Privacy policy

Last updated 24 October 2026

This policy explains what information Smaz Games (smazgames.com) collects, why, who receives it and what choices you have. The Cookie policy lists every cookie and browser storage item the site uses.

Who we are

Smaz Games is owned and run by Saratoga Games, which is responsible for your information under this policy. We are based in Plattekloof, Cape Town, South Africa. We are based in South Africa. We apply the Protection of Personal Information Act (POPIA) and, for people in the European Economic Area, the UK and Switzerland, the GDPR and UK GDPR.

For any privacy question or request, email [email protected].

Signing in

There are no passwords on Smaz Games. You sign in in one of these ways:

• Email code: enter your email address and we send a six-digit code to it. A code works once, expires after 10 minutes and stops working after three wrong tries. We send at most eight codes to the same email address per day. We store only a scrambled form (a hash) of the code, never the code itself.
• Sign in with Google or Sign in with Apple: the provider tells us your email address, an account ID that the provider uses for you, and your name if you choose to share it. Apple may give us a private relay email address instead of your real one, and emails we send to it are forwarded by Apple. We do not receive your Google or Apple password.

If you sign in with Google or Apple using the same email address as an existing Smaz Games account, the two are linked to that account. You can disconnect Google or Apple on the Account page; email codes keep working.

When you sign in for the first time, you have 30 minutes to finish creating your account (choose a username and age group and accept the terms) before you need to start again.

Sign-in codes are sent by our email provider, Resend, from a no-reply smazgames.com address. Replies and support email go to [email protected], a mailbox hosted by Apple iCloud Mail.

What we collect and why

You can play as a guest without an account. If you create one, we collect what you give us and what the account features need.

We do not ask for your phone number, date of birth, precise location or contacts.

Legal bases

• Providing the service you asked for: accounts, sign-in, profiles, badges, saves, favourites, votes, friends, notifications, messages and player tokens for games you play.
• Our legitimate interests: keeping the site secure, preventing abuse, handling reports and error reports, and producing per-game statistics.
• Legal obligations: teen protections, records of accepted terms and responding to lawful requests.
• Consent: playtests, marketing email, and Google Analytics and advertising cookies where consent is required.

Developer accounts

The same sign-in can hold a player profile and, separately, a developer account. A developer account holds a studio name, and optionally a website, an "about" description and a billing email address. The studio name is shown on the developer's game pages, and the website and description may be shown with it. The billing email is used only to contact the developer about their account and billing, and is not shown publicly. Developer accounts are for adults only.

Statistics we record ourselves

To see which games are played and how, the site records:

• A random visitor ID kept in your browser's local storage. It is not your name or email.
• Page views of game pages, counted once per visitor per game every 30 minutes.
• Plays, with the device type (desktop or phone), the time played and the country.
• Which game pictures on our pages were shown on your screen and which you opened, once per visitor per game each day.
• Whether each play finished loading and how many errors the game reported during it.
• If you are signed in, your account ID with your page views and plays.

The country comes from your IP address, looked up by our network provider, Cloudflare, when your request reaches it. We store the two-letter country code with the play. We do not store your IP address with plays or page views.

Raw page-view records are deleted after 13 months. We keep daily totals per game, which do not identify anyone. When you delete your account, your account ID is removed from your page views and plays.

Each game's developer sees statistics for their own games only: plays, numbers of players, time played, devices, countries and how many players come back. These are totals. Developers do not see names, usernames, email addresses or individual players' records.

We also use your IP address for a short time to limit abuse, such as repeated sign-in attempts. It is not kept in our database.

We rely on our legitimate interest in running and improving the site for these statistics.

Google Analytics

We use Google Analytics 4 to understand how visitors use the site. It uses Google Consent Mode v2. If you are in the European Economic Area, the UK or Switzerland, analytics and advertising storage stay off until you accept in Google's consent message. Elsewhere they are on by default, and you can change this at any time with the "Cookie settings" link in the site footer.

Games send gameplay events, such as starting or finishing a level, to the site, and the site forwards them to Google Analytics labelled with the game's ID. Games do not contain analytics code of their own. The site checks these events and does not accept personal information in them.

We can link a game to a Google Analytics property chosen by Smaz Games for that game, for example one used by the game's developer. If we do, that game's events and its game page views are also sent to that property, under the same consent choices. Nothing else from the site is sent there.

For signed-in teen accounts, Google signals and ad personalisation signals are turned off.

Advertising

We show Google AdSense ads on game pages on desktop computers only. There are no ads inside games or on phones. When ads are switched on, the AdSense script loads on every page so that Google's consent message can appear.

Google and its partners may use cookies or device identifiers to show ads, measure them, prevent fraud and, where you allow it, personalise them. Ads for signed-in teen accounts are not personalised.

In the European Economic Area, the UK and Switzerland, we use Google's certified consent message to ask for your choice. In US states with privacy laws that require it, Google's US state privacy message lets you opt out of the sale or sharing of your information for advertising. You can change your choice at any time with the "Cookie settings" link in the site footer.

Read how Google uses information from sites that use its services: How Google uses information from sites or apps that use our services.

We never give advertisers your email, saves, friends or account details. We publish an ads.txt file listing the sellers authorised to sell ad space on the site.

Badges and profiles

Badges are worked out automatically from your activity on Smaz Games, such as how long you have had an account, how many games you have played, time played, games you have rated and favourites.

Your profile and badges are shown according to your profile visibility setting: only you (private), your friends, or everyone. Profiles are private by default. Profiles of teen accounts are never shown to everyone.

Badges have no money value and cannot be traded, sold or exchanged.

Playtests

Playtests let adults try unreleased games and help developers improve them. Taking part is optional.

• You can opt in from your account preferences. Only adult accounts can take part.
• Each playtest session asks for your consent before it starts. You can decline or stop at any time.
• During a session, only the game area is recorded as video. We do not use your camera or microphone, and nothing outside the game area is recorded.
• We also record a timeline of game events during the session, your device type, and any answers you give to the developer's questions.
• The recording and answers are available to that game's developer and to our staff.
• Recordings are deleted automatically 30 days after they are made. You can withdraw from a playtest and delete your recording earlier.

We rely on your consent for playtests. Withdrawing it does not affect anything done before.

Teens and children

Accounts are for people aged 13 and over. When you sign up you choose your age group. Teen accounts (ages 13 to 17):

• Cannot add friends or upload a profile picture.
• Cannot make their profile visible to everyone.
• Can send developers messages only about bugs, saves or accessibility.
• Cannot take part in playtests or create a developer account.
• Get non-personalised ads, and have Google signals and ad personalisation signals turned off.

Smaz Games is not intended for children under 13. If you think a child under 13 has created an account, email [email protected] and we will delete it.

Games and their developers

Each game runs in a separate, sandboxed frame at its own address on smazplay.com, apart from smazgames.com and from other games. Games cannot read your email address, your sign-in cookie or another game's data. A game that supports account saves receives only its own save data.

Some games are made by other developers, and the game page names the developer.

What a game can receive

Through the Smaz Games SDK, a game you play while signed in can receive:

• Your username and display name.
• Your avatar: the name of the preset avatar you picked, or only the fact that you uploaded your own picture. Uploaded pictures are not shared with games.
• A player ID for that game. Each game gets a different player ID for you, so games cannot use it to match you across games.
• Whether you are under 18. Games do not receive your date of birth or exact age.

Games do not receive your email address, sign-in details, friends, profile, other games' saves or your activity on other games. Guests are not identified to games.

Player tokens

When a game asks, the site can give it a signed token that its own server can use to confirm who is playing, for features such as multiplayer and leaderboards. The token contains the game's player ID for you, your username, your display name and whether you are under 18. It is valid for 10 minutes and does not contain your email address.

Developers may use the token only to check who is playing their game. They must not share it, sell it or keep it after checking it, or try to match players across games or identify them, as the Developer agreement requires. Developers whose games run their own servers are responsible for the information those servers receive, under their own privacy policies. The game page lists the outside services a game connects to.

Invite links

Some multiplayer games let you share an invite link. The link can carry a room code so a friend can join the same game. It does not contain information about you. Anyone who has the link can use it, so share it only with people you want to play with.

Links to other sites

A game can open only websites its developer declared and we approved in review, and the site asks you before opening one in a new tab.

Error reports and gameplay events

If a game crashes or reports an error, the site records technical details: the error message, where in the game's code it happened, the game version and the device type (desktop or phone). Web addresses in these details are shortened so they do not carry extra information. Reports are not linked to your account, and they are shown to that game's developer so they can fix the problem.

Games can also send gameplay events, such as finishing a level, as described under Google Analytics. They must not contain personal information.

Messages to developers

When you message a developer, the message is checked by us before it reaches them, and they see it labelled as from a player rather than with your account details.

Saves

• Account saves: if you are signed in and a game supports it, your progress is saved to your account so you can continue on another device.
• Browser saves: otherwise, progress is kept in your browser, either by the site or by the game in its own browser storage, which only that game can read. Browser saves stay on that device and are shared by everyone who uses the browser. Clearing your browser data removes them.

Who receives your information

We use these service providers to run the site. They process information on our behalf and only for that purpose.

Google also uses information from advertising as an independent controller under its own privacy policy, as explained above.

Game developers receive the information described in "Games and their developers" and "Playtests". We may also disclose information when the law requires it, to protect people from harm, or as part of a sale or transfer of the business, with notice where the law requires it. We do not sell your information to anyone for money. Under some US state laws, advertising cookies can count as "selling" or "sharing" information; you can opt out as described under Advertising.

International transfers

Our service providers process information in countries outside South Africa and outside your own country, including the United States. Where the law requires it, we rely on the providers' data processing terms, including standard contractual clauses, to protect information transferred abroad.

How long we keep information

Your rights

Depending on where you live, including under POPIA and the GDPR or UK GDPR, you have the right to:

• Ask what information we hold about you and get a copy.
• Correct information that is wrong.
• Delete your information.
• Object to, or ask us to restrict, how we use it, including for direct marketing.
• Receive your information in a portable format.
• Withdraw consent you gave, without affecting what was done before.

On the Account page you can:

• Edit your profile, username, display name and privacy settings.
• Download a copy of your data in a file.
• Delete your account. You confirm this with a code we email to you. If you have games published as a developer, email us first so we can deal with them before the account is deleted.

For anything else, email [email protected]. We may ask you to confirm the request from your account email. We reply within the time the law allows, normally within 30 days.

You can complain to a data protection authority:

• South Africa: the Information Regulator.
• United Kingdom: the Information Commissioner's Office.
• European Economic Area: the data protection authority in your country. The European Data Protection Board lists them.
• Switzerland: the Federal Data Protection and Information Commissioner.

We would appreciate the chance to deal with your concern first.

Security

Sign-in uses single-use codes or Google and Apple, so we store no passwords. Codes and session tokens are stored only as hashes, sign-in cookies are secure and cannot be read by page scripts, games run on a separate domain, and staff access to accounts is limited to what their role needs. No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities where the law requires it.

Changes

We will post changes to this policy on this page and update the date at the top. If a change is significant, we will tell signed-in players on the site or by email before it takes effect.

Contact

Email [email protected] for privacy questions, requests and complaints.