Your account.
Your choices.

Account data and saved activity

Firebase Authentication manages sign-in. Tailorgame stores account profiles, practice scores, credit history, saved game briefs, created games and room membership in its dedicated Firestore database on Google Cloud.

Your profile can include information you choose to enter, such as a display name, biography, location, hobbies, pronouns, website and birthday. Email and authentication-provider details support account access. Saved briefs include the idea and instructions you enter.

When you request prototype generation, the brief is sent to the configured Gemini service to produce a separate browser prototype. Generation usage and credit settlement are recorded. Saving a brief alone does not start generation.

What other people can see

Public game listings and practice rankings are visible without an account. Rankings expose player display names and practice activity, such as completed-game counts and best scores.

Profiles support an optional public view. Its allowlisted fields exclude email, birthday, authentication details and credit balances. Set your profile visibility to private to turn off that public profile view. This does not remove separate public practice-ranking entries.

Private game briefs and account history require server-authorized access. Room invitation codes and links grant membership and can grant access to a private game. Share them only with the people you intend to invite.

Cookies and browser storage

The website uses an HTTP-only tailorgame-session cookie for signed-in sessions, lasting up to five days. A tailorgame-csrf cookie protects session changes. The session cookie is Secure in production and uses SameSite=Lax. Signing out clears the app session cookie.

Saved-game favorites, some homepage preferences or interest markers, and your analytics choice use this browser’s local storage. Favorites and interest markers are local to this device. A local interest marker does not subscribe you to email or purchase a product.

Clearing site storage removes those local preferences. Signing out or clearing browser storage does not delete server-stored scores, briefs, games or credit records.

Page fonts currently load from Google Fonts, so the browser contacts Google’s font hosts when those styles are used.

Optional page analytics

When configured, Google Analytics and PostHog begin collecting page visits only after you choose to accept analytics. You can reject analytics or change your choice using the site’s Analytics settings control. That control appears when analytics is configured.

Page tracking uses an allowlist of recognized public application routes and published guide paths. Query strings, URL fragments and referrers are removed from application page events. The application does not send your game prompts, account details or private invitation links as page-event properties.

PostHog autocapture and session recording are disabled; its persistence is held in memory. Google advertising signals and ad personalization are disabled. Rejecting analytics stops application tracking and attempts to remove Google Analytics cookies already set for this site.

Public integrations

The public MCP server and browser WebMCP tools expose the public game catalog, practice rankings and documentation. They do not use browser credentials to retrieve private account data or perform account actions. The existing account APIs retain session, origin, ownership and room-membership checks.

Read the developer documentation and authentication guide for the current access boundaries.

Available controls

• Edit your profile details and public-profile visibility in your account.
• Use Analytics settings to accept or reject optional page tracking.
• Sign out to clear the application’s browser session.
• Clear site storage in your browser to remove device-local favorites and preferences.

There is currently no self-service account-data deletion or export flow in the application.