Privacy notice

Version · effective

Who we are

Giant Leap is run by , . Email about anything in this notice. We are the only operator of the game.

Playing on your own: nothing is collected

The game runs in your browser. Settings, progress and unlocked suits are saved only on your device (in the browser's local storage) and are never sent to us. We use no analytics, no advertising, no tracking cookies and no social-media plug-ins. Our web server does not keep access logs.

Playing online

Playing with others is for players aged 13 and over for now, and needs an account. You make one by signing in: we email you a code, or you continue with Google or Microsoft, or you scan a code on the screen with a phone where you are already signed in. Signing in the first time makes the account; there is no password to choose. Where we offer it, you can instead start with a guest account, with no sign-in, and sign in later to keep it. We keep:

• For a guest account: a random account number made by our server, and a secret that stays in your browser's local storage (we keep only a scrambled copy of it, so we cannot read it). No email address, no name and no password. If you clear your browser's data without signing in, the guest account cannot be opened again. If you sign in later (Keep my progress), the guest account's call sign, progress and Lunar Accord record are moved into your signed-in account, and the guest account and its secret are deleted. Guest accounts cannot start or vote in the crew's vote, swap with other players or place buildings on the shared base until they are signed in.
• Your sign-in: a random account number made by our server; your email address only as a scrambled copy (a keyed code we cannot turn back into the address, so we can recognise you when you sign in again but cannot read it or write to you); if you used Google or Microsoft, which one and the account number it gave us; and a sign-in session (a random token kept in your browser and on our server for up to 90 days). We do not keep your name, your picture, your IP address, a password or anything from your Google or Microsoft account beyond that. When you ask for an email code, we use the address you type only to send it, through our email provider, and do not keep it.
• A call sign picked from our own word list (for example "Kestrel-7"). Players cannot type their own names, so nothing a child types is ever shown to anyone.
• Game progress: objectives completed, distances walked, suits unlocked, and which bunk in the game world you made your home, and the places you saved for the hopper (a position on the Moon and an icon from a fixed set; they are named "Waypoint 1, 2…" and only you see them), and where your astronaut last stood in the game (a position on the Moon and which way they faced, so the game can open there next time).
• Your Lunar Accord record: the home base you chose, what is in your cargo pod, your game credits and the bases you have traded with. Credits are only points in the game; they cannot be bought, sold or cashed out. Trades and swaps are picked from fixed choices: nothing is typed, and other players only see your call sign.
• Your look: the visor colour and the face behind it, picked from our own set of parts (skin tone, hair, eyes and so on). There is no photo and nothing typed, so it is not a picture of you.
• Your country: the home country you picked from the list (or the International crew), shown as a flag on your suit. The game suggests one from your browser's language or, where the game is served through Cloudflare, from the country your connection seems to come from; we use that guess once, to make the suggestion, and do not keep it. Nothing is chosen until you pick. The crew's vote. Any signed-in player whose account is two days old can ask the crew to vote on sending another player home to Earth, choosing the player's call sign and one reason from a short list; nothing is typed. The vote lasts 24 hours. While it runs we keep your account number (as the one who asked, or as someone who voted), your ballot and the call sign it is about. Nobody is shown who asked or how anyone voted, and the player it is about is not told until the end. When it closes we delete who asked and who voted and keep only the totals for 30 days. If the crew send a player home we keep their account number, the reason and the date the break ends (or "for good") even if they delete their account, so deleting it does not undo the decision. Nothing about a vote appears in the comms log. A report that someone made a player feel unsafe is also written to our safety record, with the two account numbers (never who reported it), so a person reads it within a day and can act on it, including telling the authorities when a child may be at risk.
• An age group (under 13, 13–17 or adult) from the age question. We never keep a date of birth.
• A record of what you do in the shared world, for 30 days: when you join and leave, what you build, take down or open, items you take, give or drop, the shared crates you pick up and set down, trades, your home base and homestead, which callout or emote you used (by its number in our list, never anything typed), and where on the Moon it happened (to about 100 metres). There is no typing in the game to record, and we never record your IP address, your device or how anyone voted in a crew vote. Only the people who run the game can read it, to find out what happened when someone is reported or a build is wrecked, and to put the world back.

While you are online, other players see your call sign, your suit and look, your country's flag (the International crew's patch for players under 13, whatever they picked) and where your astronaut is on the Moon, and the comms log shows when call signs join, land and leave. Online or not, the orbit map marks each base you finish with your call sign, where it stands on the Moon, until your account is deleted. The orbit map's Busy layer glows over the areas (about 90 km across) where players have been in the last half hour, only where at least three different players have been and without saying who or how many; players under 13 are never counted in it. Nothing else is shared.

Keeping the game fair and safe

The people who run the game can step in when a player spoils it for others. Every step is chosen by a person, never by a computer on its own, and the player is told plainly, by "Mission Control" (never by a person's name), with a reason from a short fixed list. We can show a warning, switch off a player's radio or pause their building for a while, bring their astronaut back to their home base, take them off the Moon, send them home to Earth for a while or for good, and put back things they wrecked. Other players are not told who was involved. A break or a ban is for the account only: we do not block devices, IP addresses or email addresses. If you think we got it wrong, write to and we will look at it again.

Your own AI mission director (13 and over)

Online, a player aged 13 or over can let an AI service they choose direct their astronaut while they are away (the crew sheet, J). It is off unless they turn it on, and it is never offered to players under 13.

• You pick the service and bring your own key: OpenAI, OpenRouter, or a model running on your own computer (Ollama, LM Studio). Your browser talks to that service directly. The key and the service's replies never pass through our servers.
• The key stays in your browser (local storage, or only this tab if you untick "Remember the key"). Forget key deletes it.
• What is sent, at most every few minutes and 96 times a day: the time, your astronaut's needs, what they are doing and have queued, their priorities, what the hab produced and their last few journal lines. No call sign, account number, age or email. The service also sees what any website sees: your IP address, and whatever its own account holds about you.
• That service is not one of ours: its own terms and privacy policy apply, and it may charge you. We do not choose it, pay for it or get anything from it.

Children under 13

Children play Giant Leap, and we follow the US Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code and the GDPR's rules for children. For now, online play is for players aged 13 and over: a player who tells us they are under 13 plays on their own, where we collect nothing, and cannot sign in or start a guest account. If we open online play to children under 13, a parent or guardian will first be asked to read the notice to parents and agree, and we will update this notice before that happens. We do not ask anyone for more information than the game needs, and we never make a player's information public.

How we use it

Only to run the online game: to sign you in, show your astronaut to others, save your progress and keep the game safe and working. We do not sell or rent information, we do not use it for advertising or profiling, and we do not use it to train AI.

Who else sees it

These providers may only use the information to provide their service to us. We will disclose information if the law requires it, or to protect a child's safety. An AI service a player aged 13 or over picks for their mission director is theirs, not ours (see above).

How long we keep it

• Accounts not used for 12 months are deleted automatically, with their progress.
• A guest account that was never played past the start is deleted after 30 days. Other guest accounts are kept like any account (12 months unused).
• A sign-in session ends after 90 days without play, or when you sign out. An email code works for 5 minutes.
• Safety records: a report that someone was made to feel unsafe, and what we did about it, for a year; longer only if the law asks us to keep it (for example when the authorities ask us to preserve it).
• When an account is deleted we keep a short note that it was deleted and when, under a scrambled code rather than the account, for 3 years, so we can show we did it.
• While a crew vote is open: who asked and how each player voted. Once it closes: only the totals, for 30 days.
• A player the crew send home: their account number, the reason and the end date, until a year after the break ends, or with no end for as long as the decision stands. A parent can ask us to review it (below).
• The record of what you do in the shared world: 30 days, then deleted. If you delete your account, it is no longer linked to you straight away. It is kept longer only if the law asks us to (for example when the authorities ask us to preserve it).
• A break from the game set by the people who run it: like a crew vote's (above). A switched-off radio or paused building: until it ends.
• Server logs (call signs and connection times, never email addresses) roll over within days.
• Encrypted backups, made every night so the game can recover from a fault, are kept 30 days. Something you delete is gone from them 30 days later.

If you donate

Grown-ups (18 or over) can make a donation on Ko-fi, an outside site, from our supporters page. The game itself never asks for money and a donation unlocks nothing. Ko-fi and its payment providers handle the payment under their own privacy policy; we never see card details. Ko-fi tells us about each donation; from that we keep only the date and, if your message starts with Wall:, the name you gave for the supporters wall. We do not keep your email address, your message or the amount against your name, and we never connect a donation to a player or an account. A name is shown only after a person has approved it, and stays on the supporters page and the wall in the game until you ask us to take it off at .

Your rights (and a parent's rights)

A parent can, at any time: see the information we hold about their child (including the last 30 days of the record of what they did in the shared world), have it deleted, and withdraw consent so we stop collecting it. Everyone has the same rights over their own account, and in the UK and EU also the rights to correct it, to object, and to complain to a data protection authority (in the UK, the ICO at ico.org.uk). To do any of this, open Settings → Account in the game while signed in or playing as a guest (download, delete), or email . We answer within 30 days and may need to check that the request comes from the account holder.

Security

The site uses HTTPS only. Account records are stored on our own server, readable only by the game server, and we keep a written information security plan. No system is perfect; if something goes wrong that affects your information we will tell you and the authorities as the law requires.

Changes

If we change this notice in a way that affects children's information, we will ask parents to agree again before it applies to their child.