Privacy

Short version: play as a guest with nothing to sign up for. Sign-in and Google Analytics are optional, there are no ads, and we never see your email.

On your device

Your name, colors, cosmetics, level, trophies, weekly rewards, settings, your analytics choice and your private invite and supporter keys are saved in your browser's local storage. Clearing site data deletes them from this browser (anything saved to an account stays there).

While you play

To run the multiplayer game our server receives your chosen name, color and cosmetics, and your steering inputs. Other players in your pond see your name, look and score. Your IP address is used only in memory to limit abuse (for example too many connections at once) and is not stored by the game. A shared pond link contains a public pond code; it is not a credential and stops working when the pond closes.

Weekly leaderboard

When a run ends, its weekly-challenge result, your chosen name and color may appear on that week's public top-10 board. The board ranks runs, not people, and resets every Monday at 00:00 UTC. It never includes an account, invite key or IP address.

Optional account (Google or Discord)

You never need an account to play. If you choose Google or Discord, that provider asks permission to share your basic profile with JellyBlob. We keep a hash of your provider-specific account ID, your display name, your progress (XP, level, lifetime totals, personal bests, trophies and weekly rewards), your equipped look and a per-device progress record. We do not request your email, contacts, messages or server memberships, and we do not keep provider access or refresh tokens. Progress saved to your account in the original JellyBlob comes with you.

An essential, secure HttpOnly cookie keeps you signed in for up to 14 days; a sign-in attempt expires after 10 minutes. Signing out ends the session on that device. Google and Discord sign-ins are separate accounts, so use the same one on each device. Your saved progress stays until you ask us to delete it (see Contact).

Friend invites

Your browser creates a random private invite key. We store an identifier derived from it, its public invite code, the invite code that first brought you here (if any), and when your profile was created and first confirmed by play. A friend counts once they have played for 30 seconds, observed by our game server. Your invite link contains only the public code. We use no device fingerprinting and need no name or email for invites. When you are signed in, your invite and supporter records are linked to your account by proving ownership with the private keys; the keys themselves are not stored.

Supporter donations

Donations are processed by Buy Me a Coffee under its own privacy policy; we never see card or bank details. Its signed donation and refund events reach our verification endpoint, and we store the payment and event IDs, the supporter code from your message, refund status and timestamps — not donor names, email addresses or full messages. The code is derived from a private key that stays in your browser.

Our hosting provider may also use essential security cookies to prevent automated abuse. These are separate from optional analytics.

Visit totals (Cloudflare Web Analytics)

Cloudflare Web Analytics counts page views and visits and measures page-loading speed on our public pages. It uses no cookies, local storage, persistent visitor IDs or fingerprinting, and it does not see your game actions, name, account or rewards. It runs independently of the Google Analytics choice below.

Optional Google Analytics

Google Analytics is off until you allow it on the banner or under Settings → Optional analytics. When allowed, Google Tag Manager loads Google Analytics to measure page views, game starts, first pickups and hops, second rounds, run size, length and splats, join failures, shares, trophy unlocks, invite totals and supporter-page and verification events, plus your control type (touch, pointer or keyboard). We send no player names, keys, invite or supporter codes, or donation details, and page addresses are sent without query strings. Google receives ordinary connection and device information and may set analytics cookies. With your consent this browser also remembers your last visit date (no ID) to count returns within 90 days. Advertising storage, ad personalization and Google signals stay off.

Turning it off stops our events and removes the Google Analytics cookies we can reach; it does not erase data Google already received. See Google's privacy policy.

Hosting

The website and the account and reward records are served and stored by our hosting provider (Sites, on Cloudflare's network). The multiplayer arena runs on a ServaRica server in Montréal, Canada, reached through Cloudflare. These providers process connection information such as IP addresses and may keep short-lived operational logs. Our own server counters (connections, pond sizes, performance) contain no names or identifiers.

Children

JellyBlob does not ask for personal information to play. Player names are filtered for offensive words. Please don't use your real name as your jelly's name.

Contact and deletion

Questions, or to delete an account, its saved progress or reward records: reach the creator through our Buy Me a Coffee page. Tell us which sign-in you used (Google or Discord) or your public invite or supporter code and we will arrange a private ownership check. Never post a private key publicly.

Last updated: September 28, 2026.