---
title: "Tailorgame privacy and data"
updated: 2026-11-06
language: en
canonical: "https://tailorgame.com/privacy"
---

# Tailorgame privacy and data

Updated: 2026-11-06. This guide describes the data used by current features and the controls available in the application.

## Account data and saved activity

Firebase Authentication manages sign-in. Tailorgame stores profiles, practice scores, credit history, saved briefs, created games and room membership in its dedicated Firestore database on Google Cloud. Optional profile information includes a display name, biography, location, hobbies, pronouns, website and birthday. Email and provider information support account access.

When a person requests prototype generation, their brief is sent to the configured Gemini service. Usage and credit settlement are recorded. Saving a brief alone does not start generation.

## Public visibility

Public catalog and ranking data are visible without an account. Rankings show display names and practice activity. Opt-in public profiles exclude birthday, email, authentication details and balances. Turning a profile private does not remove separate ranking entries. Private briefs and account history require server authorization. Room invitations grant membership and can grant game access; share them only with intended players.

## Cookies and browser storage

Tailorgame uses an HTTP-only tailorgame-session cookie for up to five days, with Secure in production and SameSite=Lax. A tailorgame-csrf cookie protects session changes. Signing out clears the app session cookie. The tailorgame-locale cookie stores the selected interface language for up to one year. Favorites, some homepage preferences and interest markers, and analytics choices use local storage. Local interest markers do not subscribe a person to email or purchase anything. Clearing storage removes local preferences but does not delete server records. Fonts load from Google Fonts.

## Gameplay activity and administration

Signed-in gameplay records include the game, session timestamps, estimated active playtime, browser timezone and language. Tracking pauses while a game is hidden or idle. Timezone and language are browser-provided hints, not verified country or region. When the trusted network edge is configured, approximate country and region are derived from the connection. Raw IP addresses are not stored in gameplay history. This operational history is separate from optional third-party page analytics.

Authorized platform administrators can inspect player profiles, gameplay history, credits, rooms and generation records after signing in with a verified pwm.co.il organization email. Passwords and authentication tokens are excluded from dashboard views and exports. Historical playtime before tracking began is unavailable.

## Optional analytics

When configured, Google Analytics and PostHog start after analytics consent. Analytics settings lets a person accept, reject or change that choice. Application page events use an allowlist and remove query strings, fragments and referrers; prompts, account details and private invitation links are not included. PostHog autocapture and session recording are disabled, and persistence is in memory. Google advertising signals and ad personalization are disabled. Rejecting analytics stops application tracking and attempts to remove existing Google Analytics cookies.

## Public integrations

Public MCP and WebMCP tools read only public catalog, rankings and documentation. They do not use browser credentials to retrieve private data or perform account actions. Account APIs retain session, origin, ownership and membership checks.

## Available controls

- Edit profile details and public-profile visibility.
- Accept or reject optional analytics.
- Sign out to clear the application session.
- Clear browser site storage to remove device-local preferences.

There is currently no self-service account-data deletion or export flow.

[Authentication and authorization](https://tailorgame.com/auth.md) · [Public integration guide](https://tailorgame.com/docs/api.md)