Privacy Policy

This Policy describes what personal data ИП Володин С. В. · ИНН 666307848501 (the “Operator”, “we”) processes on zloy.net, its subdomains (including api.zloy.net, s.zloy.net and game sites like <game>.zloy.net), on the zloy.site game domains, in game mini apps in Telegram and MAX (connect-tg.zloy.net, connect-max.zloy.net) and in the Zloy Studio developer app, why, for how long, who it is passed to, and what rights you have. The Russian version of this Policy prevails.

Consent to personal data processing is a separate document — “Consent to Personal Data Processing”; it is given with a separate checkbox at sign-up or when confirming the link of a Telegram account.

1. What data we process

1.1. Account

• email address (you sign in to the site by email only), username (your page address zloy.net/name), display name;
• password — only as a bcrypt hash: we do not store the password itself and cannot learn it;
• account language, page privacy and notification settings, sign-up date, email confirmation flag;
• a record of your consent to personal data processing: time, revision of the text and the IP address it was given from.

1.2. Sign-in security

• sign-in history: date and time, IP address, browser string (User-Agent), outcome (successful sign-in, wrong password, lockout, password or email change, etc.) — you see it under “Sign-in & security”;
• active sessions: IP address and browser at sign-in, time of last activity;
• failed sign-in counter: after 5 wrong passwords in a row sign-in is locked for 12 hours.

1.3. Your page and social features

• avatar, “about” text, friends list, friend requests, users you blocked;
• wall posts, comments, reactions and reposts; the author’s IP address is stored when a post or comment is published;
• the activity feed on your page (installed games, new friends).

1.4. Games

• which games you launched (installed), your game ratings, bans set by game developers;
• data a game saves on the platform’s servers via Zloy Backend: progress and saves, leaderboard positions (with your display name), in-game accounts and transactions, game-world objects — all tied to your user number;
• posts a game publishes on its page on your behalf (text, a screenshot or a video — with the platform watermark);
• sign-ins to standalone game apps (Windows, Linux, Android): the game, device name, time of sign-in and last use — you see and can revoke them under “Sign-in & security”.

1.5. Notifications

• the notification feed (title, text, link);
• push subscriptions: the subscription address issued by your browser’s push service, encryption keys and the browser string;
• which notification groups you turned off.

1.6. Payments

If you use payments: Zloy Coin balance, transaction history (amount, purpose, game), payment records (amount, status, item, time of payment). You enter bank card details on the payment service’s page — they never reach us.

1.7. Game developers

• projects, games and their settings, uploaded game builds, promo sites, icons, covers, the testers list, tasks, the repository address (without login or token — the server rejects addresses with credentials inside);
• the log of actions on a game (publishing, submitting for review, approval, data edits): time, IP address, browser, who performed the action;
• connecting a game to Telegram: the game bot’s name and token (stored only encrypted), prices in Stars, the platform’s invoices for payments via Telegram;
• Zloy Studio client data — see section 2.

1.8. Playing via Telegram

If you open a game in Telegram (with the “Play” button in the game bot):

• the information Telegram passes to the mini app on every opening: your Telegram account number, name, username and Telegram interface language (Telegram’s signature is verified; we receive this information from Telegram, not from you);
• a link request: the email address you entered, this Telegram information, the game and the language — to send you an email with a link;
• the link: which Telegram account (number, name, username) is linked to your zloy.net account and when;
• unlinking: which Telegram account (number) was unlinked from your zloy.net account and when — for 14 days after unlinking, no Telegram account can be linked to your account, and the unlinked Telegram account cannot be linked to any zloy.net account;
• the days on which you opened the game in Telegram (Telegram account number, game, date) — to account for load and the number of players;
• payments in Telegram Stars: item, amount in Stars, Telegram payment number, your Telegram account number, and who received the payment (the game developer or the platform).

We do not store messages you write to the game bot: the bot only replies with a greeting.

1.8.1. Playing via MAX

If you open a game in the MAX messenger (with the “Play” button in the game bot), we process the same as for Telegram except payments: your MAX account number, name, username and interface language that MAX passes to the mini app; the link request (email, this information, the game, the language); linking and unlinking of the MAX account; the days on which you opened the game in MAX. The MAX account is stored together with the number of the game bot you came through: the MAX information is signed by the game developer’s bot, not by the messenger itself. There are no payments inside MAX — a purchase opens the zloy.net payment page in a browser. The sign-in link for opening the game in a browser from MAX is sent to your account email.

1.8.2. Duplicating posts to Telegram and MAX channels

The owner of a game page (and of the zloy.net blog) can link their own Telegram and MAX channels and chats to it and turn on duplication of the page’s posts: their own posts, game release notes and announcements, and — only if they separately allow it — posts the game publishes on its page on behalf of players (results, screenshots, videos). Ordinary posts by players and comments are never duplicated to channels. For this we process:

• the channel link: the messenger, the channel or chat number, its title and name, the channel language, who linked it and when; the one-time link code is valid for 15 minutes;
• the copy of a post sent to the channel: the post text (in the channel’s language if the post has text in two languages), the screenshot, video or gallery — with the platform watermark — and a link to the game or the post on zloy.net. The post author’s name, display name and avatar are not included in the copy; but if the game wrote a player’s name in the text or showed it in the screenshot, it ends up in the copy along with them;
• delivery records: which post was sent to which channel, the message number in the channel, the link to it and the delivery error, if any.

A copy in a channel lives under the messenger’s rules and is controlled by the channel owner. When a post is explicitly deleted on the site (by its author, the page owner or a moderator), we delete its copies in channels as well — as far as the messenger allows. When a post from a game expires (30 days), its copies in channels remain: the channel owner can delete them.

1.9. Technical data

• cookies — see section 8;
• Yandex.Metrica data — see section 5;
• web server logs (IP address, time, page address, browser) — for diagnostics and protection against attacks.

Our own visit counter (analytics.zloy.net). When you open a zloy.net page, a game’s page or promo site, launch a game (including in Telegram, MAX or in a game’s app from RuStore, Google Play, Huawei AppGallery, Xiaomi GetApps or Galaxy Store), install it or remove it from your games, and when you create an account (with the sign-up form or by confirming a Telegram or MAX link), the counter records one event: what happened, with which game, when and from which platform; the country and city determined from the IP address at the moment of the request; the browser language, device type (desktop, phone, tablet), operating system and its version; the page address, the site you came from (its name only) and the tags of the link you followed, if it has them (utm_source, utm_medium, utm_campaign). For a sign-up event, instead of the page address it is the first page of the visit that brought you, the game is the one you came from to sign up (if you came from a game), and the site and tags are those of the same visit; the browser keeps them in the zloy_src record (section 8) and sends them together with the sign-up form. A sign-up event only says that an account appeared: the username, email, account number and other account data do not get into it, and it cannot tell which account was created. To tell visitors apart, the browser (or the game’s app) keeps a random number — zloy_vid (section 8); the counter’s database receives not the number itself but its irreversible hash with a secret key. Without the number, visitors are told apart by a hash of the IP address and browser with the date — it changes the next day. The IP address is not stored — neither in the counter’s database nor in its web server log; no user number, name, email or other account data is attached to an event, and an event cannot be linked to an account. We determine the country and city from the IP address on our own server using MaxMind’s GeoLite2 database — the address itself is not sent to MaxMind. A game’s developer sees counter data about their game only in aggregate: numbers of visitors and events by day, hour, country, city, device, system and platform; sign-ups are not among them — they are a platform event, not a game one. The portal owner (the Operator) sees the same aggregate for the whole platform and, in addition, individual visits — the time, country and city, device, system, platform, the site and link tags you came with, what you opened first and whether an account was created from this browser — without the IP address (the database has none) and without any link to an account. It is stored in a database on the Operator’s server in Russia. While a game is being played, the counter sends nothing. You can turn the counter off with a blocker; this does not affect the site or games.

1.10. Requests

The content of your emails to support and the address they were sent from.

We do not request or process passport details, phone numbers, dates of birth, geolocation or special categories of personal data.

2. The Zloy Studio app

Zloy Studio is a desktop app for making games (macOS, Windows, Linux). Some data stays only on your computer, some is sent to the platform’s server.

Stored on the platform’s server:

• conversations in AI agent chats (Claude Code, Codex and others) — in full, including agent replies, tool calls and the output of executed commands. Command output may contain the contents of your project files and other information from your computer that the agent read or printed. Do not paste passwords or keys into the chat, and remember that command output is saved too;
• the sign-in label: when you sign in to the app, your computer name and operating system are written into the token label (e.g. “Суперапп Zloy · my-macbook (macos)”); the sign-in history gets the IP address and time; the token keeps its time of last use;
• game tasks, project settings, the repository address, uploaded game and promo site builds, icons and covers.

Stays only on your device and is never sent to the server:

• AI provider keys (Anthropic, OpenAI, OpenRouter, GigaChat, Meshy, etc.) and your Claude Code / Codex sign-in;
• your GitHub token (GitHub sign-in happens directly between the app and GitHub; the app only gets the public GitHub app identifier from the platform);
• project files and their version history (git), the local copy of conversations, voice notes and their transcripts (transcription runs on your computer).

Requests to AI providers are sent by the app from your computer directly to the provider you chose, under your own agreement with it — they do not pass through the platform’s servers.

3. Why we process data

• registering and running your account, signing in, protecting against password guessing and hijacking (sign-in history, lockout);
• social features: your page, friends, posts, comments, feed, notifications;
• launching games, signing in to games, saving progress, passing to the game developer the information listed in section 5;
• developer tools: Zloy Studio, game publishing and moderation, promo sites;
• payments and Zloy Coin records;
• playing via Telegram: linking a Telegram account to a zloy.net account, payments in Stars, counting players and payments for settlements with game developers;
• duplicating posts of game pages and the blog to the Telegram and MAX channels linked by the page owner (section 1.8.2);
• service emails: email confirmation, password recovery, email change, Telegram account linking, friend requests (if enabled);
• answering requests, complying with the law (including keeping the IP address of the author of publications), visit statistics and improving the site.

4. Legal grounds

• your consent to personal data processing (Art. 6(1)(1) of Federal Law No. 152-FZ);
• performance of the Terms of Use to which you are a party (Art. 6(1)(5));
• fulfilment of obligations imposed on the Operator by law (Art. 6(1)(2)).

5. Who we pass data to

• Selectel — hosting of the platform’s servers and database, and sending emails (mail server smtp.mail.selcloud.ru). Processing on the Operator’s behalf. The servers and the database are located in Russia.
• Yandex LLC — Yandex.Metrica: visit statistics on platform pages, including account pages and game pages. Metrica uses cookies and receives the IP address, browser and device information, page addresses and clicks; Webvisor (session replay) is enabled on platform pages — a recording of the visitor’s actions on the page (mouse movement, scrolling, clicks) to analyse the site’s usability. Game promo sites (<game>.zloy.net) use the same Metrica without Webvisor and without the click map. Yandex terms: yandex.ru/legal/metrica_termsofuse. Besides Metrica, only our own visit counter works on the site (section 1.9): its data is stored on our server and not passed to third parties. There are no other counters (including Google Analytics) and no third-party hosted fonts on the site.
• Game developers. When you launch a published game or sign in to it, the game receives: your user number, username, display name, avatar link, account language, your friends list (number, username, display name, avatar) and which of them play this game. Your email address, password, sign-in history and IP address are not passed to developers. In the developer tools a developer sees the data their game saved about you on the platform’s servers (section 1.4) and aggregate statistics of their game from our counter (section 1.9) — only numbers of visitors and events by country, city, device and platform, with no information about specific people. A developer is a person separate from the Operator; what a game does with the received information on its own side is decided by its developer. Game code runs on separate domains and has no access to your zloy.net session.
• Browser push services (e.g. Google for Chrome, Apple for Safari, Mozilla for Firefox — your browser chooses the service, not us), if you turned notifications on. The service receives your subscription address and the notification text in encrypted form (RFC 8291): only your browser can read it. These services may be located outside Russia.
• Robokassa LLC — when you pay for Zloy Coin: order number, amount and purchase description. You enter card details and the receipt address on Robokassa’s page; their processing is governed by Robokassa’s rules. Payments are enabled separately and may be unavailable.
• MAX — if you play via MAX. The messenger receives what the platform sends on behalf of the game bot: the bot’s reply to you (the game’s name and description, cover and the “Play” button). In addition, the platform bot publishes in MAX copies of posts that the page owner duplicates to their channels (section 1.8.2). MAX is a Russian service: transfer to it is not cross-border.
• Telegram — if you play via Telegram. The messenger receives what the platform sends on behalf of the game bot: the bot’s replies to you and invoices for payment in Stars (item and amount); payment in Stars is carried out by Telegram itself under its own rules. The mini app loads Telegram’s script from telegram.org — without it the app does not work inside the messenger. In addition, the platform bot @zloynetbot publishes in Telegram copies of posts that the page owner duplicates to their channels (section 1.8.2); in a public channel anyone can see them. Telegram is operated by Telegram Messenger Inc.; according to its privacy policy (telegram.org/privacy) the company is located outside the European Economic Area and may share data with its group companies — Telegram Group Inc. and Telegraph Inc. (British Virgin Islands) and Telegram FZ-LLC (Dubai, UAE); that policy names neither the country where Telegram Messenger Inc. itself is registered nor where the data of users outside the EEA and the UK is stored. This is a cross-border transfer of personal data, possibly including to countries that do not ensure adequate protection of the rights of personal data subjects (the UAE is not a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data). Its processing of data is governed by its own rules. If you do not want your data to go to Telegram, do not play via Telegram; posts a game publishes on your behalf go to channels only if the page owner allowed it — you can choose not to publish them or delete them on the site.
• The Operator’s server in Germany (rented from Fornex hosting). From Russia the connection to Telegram is unreliable, so this server carries: (1) all data exchange between game bots, the platform bot and Telegram — Telegram information about you (section 1.8), bot replies, invoices and payment notifications, copies of posts for channels (section 1.8.2); the server runs the Telegram Bot API program, which relays them between Telegram and our server in Russia; (2) visitors’ connections to game sites like <game>.zloy.net — the server sees the visitor’s IP address and the site name and forwards the connection as is; page contents are encrypted and are not decrypted there (there are no encryption keys on it). This is a cross-border transfer of personal data to Germany, a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). The platform’s database, where this information is recorded and stored, is located in Russia.
• Other users see what you publish: username, display name, avatar, “about”, friends, posts and comments — within your privacy settings (a private page is visible to friends only). Platform moderators see games and sites submitted for review.
• Government authorities — in the cases and manner provided by law.

We do not sell personal data and do not pass it on for advertising.

6. How long we keep data

• account, profile, friends, sign-in history, consent records — until the account is deleted;
• a site session — 30 days from sign-in, then deleted;
• a Zloy Studio sign-in — valid for 180 days from last use; its record (with the computer name) is kept until the account is deleted;
• a game app sign-in — 180 days from the last refresh; the record is deleted 30 days after expiry;
• links in emails: email confirmation — 48 hours, password and email change — 1 hour; deleted 7 days after expiry;
• an account whose email was never confirmed — 7 days from sign-up, then deleted with all its data (you can sign up again at any time);
• the notification feed — 7 days;
• a push subscription — until you turn it off or the browser reports it invalid;
• posts games publish on your behalf (results, screenshots, videos) — 30 days; developer notes about new game versions — no time limit while the game exists;
• deleted posts on walls and game pages — archived for 1 year after deletion (text, author, IP address, dates), then deleted;
• data games saved about you on the platform’s servers (saves, leaderboard entries, in-game items and currency) — until the game or its developer deletes it, but no longer than your account exists: it is deleted together with the account;
• server backups of the database — 14 days, then deleted;
• a deleted project and game — 30 days in the trash (can be restored), then deleted together with AI chat conversations, files and the action log;
• Zloy Studio AI chat conversations — until you delete the chat, the project or the account;
• the game action log — while the game exists;
• payments and Zloy Coin transactions — until the account is deleted;
• a Telegram account link request (email, Telegram information) — the link is valid for 48 hours, the request is deleted 7 days after it expires;
• the Telegram account link — until the zloy.net account is deleted or the Telegram account is unlinked;
• a Telegram account unlink record (Telegram account number and time) — 14 days, then deleted;
• a MAX account link request, link and unlink record, and the days on which you opened a game in MAX — the same periods as for Telegram;
• the days on which you opened a game in Telegram — 400 days, then deleted;
• a channel link for duplicating posts — until the page owner removes it or while the page exists; delivery records of copies (channel, message number, link) — while the page exists;
• copies of posts in Telegram and MAX channels — under the messenger’s rules and controlled by the channel owner; when a post is explicitly deleted on the site, we delete its copies as far as the messenger allows (section 1.8.2);
• payments in Telegram Stars — not deleted automatically: they are used for developer invoices and accounting. When the account or the game is deleted, the record’s link to them is removed, but the Telegram account number in the payment record remains;
• visit counter events (section 1.9) — 24 months, then deleted automatically;
• web server logs — for the limited time needed for diagnostics and protection against attacks;
• support requests — as long as needed to answer and resolve the matter.

Deleting your account (under “Sign-in & security”) immediately deletes from the database your account, profile and avatar, friends, posts on your wall, sign-in history, sessions, notifications, subscriptions, game sign-ins, the Telegram and MAX account links, data games saved about you (section 1.4), payments and wallet. Comments and posts you left on other people’s pages and on game pages remain, but without the author. Posts you deleted earlier remain in the archive for the period stated above; in backups, the data of a deleted account is kept for up to 14 days. An account that has games or projects in Zloy Studio cannot be deleted while they exist: delete them in the Studio first (a deleted game stays in the trash for 30 days). How to delete the account and what remains is described at zloy.net/account/security; if you cannot sign in, write to s@zloy.net from the account’s email address.

7. How we protect data

• the connection to the site is encrypted (HTTPS);
• passwords are stored only as bcrypt hashes; sessions, sign-in tokens and one-time links — as hashes;
• sign-in attempts are rate-limited, with a lockout after 5 wrong passwords in a row;
• the session cookie is not accessible to page scripts or to subdomains; game and promo site code runs on separate domains and cannot see your session;
• access to the servers and the database is limited to the Operator.

8. Cookies

The site uses cookies required for it to work (sign-in, form protection, settings), Yandex.Metrica cookies with Session Replay (Webvisor) to understand how the site is used (section 5), and our own anonymised visit counter (section 1.9). The site tells you about this with a notice at the bottom of the page linking to this section; pressing “Got it” only hides the notice. These are the cookies:

• zsid — the signed-in user’s session, 30 days;
• zcsrf — protection of forms against request forgery, 6 hours;
• zflash — a short message after an action (“profile saved”), 1 minute;
• znext — where to return you after sign-in or sign-up, 30 minutes;
• zoauth — an unfinished game sign-in, 15 minutes;
• ztrial — when a trial game without sign-in started, up to a day;
• zsitedev — access to a game promo site draft via the developer’s link, up to a day;
• Yandex.Metrica cookies (_ym_uid, _ym_d and others) — under Yandex’s rules.

Over HTTPS our cookie names start with the __Host- prefix. You can delete or block cookies in your browser settings; without the zsid and zcsrf cookies you cannot sign in. Metrica can be disabled with a blocker or the Yandex opt-out add-on.

Besides cookies, the site keeps display settings in browser storage (localStorage): that you pressed “Got it” under the cookie notice, declined the offer to install the site or have already seen the hint on the game screen, and which code language you chose in the documentation. These records are not sent to the server and are deleted together with the site’s data in your browser. Two records are an exception. zloy_vid is a random browser number for our visit counter (section 1.9). It is not linked to your account, is sent to analytics.zloy.net together with a visit event and is kept until you clear the site’s data in your browser; each site (zloy.net, a game’s promo site, a mini app) has its own. zloy_src is where the browser last came to zloy.net from: the site name, the link tags and the first page of that visit (without such a visit — the very first page); the record is forgotten after 30 days. It is sent to the server only when you submit the sign-up form, so that the counter records where the sign-up came from; the site itself does not keep it. Game promo sites do not have this record.

9. Your rights

• to get information about the processing of your data and a copy of the data;
• to demand that data be clarified, blocked or deleted if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
• to withdraw your consent to personal data processing (see the consent text);
• to appeal the Operator’s actions to Roskomnadzor (the Russian data protection authority) or in court.

Much of this you can do yourself in your account: edit your profile, email and password, hide your page from strangers, turn off notifications, revoke game sign-ins and delete the account. For anything else, write to s@zloy.net from the address linked to your account. We answer within 10 working days of receiving the request; this period may be extended by no more than 5 working days, and we will tell you why.

10. Changes to this Policy

We update the Policy when data processing changes; the revision date is shown at the top of the page. If the changes affect what you consented to, we will ask for your consent again.

11. Contact

ИП Володин С. В. · ИНН 666307848501
E-mail: s@zloy.net