Privacy Policy
Last updated: November 6, 2026
GERMINALS is a browser game run by Darren.G ("we"). You can play without giving us your name or email address. This policy explains what we do collect, why, and how to remove it.
The short version
- We don't ask for your email address or real name, and we don't store them, even if you sign in with Google.
- Your germ name, look and scores can be seen by other players.
- Your votes and your answers to "Myself" questions are not saved after a match.
- We don't sell your data for money. We use Google Analytics to count visits, outside Europe.
- We show ads from ExoClick, limited to non-adult ads, in most of the world but not in Europe. When an ad loads, ExoClick receives some data from your browser, such as your IP address. See "Advertising" below.
- If you buy something, Link, part of Stripe, is the seller and handles the payment. We never see your full card number.
- You can delete your account data at any time from your Germ Journal.
What we collect
| Data | When | Why |
|---|---|---|
| Germ name and look: the name you choose, plus your shape, skin, effect, hat and glasses | When you first play a public match or open the shop | To show your germ to other players |
| Progress: points, wins, matches, rounds and time played, longest run, and daily, weekly and monthly scores | When you play public matches | To run the leaderboards and your Germ Journal |
| Purchases: what you bought, the price, the date, Stripe's payment references, and which Payment Terms you accepted | When you buy something | To deliver your purchase, and for accounting, tax and dispute records |
| Question reports: the question you picked, the reason you chose, the date, your player number, and a random label for the match | When you report a question | To fix mistakes in our questions, and to limit how many reports each player can send |
| Online count: a random temporary number for your browser tab, and your IP address, held in memory only | While the game is open and visible | To show how many germs are online, and to stop one address inflating that number |
| Account record: a player number, a sign-in token, and the dates the account was created and last seen | When your account is created and used | To recognise your account, and to remove inactive guests |
| Google account number: an opaque identifier from Google | Only if you sign in with Google | To sign you in on any device |
| IP address | Whenever you connect | To deliver the game and to limit abuse, such as too many connections from one address |
When you sign in with Google, Google sends us a token that also contains your name, email address and profile picture. We check the token, keep only the account number, and discard the rest.
What happens during a match
Your votes, final guesses and emotes pass through our server so the match can run. Other players see the results and your emotes. They are held in memory for the match only. They are not written to our database, although your resulting score is.
In private rooms, the host's browser runs the match. Votes and chat messages pass through our server to the players in that room, and we do not store them. The host's browser receives other players' votes.
What is saved in your browser
The game itself uses your browser's local storage, not cookies, to remember your sign-in token, germ name and look, settings, personal stats, field notes, achievements and which questions you have already seen. Local stats and notes stay on your device. You can remove all of it by clearing this site's data in your browser.
Who can see your data
- Other players see your germ name and look during matches. The public leaderboards show your germ name, look, points and wins if you have scored points. The All Time board shows signed-in players only.
- Vultr hosts our server and database in the United States.
- Stripe and Link: purchases are sold through Link, part of Stripe, which is the merchant of record. If you buy something, it receives your payment details, email address, name and billing address directly, under Stripe's Privacy Policy.
- ExoClick provides ads. See "Advertising" below.
- Google Analytics counts visits. See "Analytics" below.
- Google provides Google sign-in. If sign-in is available, opening your Germ Journal as a guest loads Google's script, which lets Google receive your IP address and set its own cookies, under Google's Privacy Policy.
- Authorities or advisers if the law requires it, or if it is needed to protect players or our rights.
If we add another analytics or ad partner, we will update this policy first.
Analytics
We use Google Analytics to understand how many people visit and where they come from, including so that we can apply to ad networks. It sets cookies in your browser, and Google receives your IP address, device and browser details, the page you are on and how long you stay. We turn off Google signals and ad personalisation for it, and we don't send it your germ name, votes, answers, purchases or Google account number. We keep this data for 2 months in Google Analytics, under Google's Privacy Policy. The same limits as ads apply: it doesn't load if your browser's time zone is in Europe or can't be identified, or if your browser sends a Global Privacy Control signal.
Advertising
We show ads from ExoClick in the game. We set our ExoClick account to allow non-adult ads only. Ad filters aren't perfect, so if you see an ad that seems inappropriate, please email playgerminals@gmail.com and tell us what it showed. If you buy Remove Ads, ad placements are removed on your account while you are signed in.
When an ad loads, your browser connects to ExoClick directly. ExoClick says it collects your IP address, operating system, browser details, country, time zone and language, the page showing the ad and the page you came from. For some ads it may also receive advertising IDs, device details, network carrier and approximate location. It can use this to deliver and measure ads and, where allowed, to choose ads based on your interests. ExoClick and we can act as joint controllers of this data. ExoClick says it keeps personal data for up to 365 days, under ExoClick's Privacy Policy and Cookies Policy. We don't send ExoClick your germ name, your votes, your answers or your Google account number.
Where ads and analytics don't run: we don't load them if your browser's time zone is in Europe, or if we can't tell its time zone, because their cookies there need a consent step we haven't built. The check happens on your device, and the time zone isn't sent to us. It isn't perfect: someone in Europe whose device is set to another time zone can still get them. If we start using them in Europe, we will ask for consent first and update this policy.
Your choices: we don't load ads or analytics if your browser sends a Global Privacy Control signal. You can also block or clear cookies in your browser settings, or use a browser or extension that blocks ads.
How long we keep it
- Guest accounts are removed automatically after 90 days without activity.
- Accounts signed in with Google are kept until you delete them.
- Daily scores are removed after about 8 days, weekly scores after about 8 weeks, and monthly scores after about 13 months.
- Purchase records are kept as long as accounting, tax and legal rules require, even after you delete your account. Deleting your account removes the link between those records and your germ.
- Question reports are removed after about 12 months. Deleting your account removes the link between your reports and your germ.
- Ad data is held by ExoClick, under its own policies. It says it keeps personal data for up to 365 days.
- Online count data is held in memory and forgotten within about 2 minutes of your tab closing or being hidden.
- IP-based abuse counters are held in memory and cleared within about an hour. Server logs may contain IP addresses, and are kept for a limited time for security and troubleshooting.
- Backups of the server may hold deleted data until they are replaced on their rolling schedule.
Your choices and rights
Delete your data: open your Germ Journal and choose "Delete my data". This removes your account from our database immediately, including anything you bought. It cannot be undone, and purchases are not refunded.
Other requests: depending on where you live, you may have rights to access, correct, delete, restrict or object to our use of your data, or to receive a copy of it. To make a request, email playgerminals@gmail.com from any address and include your germ name. We may need your help to confirm the account is yours, because we don't hold your email address.
Europe and the UK: we use your data to provide the game you asked for (contract) and to keep it fair and secure (legitimate interests). We don't aim ads or analytics at players in Europe. If we do in future, their cookies and personalised ads will rely on your consent. You can complain to your local data protection authority. Your data is processed in the United States, so it leaves your country.
Singapore: we are based in Singapore and follow its Personal Data Protection Act. You can ask to access or correct your data, or withdraw consent. Our Data Protection Officer can be reached at playgerminals@gmail.com.
US states, including California: we don't sell your personal information for money. When an ad loads, ExoClick receives the data described under "Advertising", which some state laws may treat as "selling" or "sharing" for targeted advertising. To opt out, use a browser that sends a Global Privacy Control signal, and no ads will load. We won't treat you differently for using your rights.
Children
GERMINALS is not intended for children under 13, or under the higher minimum age for online services in your country. We don't knowingly collect their data, or knowingly show them ads based on their interests. If you believe a child has an account, email playgerminals@gmail.com with the germ name and we will delete it. A child's parent or guardian can also use "Delete my data" on the child's device.
Security
Connections to the game are encrypted, sign-in tokens are cryptographically signed, and the database is not reachable from the internet. No system is perfectly secure, so we can't guarantee absolute security.
Changes
We will update this page and its date when this policy changes, and give more notice in the game for significant changes.
Contact
Darren.G: playgerminals@gmail.com
Privacy PolicyTerms of ServicePayment TermsBack to GERMINALS
Developed by Darren.G