Privacy policy

Last updated: October 14. 2026

1. Who is responsible

The controller for Shaderdle is Georgi Dimov, Meyerstrasse 210 28201 Bremen, Germany, hello@shaderdle.dev.

2. In short

You can play Shaderdle without an account. We only process what the game needs to run: technical data to deliver the site and, if you sign in, your account and what you publish. There are no ads, no third-party analytics and no tracking, and we never sell data. We count daily players anonymously (section 4).

3. Hosting and delivery

Shaderdle runs on Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which hosts the site and its database. When you open a page, your browser sends technical data: IP address, date and time, the page requested, browser and operating system (user agent) and the referring page. Cloudflare processes this on our behalf to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working site. We keep request logs for [7 days].

4. Counting players

To see how many people play each day, we count unique visitors without cookies, local storage or IDs stored on your device. When the page loads, and when you start or finish a puzzle, your browser sends us that event and the game mode. On our server we combine your IP address and browser user agent with a random value that changes every day, hash the result, and store only that hash. When the day ends we keep the totals and delete the hashes and that day's random value. After that, nobody, us included, can link your visits across days or back to you. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how many people play.

5. Playing without an account

Your daily results, streaks, tutorial progress and Studio drafts are stored in your browser's local storage, on your device only. They are not sent to us. This storage is strictly necessary for the game you asked to play (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

6. Accounts and sign-in

You need an account to publish, like or report shaders. You sign in with GitHub (GitHub, Inc., USA) or Google (Google Ireland Limited, Ireland). The provider then sends us your account ID with that provider and your username or name. We store only the account ID. We use the name once to suggest a handle, which you can change, and we never store your name, profile picture or email address. Legal basis: Art. 6(1)(b) GDPR, providing the account you asked for. The provider's own privacy policy applies to your login there.

To keep you signed in we set one cookie, session. It holds a random token, can't be read by scripts and expires after 30 days or when you sign out. It is strictly necessary for the account you asked for (§ 25(2) no. 2 TDDDG).

7. Shaders, likes and reports

• Shaders you publish (code, name, hint, difficulty, mesh and date) are public, together with your handle, so others can play, like and remix them.
• Likes: we store which shaders you liked. Others see the like count, not who liked.
• Reports: we store the report, its reason and the reporting account to handle it. Reports are never shown publicly.
• If we remove a shader, we tell its author why.

Legal basis: Art. 6(1)(b) GDPR for running the gallery you use, Art. 6(1)(f) GDPR for moderation, and Art. 6(1)(c) GDPR together with the Digital Services Act for handling reports.

8. Bot protection

When you publish a shader, Cloudflare Turnstile checks that you are a person. Its script loads only in the Studio, for signed-in users. It processes your IP address, TLS fingerprint, user agent and the site key. Cloudflare does this on our behalf to block bots, and as its own controller to improve its bot detection; see the Turnstile Privacy Addendum. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the gallery free of spam.

9. Donations via Ko-fi

After you have finished a few daily puzzles, we may show a link to support Shaderdle on Ko-fi. It is a plain link: no Ko-fi script or widget loads on our site. If you click it, Ko-fi processes your visit and any payment under its own privacy policy. From a donation we see only what Ko-fi shows us: the name and message you choose and the amount.

10. Cookies and local storage

Both are strictly necessary, so we don't ask for consent and show no cookie banner.

11. Recipients and transfers outside the EU

We share data only with Cloudflare (hosting, database, bot protection) and, if you choose them for sign-in, GitHub or Google. If you choose to donate, Ko-fi processes that payment under its own privacy policy. Transfers to the USA are based on the EU-U.S. Data Privacy Framework adequacy decision; Cloudflare's data processing agreement also includes the EU Standard Contractual Clauses.

12. How long we keep data

• Request logs: [7 days]
• Player counts: hashes and the day's random value are deleted after the day; only anonymous daily totals are kept
• Your account: until you delete it
• Published shaders: until you or a moderator removes them, or you delete your account
• Removed shaders: hidden, then deleted after 30 days
• Reports: 6 months after they are resolved

13. Your rights

You have the right to access your data (Art. 15 GDPR), to correct it (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can delete your account from the account menu or by emailing hello@shaderdle.dev. You can also complain to a data protection supervisory authority, for example the one where you live.

14. Children

Accounts are for people aged 16 and over. Playing without an account is open to everyone and leaves nothing with us beyond the request logs and anonymous counts above.

15. Changes

We update this policy when Shaderdle's features change. The date at the top shows the latest version.