Legal
Privacy policy
Last updated 15 October 2026
1. Who we are
wasmga.me ("wasmga.me", "we", "us") is a website for playing games built on WebAssembly, available at https://wasmga.me. You can reach us about privacy at privacy@wasmga.me.
2. Data kept on your device
To make the site work, we store the following in your browser's own storage (localStorage and IndexedDB). It stays on your device, we cannot see it, and it is not sent to us:
- Preferences: colour theme, mute and lights-off settings, and your answer about analytics cookies.
- Game saves: save slots and autosaves for games that support them.
- Your local best scores.
- For Flash games, any data the game saves itself, stored by the Ruffle engine.
You can delete all of it at any time from Help → Your data on this device or by clearing site data in your browser.
3. Game files you choose
Some games ask you to choose files from your device, such as a .swf or a DOOM WAD. Those files are read by your browser and passed straight to the game engine running on your device. They are never uploaded to wasmga.me or anyone else.
4. Data our servers receive
Like any website, our hosting provider receives technical information when your browser requests a page or file: your IP address, the time, the address requested, your browser's user-agent string and the referring page. The site is hosted on Cloudflare, which processes this information to deliver the site and protect it from abuse, under its own privacy policy. We use it only for security and to keep the site running, and we do not combine it with other data to identify you.
We also count, per day, which games and tags are opened, which games are started, and how long games are played while on screen. These counts are anonymous: nothing that identifies you, your device or your visit is stored with them, they use no cookies, and your browser doesn't send them at all if it has Do Not Track or Global Privacy Control switched on.
5. Google Analytics
We use Google Analytics, a service of Google LLC and Google Ireland Limited, to understand how many people visit, which pages they open, and how they found us. When you open a page, your browser loads Google's script from www.googletagmanager.com and sends Google the page address, the referring page, your browser and device type, screen size, language, approximate location derived from your IP address, and, once cookies are allowed, a random identifier stored in the _ga and _ga_GTMKJPHSTB cookies, which last up to 2 years. Google Analytics does not log or store IP addresses. We see only aggregated reports and use them to improve the site, never for advertising.
If you are in the EU, the rest of the European Economic Area, the UK or Switzerland, we ask before Google Analytics sets any cookies. Until you allow them, and if you decline, Google receives the visit without cookies or an identifier, which can't link your visits together. Elsewhere, cookies are allowed unless you decline. We work out which applies from the country your connection comes from, as reported by Cloudflare. Your answer is kept in your browser, and you can change it at any time:
Your browser doesn't load Google Analytics if it has Do Not Track or Global Privacy Control switched on. You can also block it with Google's opt-out add-on or a content blocker. Google processes this data under its own privacy policy; see also how Google uses information from sites that use its services.
6. Third-party engines and services
Flash and DOS games use open-source engines that your browser downloads from their publishers when you start one of those games. At that moment the publisher's server receives the same technical information described above. Each game's Sources panel names every such server before anything is loaded. Today these are:
- js-dos (DOS), from cdn.jsdelivr.net
We turn off js-dos's optional cloud features. Our own original games load nothing from third parties.
7. Accounts, cloud saves and scoreboards
Accounts are optional. You sign in with an account you already have at GitHub, Google or Discord; we never see or store a password. When you sign in, the provider tells us an account ID and your display name, and we store:
- That provider's account ID, linked to your wasmga.me account.
- A username, which starts as your display name and which you can change.
- A session record while you're signed in (a cookie holds the key; we store only a one-way hash of it).
- The saves you choose to upload, and your best submitted score for each game, which is shown publicly next to your username.
We don't ask the provider for your email address, contacts or any permission to act on your behalf. Signing in means your browser visits the provider, which processes your data under its own privacy policy: GitHub, Google, Discord.
Account data is stored with Cloudflare (D1 database and R2 storage). We keep it until you delete your account. From the account page you can download everything we hold about you, and delete your account, which removes your profile, uploaded saves and scores immediately from the live service and from backups within 30 days.
8. Advertising
The site is paid for by ads from Google AdSense. Each page loads Google's ad script from pagead2.googlesyndication.com, and Google and the ad partners it works with receive the page address, your IP address and information about your browser and device, and may read or set cookies and similar identifiers. Google uses this to show ads, limit how often you see the same one, prevent fraud and measure results, and, where allowed, to show ads based on your interests across sites.
In the EU, the rest of the EEA, the UK and Switzerland, ads use cookies or personal data for those purposes only with your consent; without it you see ads that are not personalised. If your browser sends Global Privacy Control or Do Not Track, we ask Google for non-personalised ads only. You can control how Google personalises ads in My Ad Center, and read how Google uses cookies in advertising.
9. Cookies and similar storage
Google Analytics sets the cookies described in section 5, only after you allow them where we ask. Our own cookies are set only if you sign in, and all three are strictly necessary: wg_session keeps you signed in for up to 30 days or until you sign out, wg_user holds your username for the same time so pages can show that you're signed in, and wg_oauth protects the sign-in step and expires after 10 minutes. The browser storage described in section 2 is strictly necessary for features you use, such as saving a game. Google's ad cookies are described in section 8.
10. Legal bases
Where the GDPR or UK GDPR applies, we rely on: our legitimate interests in running and securing the site (section 4); performing our agreement with you when you use features you ask for, such as accounts and cloud saves (section 7); and your consent for anything optional, such as analytics cookies (section 5) or personalised advertising, which you can withdraw at any time.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to processing, and to withdraw consent. California residents may request to know and delete personal information. We do not sell personal information for money, but Google's personalised ads may count as sharing it for cross-context behavioural advertising; we treat Global Privacy Control as your request to opt out. Write to privacy@wasmga.me and we will respond within one month. You may also complain to your local data protection authority.
12. Children
Anyone can play without an account. Without one, the only personal data processed is what sections 4, 5 and 8 describe. Accounts are for people aged 13 or older, or the minimum age for consent to online services in your country if higher. If you believe a child has created an account, contact us and we will delete it.
13. International transfers
Our hosting provider operates worldwide, so data described in sections 4, 5, 7 and 8 may be processed outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.
14. Security
The site is served only over HTTPS. We store no passwords, session keys are stored only as one-way hashes, and session cookies are marked Secure, HttpOnly and SameSite. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the authorities as the law requires.
15. Changes and contact
If we change this policy, we'll update the date at the top, and for significant changes we'll give notice on the site before they take effect. Questions: privacy@wasmga.me.