Privacy

What OJPlay stores about you, why, and who else sees it.

This page lists what the site actually holds. It was written by reading the database schema and the code that writes to it rather than from a template, so it is specific, and where something surprised us we have said so plainly.

Questions go to hello@onejs.com.

What we store about you

Your email address. It is how you sign in, and it is the only thing we need from you to make an account. It is stored lowercased, because somebody who signs up as Sam@example.com and comes back as sam@example.com is one person.

Your handle, made from your address when you first sign in and changeable afterwards. This one is public: it is in the address of your profile and beside every sketch you publish.

A display name and an avatar, if you set them.

When your account was made.

A OneJS purchase, if you verify one. We keep the invoice number, which doubles your storage allowance. It is unique across accounts, which is how one purchase stays one account.

That is the whole list. We do not ask for your name, your address, your date of birth or your phone number, and there is nowhere to type them.

Signing in

When you ask for a code we store your address, a hash of the six digit code, when it was made, when it expires and how many times it has been tried. The code itself is never stored, only the hash, so nobody reading the database can sign in as you. The row expires after ten minutes.

The sign-in email is delivered by Resend, which therefore sees your address and the code. It is the only company we hand your address to.

Your session is a cookie called oj_session. It holds your account number, when it was issued and a signature, and nothing else: no name, no address, nothing a site you visit later could read. It is HttpOnly so no script can see it, Secure so it only travels over HTTPS, and SameSite=Lax. It lasts thirty days.

What we store about your sketches

Each sketch has a name, a description, its stage size, its tags, its files, its history, when it was made and changed, and when it became public if it is. It records how many times it has been played, bookmarked and forked, and which sketch it was forked from if any.

Those counters are totals, not records of who. Playing a sketch adds one to a number. We do not store who played it, when, or from where.

A bookmark is different and does have your name on it, because it is a list you keep: it stores which account bookmarked which sketch, and when.

If a sketch has a leaderboard, a score row holds the name the player typed (or their handle if they were signed in), the score, and the time. A player who is not signed in is not identified beyond the name they chose to type.

What the server writes down

One line per request, as structured JSON. It carries the method, the host, the path, the sketch id if the request was about one, your account number if you were signed in, Cloudflare's request id, the status and how long it took.

The query string is never logged, deliberately: a grant or a play token can appear in one, and a log that captured them would be a copy of the keys.

Your IP address is not in that line either, and it is not stored in our database. It is used for one thing: as the key that limits how often a single source can ask for sign-in codes, try codes, or run preview builds. That check goes to Cloudflare's rate limiter, which counts against the key and forgets it; we neither read it back nor keep it.

When something goes wrong we log the same fields plus the error and its stack.

These logs live in Cloudflare Workers Logs and age out on Cloudflare's schedule. Cloudflare also keeps its own network-level records of traffic to the site, as any host does; those are theirs and are covered by their policy rather than by this page.

Who else sees anything

Five, and only five. The last two hear nothing at all unless you choose them:

There is no analytics, no advertising, no tracking pixel and no third party script on any page of this site. The site loads no web fonts and calls no external service while you read it.

What is public

Worth stating in one place, because it is the thing most likely to surprise somebody:

Your email address is never shown to anybody. Your private sketches are not listed, not readable and not countable by anyone but you.

Cookies

Three things, and none of them for tracking:

Keeping and deleting

Sign-in codes expire after ten minutes. Leaderboard tokens are swept once they are no longer usable. A file with nothing referencing it any more is deleted after a seven day grace period, so that restoring a sketch you just deleted does not find its art missing.

Deleting a sketch from your account page takes down its page, its origin and its files, and frees the space straight away.

Closing an account has no button yet. Write to hello@onejs.com and we will do it by hand and tell you when it is done. We would rather say that than describe a control that does not exist.

To ask what we hold about you, or to correct it, write to the same address. Given the list at the top of this page, the answer is short.

Children

The site is not aimed at children and we do not knowingly keep accounts for anybody under 13. If you believe a child has made an account, tell us and we will remove it.

Changes

When this page changes we will change the date below. If we ever start collecting something that is not on this list, that is the kind of change we will say out loud rather than edit in quietly.

Last updated: 14 September 2026.