invitation links: 7 days.
- Support mail: the mail system's copy, 30 days.
- Billing records: as long as tax law requires.

## Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Email support@glitchless.gg and we'll answer within 30 days. Depending on where you live, laws such as the GDPR in the EU and UK and the CCPA in California give you these rights, and you can complain to your data protection authority.

Players: anonymous mode has no player ID, so we can't tell which sessions are yours. Ask the game's developer, who decides what's collected, and we'll help them answer.

## Security

Everything travels over HTTPS. Secret keys are stored only as hashes, export credentials are encrypted with AWS KMS, sign-in cookies are HttpOnly and Secure, and each workspace can read only its own games. If a breach affects your data, we'll tell you promptly.

## Children

Glitchless accounts are for developers aged 16 and over, and we don't knowingly collect personal data from children. If your game is for children, keep the SDK in anonymous mode.

## Changes

We'll post changes here and update the date at the top. If a change affects how we use your data, we'll email you before it takes effect.

## Contact

support@glitchless.gg

Terms of service: https://www.glitchless.gg/terms.md