Privacy Policy
Effective November 1, 2026
This policy explains what information Tapmedal (the games at bitgames.win, "we") collects, why, and what you can do about it. We keep it short and only collect what the games need to work.
1. You can play without an account
All games can be played without signing up. If you don't create an account, your records, XP and settings stay in your own browser (local storage) and are not sent to our server.
2. What we collect when you create an account
| Information | Why |
|---|---|
| Your ID (username) | To let you log in. |
| Your password | To let you log in. We never store the password itself, only a salted one-way hash (PBKDF2-SHA256), so nobody, including us, can read it. |
| Country or region you choose | For the country leaderboard and medals. |
| Nickname | Shown on the leaderboard. It starts as your ID; you can change it. |
| Your best scores per game and season, XP and level | To run the leaderboard, medals and levels. |
| Dates (sign-up, last update, when you agreed to these terms) | To run the service and keep a record of your consent. |
A login cookie (tt_sid) | Keeps you logged in for up to 30 days. We store only a hash of it on our server. |
| A hashed version of your IP address | Only to limit repeated sign-up and log-in attempts (spam and password guessing). We don't store your IP address itself, and these entries are deleted after about a day. |
We do not ask for your real name, email address, phone number or location. Please don't put personal information in your ID or nickname.
3. What is public
Your nickname, country, level and best scores are shown on the public leaderboard. Your ID and password are never shown by the service, but if you leave your nickname the same as your ID, your ID will be visible as your nickname.
4. What we don't do
- We don't sell or rent your information.
- We don't show ads and don't use advertising or tracking cookies.
- The visitor count at the bottom of the home page is a plain number. To count each browser once a day, we keep a small marker (the date and a yes/no flag) in your browser's local storage. It holds no ID and no personal information.
- We don't use analytics that track you across websites.
5. Services we rely on
- Cloudflare hosts the website, the game server and the database, and forwards email sent to [email protected]. Your requests (including your IP address) pass through Cloudflare's global network so the site can work and be protected from attacks.
- Google Fonts provides the pixel font. Your browser downloads it from Google, which receives your IP address as part of that request.
Because these services run worldwide, your information may be processed outside your country.
6. How long we keep it
We keep your account information until you delete your account. When you delete it, we remove your account, scores, XP and login sessions from our database right away. Copies may remain in automatic database backups for up to 30 days before they are overwritten.
7. Your choices and rights
- Change your nickname from the leaderboard profile.
- Delete your account at any time: tap your ID at the top of the home screen, then "Delete account".
- Ask us for a copy of your information, a correction, or deletion by emailing [email protected]. Depending on where you live, you may also have the right to object to or restrict processing and to complain to your local data protection authority.
8. Children
You must be at least 14 years old to create an account (or older, if your country requires a higher age to agree to data processing on your own). If you are under that age, please play without an account. If we learn that an account belongs to a younger child, we will delete it.
9. Security
We use HTTPS, hashed passwords, hashed login tokens and limits on repeated log-in attempts. No system is perfectly secure, so please use a password you don't use anywhere else.
10. Changes
If we change this policy, we will update the date above. If the change is important, we will ask you to agree again the next time you log in.
11. Contact
Questions or requests: [email protected]