Privacy Policy

Effective date: 8 October 2026

This policy is general information, not legal advice. Consult a qualified lawyer for advice about your specific rights or obligations.

GlimWorld ("we", "us", "our") operates the website playglimworld.com and the related game-creation, coding-lesson, and 3D-playground community (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. We are committed to protecting the privacy of every member of our community — especially children — and to complying with the Australian Privacy Act 1988, the GDPR, and the U.S. Children's Online Privacy Protection Act (COPPA).

1. Information We Collect

• Account: Player ID, username, optional email address, optional role (Member / Educator), optional short bio, and a salted password hash if you set a password
• Profile: Avatar colour, hat, wings, accessories; Glim Coins balance; achievement list
• User content: Games you publish, lessons you author, comments, direct messages, group-chat messages, community-board posts
• Parental controls: Hashed parental PIN, parental-control preferences
• Usage & safety: Login streaks, feature usage counts, moderation history, spam-scoring metadata
• Device & connection: Browser type, screen size, approximate location (country/region from IP), anonymous device fingerprint
• Support requests: Name, email, message body — collected via our third-party form provider (JotForm)

How passwords are stored

Your password is never stored in plain text. For Player ID accounts, your password is sent to GlimWorld's server over HTTPS when you sign in or set or change it. The server stores an individually salted scrypt hash, not the raw password or a browser-generated SHA-256 hash. Player ID passwords must be 8–256 characters. Choose a strong, unique password and do not reuse it across services.

2. How We Use Your Information

• Create and authenticate your Player ID account, and sync your profile across devices you log in from.
• Display your username, avatar, bio, published games, lessons, comments, and other content you choose to share.
• Operate community features such as the game library, leaderboard, trading post, multiplayer playground, and game jams.
• Send in-app notifications about achievements, new followers, trade offers, group-chat activity, and direct messages.
• Detect, prevent, and respond to security, fraud, abuse, and policy violations.
• Moderate user-generated content in line with our Community Guidelines.
• Respond to your support tickets, ban/mute appeals, and privacy/data requests.
• Aggregate anonymous analytics about which features are used most.
• Daily aggregate counts of successful HTML page loads and successful sign-in events. These counters do not contain IP addresses, account IDs, browser fingerprints, or individual event records; repeat visits and automated page loads may count more than once.
• Comply with our legal obligations under Australian and applicable international law.

We do not use your information to build advertising profiles, sell data to third parties, or share your child's personal information for commercial purposes. We do not run behavioural advertising on GlimWorld.

3. Children's Privacy (COPPA)

GlimWorld is designed for users of all ages, including children under 13. Because our community includes children, we apply heightened protections:

• Parental consent. If you are under the minimum age in your country, you may only create an account with the involvement of a parent or legal guardian.
• Parental controls. We provide a built-in parental PIN system that lets a parent or guardian restrict chat, the in-game shop, content visibility, and certain social features.
• Minimal data. A Player ID does not require an email address, phone number, full name, or precise location. If you choose to link an identity, contact support, or use a legacy account, that flow may involve an email address.
• No behavioural advertising. Children using GlimWorld will not see targeted advertising based on their activity.
• Parental rights. A parent or guardian may request access to, correction of, or deletion of a child's account through the Support form. Account holders can also use Settings to delete an eligible Player ID account.

If you believe we have collected information from a child under the minimum age without parental consent, please contact us immediately through the Support form and we will delete that information.

4. Third-Party Services

GlimWorld relies on the following services to operate or deliver features. They process information as needed for their role and have their own privacy policies:

• Replit — hosts the GlimWorld application and its PostgreSQL-backed Player ID account service.
• Supabase — hosts some GlimWorld content and real-time features. Supabase Auth is not the active Player ID sign-in system; it may be used to verify an older account if you choose an available migration flow.
• Clerk and Google — may process identity information when you choose an optional Google account connection or an available legacy account flow. They are not required to use a Player ID.
• Loops — may deliver account-verification or recovery emails when those flows are enabled.
• GlimWorld website (Wix) — linked as an external site
• JotForm — hosts our support and ban-appeal form
• Discord — hosts our community chat (linked, not embedded)
• CDN providers (jsdelivr, cdnjs) — delivers JavaScript libraries

GlimWorld does not sell, rent, or trade your personal information to any third party for commercial benefit.

5. Cookies & Local Storage

GlimWorld uses an essential first-party HttpOnly session cookie named gw_session to keep a signed-in session. It uses the SameSite=Lax setting, expires after 30 days, and is marked Secure over HTTPS. The site also uses local storage to cache some profile, game, and preference data. Logging out invalidates the server session and clears specified account-related local-storage entries; it may not remove every GlimWorld preference or cache from the browser.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. JotForm (on the embedded form) may set cookies. Discord and the GlimWorld website (Wix) are external links that open only when you choose to visit them.

6. Data Security

For Player ID accounts, passwords are stored as individually salted scrypt hashes. We use HTTPS/TLS, server-side session and access controls, Supabase Row-Level Security (RLS) for protected Supabase data, a Content-Security-Policy, and sandboxed iframes for third-party content. However, no system is 100% secure. We cannot guarantee that unauthorised access, hacking, or data breaches will never occur. If we become aware of a security breach affecting your personal information, we will notify affected users and the relevant authorities as required by applicable law.

7. Data Retention

• Account data is kept while your account is active. Eligible Player ID accounts can be deleted from Settings after confirming the account password or Player ID.
• When a Player ID account is deleted, private account data is removed, Replit-hosted public GlimWorld creations are anonymized, and accounting history may remain without the account identity. Supabase-hosted legacy content is not changed by this deletion flow.
• Logging out invalidates the server session and clears specified account-related local-storage entries; some browser preferences or caches may remain.
• Moderation records are kept for up to 24 months after the action, even if the account is deleted, so that repeat offenders cannot avoid consequences.
• Support tickets submitted through JotForm are retained by JotForm under their policy until you request deletion.
• Anonymous, aggregated analytics may be kept indefinitely, since they cannot be linked back to an individual.

8. Your Rights

Depending on where you live, you may have some or all of the following rights under Australian privacy law, the GDPR, and similar regulations:

• Access: Request a copy of the personal information we hold about you.
• Correction: Ask us to correct inaccurate or incomplete information.
• Deletion: Request that we delete your account and associated data (the "right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing of your data.
• Withdrawal of consent: If we rely on consent, you can withdraw it at any time.
• Parental rights: Parents or guardians can exercise these rights on behalf of their children.

To request access, correction, portability, or other privacy help, submit a request through the Support form. Eligible Player ID accounts can be deleted from Settings. We will respond within 30 days (or as otherwise required by applicable law).

9. Contact Us

If you have any questions, concerns, or requests about this Privacy Policy or your personal information, email assistglimworld@outlook.com or visit the Contact page to use the support form. For verified parental requests regarding a child's account, please include the child's username and the email address (if any) used at sign-up so we can locate the account. We aim to respond to contact requests within 5 business days and to privacy-rights requests within 30 days, or sooner when required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update its effective date and show an in-app notice when a new version of this Policy or the Terms of Use is published. The notice offers Okay to close it or Learn More to open both current policies. If a change requires your consent under applicable law, we will request that consent separately.