Privacy
Updated 2026-08-30. Slime & Stuff requires no account, dedicated real-name field, email, payment, upload, advertising tag, or first-party analytics script. The browser keeps the top five on-device Pop Rush scores plus bounded run identifiers and ordering metadata in local storage under a three-character game tag; Reset scores clears that browser copy. Visual pixels are generated locally. WebGPU, Web Audio, and optional short milestone vibration are used only through browser and device features.
Optional online board
The public online board is optional and uses a constrained letter–digit 2–9–letter game tag instead of a dedicated name field. The tag is user-supplied and pseudonymous, but it may still be personal data if a player encodes initials or other identifying text; the terms instruct players not to do that. Starting an online-eligible round creates a short-lived random run ticket containing a server seed, timestamps, and a bounded verification-attempt counter. If you choose “Verify & post online” after the round, the application sends that ticket, game tag, score, hit count, best streak, Mega Pop count, total round duration, and streak lengths to the same-origin Cloudflare Pages Function. It does not send pointer coordinates, per-hit timestamps, email, account ID, device ID, location, a separate free-text field, or a Sunnyday-stored IP field. D1 retains at most the best 100 score rows and 5,000 run tickets after accepted ticket maintenance; expired tickets are removed opportunistically. The public response exposes only the tag and game totals. Reset scores clears the browser copy but not an already posted online row; operator-side online deletion remains a documented open procedure.
Cloudflare verification and operations
Online posting loads Cloudflare Turnstile only after you request verification. The server sends Cloudflare the one-time Turnstile token, the widget secret, and a retry identifier; it deliberately omits the optional IP field. Cloudflare still processes ordinary network, browser, device, IP, error, and security metadata to deliver and protect Pages, Functions, D1, and Turnstile under its settings and terms. Application error events contain only a fixed leaderboard route label; platform-level security, delivery, and account logging may still apply.
Limits
If the online service or verification is unavailable, play and the on-device board continue. This notice describes the reviewed application design; the live Cloudflare configuration and headers are checked separately at release. Contact the site operator through the published security/contact route for a leaderboard concern.