Privacy policy

How gBandit handles your data

gBandit hosts web games and the tools to build them. This page explains what we store about you, why, who else sees it, and how to make us delete it. Last updated 6 October 2026.

Who is responsible

gBandit is operated from Sweden and is the data controller for the data described here. Questions and requests go to hector@gbandit.com.

This policy covers gbandit.com, platform.gbandit.com, auth.gbandit.com, games.gbandit.com, docs.gbandit.com and the sign-in shared by games hosted on gbandit subdomains. The people who build those games decide what their own game does with your data; see Games built on gBandit.

What we collect

Account

You sign in with Google. Playing a game or deploying from the CLI without signing in creates a guest account instead. With Google we receive your Google account id, your email address and your name, through our sign-in provider WorkOS. We never see your Google password, and we ask for nothing beyond that basic profile. As a guest we store only an auto-generated username and, until you upgrade the guest to a Google account or it is deleted, the network address the guest was created from. Every account carries a public username that you can change at any time.

Sessions

Signing in sets one session cookie on auth.gbandit.com. For each session we store its token, the network address and browser user agent that created it, and timestamps. Sessions expire 30 days after you sign in, or when you log out. Guest sessions renew while they are in use.

Playing games

When you play a game hosted here, signed in or as a guest, the game page sends empty heartbeats that we credit as play minutes per game. This drives the weekly player counts in the games catalog and lets games run cross-project leaderboards. To keep the counts honest, a guest counts toward a game's players only if few guests created from the same network address are playing it. Game pages may also report frontend errors to us, together with the page URL, browser user agent and the id and username of the player who hit them.

Building games

If you build on gBandit we store what you upload or deploy: source code, build artefacts, environment variables, the databases and files your game creates, build and runtime logs, and backups of all of it. Logs are kept for 7 days. Backups follow a schedule that keeps roughly the last five weeks.

AI assistant

The in-browser assistant sends your chat messages and the files in your project to a language model through OpenRouter, which forwards them to the model provider you pick. We record which model was used, token counts and cost for every request, and the conversation history stays in your project workspace so you can continue it. gBandit itself trains no models. What OpenRouter and the model provider keep or do with what they receive is governed by their own terms and privacy policies.

Technical logs

Our servers keep operational logs with request metadata such as network addresses, paths and status codes for a limited time so we can find and fix faults and abuse.

Why we use it

Google user data

The email address, name and account id we receive from Google are used only to create and identify your gBandit account and to contact you about it. We do not sell Google user data, do not use it for advertising, and do not share it with anyone except the processors listed below. If we ever want to use it for something else we will ask first. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Cookies

We use two cookies, both strictly necessary. The session cookie on auth.gbandit.com holds your session token. A short-lived cookie on the same host carries the sign-in state while a Google sign-in is in progress. There are no analytics, advertising or third-party cookies, and gBandit does not use tracking scripts.

Who else sees your data

We use the following companies to run the service. They process data on our behalf and are not allowed to use it for their own purposes.

We disclose data beyond this only when the law requires it. We do not sell personal data. We look at a project's code, data, logs and traffic only when we need to keep gBandit secure, investigate a report of abuse or comply with the law.

Games built on gBandit

A game you play here receives a token with your stable player id and your current username, never your email address. What the game does with that, and with anything you type into it, is decided by whoever built the game. Ask them, not us, about their game's data handling. If a game hosted here is misusing data, tell us and we will act on it.

How long we keep it

Your rights

Under the GDPR you can ask what we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive a copy in a portable format. You can delete your projects yourself from the platform. To delete your account or exercise any other right, email hector@gbandit.com from the address on the account. You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten.

Children

gBandit is not directed at children under 13, and we do not knowingly create Google-linked accounts for them. If you believe a child has done so, contact us and we will delete the account.

Security

All traffic is encrypted in transit. Every project runs in its own isolated namespace with its own database, and a game can only obtain tokens for its own project. We never store passwords.

Changes

When this policy changes we update it here and change the date at the top. Material changes to how we use your data are announced before they take effect.