Privacy, in plain language
Last updated July 12, 2026. This page describes what Game Shelf actually does. If the software changes, this page changes in the same update.
What we store, and why
| What | Why |
|---|---|
| Your email address | To send you a sign-in link. It's the only way into your family's settings. |
| Shelf nickname | To label the household shelf. Use a nickname such as “Our Family Shelf,” not a surname. |
| Child first name or nickname | So the shelf and games can greet the child. We do not ask for a last name, age, birthday, address, school, or photo. |
| Game preferences | The character, look, tone, and growth focus you chose, and which games appear on your shelf, in what order. |
| Security records | Hashed sign-in and session tokens, account and child IDs, timestamps, and short-lived hashed email/IP rate-limit counters used to prevent abuse. |
There are no advertising identifiers, analytics profiles, or cross-site behavioral tracking on the parent or kid path.
Where it lives
- Your hosted family data sits in a Cloudflare D1 database. Cloudflare also serves the pages and games.
- Resend receives the parent email address and sign-in message solely to deliver the requested one-time sign-in email.
- Your child's shelf link contains a long random key instead of a family name or number. It cannot be counted up to, but anyone holding the link can see the shelf's child first names or nicknames and selected preferences. Treat it like a password and replace it from the parent area if it is shared by mistake.
- If you record your own voice for a game (like Kingdom Garden), the recording stays in the browser of the device you recorded it on. It is never uploaded anywhere.
- The shelf's "jump back in" row (recently played games) also lives only in the browser of the device your child plays on. It is never sent anywhere.
- Individual games keep progress, settings, and achievements in that game's browser storage. Those records stay on that device unless a future feature says otherwise.
- The child profile is passed to a selected game at launch so that game can apply the name, character, tone, and return link chosen by the parent. Today that profile is encoded in the game launch URL, so it can appear in browser history and hosting security logs. Use first names or nicknames only.
What we never do
- No ads, ever, anywhere.
- No selling data and no sharing it for advertising.
- No third-party scripts, fonts, pixels, or cookies on the pages your child uses.
- No asking kids for anything — all setup happens in the parent area.
Deleting your family
In the parent area, "Delete family" removes your family, your child's hosted settings, active sessions, and unused sign-in links from the live database immediately. The email rate-limit record is also removed; short-lived hashed network-address abuse counters age out separately. Cloudflare's infrastructure recovery history may retain deleted database state for its normal backup window.
Deleting the hosted account cannot erase data stored separately in a browser: downloaded files, local drafts, recent-play history, game saves, and local voice recordings must be cleared on each device or inside the applicable game.
Operator and questions
Game Shelf is operated by Kelton Hays as a small, invite-only family project. During the pilot, reply privately to the invitation you received or contact the small-group member who invited you. Do not post a child name, parent email, or private shelf link in a public GitHub issue.
The source code is public at github.com/Kelton-Hays-Via/keltons-game-shelf so the technical claims on this page can be reviewed. A dedicated monitored support address will replace the invitation-reply channel before any public rollout.