Privacy

Play as a guest with nothing to sign up for. Accounts are optional, there are no ads, and optional website analytics are disabled in the iOS and Steam game apps.

On your device

Your name, colors, cosmetics, level, trophies, weekly rewards, settings, block list, interrupted-run checkpoints, your analytics choice and your private player, invite and supporter keys are saved on your device. The apps also retain the sign-in session and unfinished purchase delivery information. Clearing app/site data deletes local progress and keys; progress already saved to an account stays there. A reinstall may require signing in and restoring purchases.

While you play

To run the multiplayer game our server receives your chosen name, color and cosmetics, and your steering inputs. Other players in your pond see your name, look and score. Your IP address is used only in memory to limit abuse (for example too many connections at once) and is not stored by the game. A shared pond link contains a public pond code; it is not a credential and stops working when the pond closes.

For blocking and moderation, players in a pond receive an opaque player identifier derived on the server from your account or a random private guest key. It does not reveal your account ID or private key. It stays the same when you rename your jelly or reconnect using the same account or guest key. Guest identifiers can change when local data is cleared; they are not device fingerprints.

Weekly leaderboard

When a run ends, its weekly-challenge result, your chosen name and color may appear on that week's public top-10 board. The board ranks runs, not people, and resets every Monday at 00:00 UTC. A public opaque moderation identifier lets other players hide a blocked player's name. It never includes an account ID, private invite key or IP address.

Optional accounts

You never need an account to play. If you choose Google or Discord, that provider asks permission to share your basic profile with JellyHop. We keep a hash of your provider-specific account ID, your display name, your progress (XP, level, lifetime totals, personal bests, trophies and weekly rewards), your equipped look and a per-device progress record. We do not request your email, contacts, messages or server memberships, and we do not keep provider access or refresh tokens. The relaunched account service starts fresh: accounts and cloud-only progress from the original server are not imported. Progress still present in this browser is retained and can be saved to a new account.

The iOS app also offers Sign in with Apple. We verify Apple's identity response, store a hash of its provider-specific identifier, and retain an encrypted revocable Apple authorization token so we can revoke access when you delete the account. Apple may include an email or relay address in its authorization response; we do not save that address or your full name. Short-lived login challenges prevent reuse of an authorization response. Verified Apple revocation/account-deletion notifications invalidate sessions or erase the matching account. We retain hashed notification receipts and hashed-identity event timestamps for 31 days to reject replay and out-of-order events. Steam accounts are identified through Steam's authentication service.

An essential, secure HttpOnly cookie keeps you signed in for up to 14 days on the website. The Steam and iOS apps use a bearer token stored on the device instead of that cookie. A sign-in attempt expires after 10 minutes. Signing out ends the session on that device. Google, Discord, Sign in with Apple and Steam are separate accounts, so use the same one on each device.

You can delete your account in the game: open Save progress and choose Delete account. Deletion removes that account, its sign-in sessions, its authored player reports, its links to invite and supporter records, and the progress synced to it. Available Apple authorization is revoked before we confirm completion; if Apple is temporarily unavailable, the request remains pending for retry. If we no longer hold a revocable credential, we still erase your account and explain how to remove any remaining authorization in Apple Settings. Signing in again creates a new account and does not restore the deleted progress. Minimal payment/refund records and a pseudonymous purchase-owner proof remain to prevent replay and let the same verified provider identity recover an existing purchase. Unrelated invite/supporter records are handled separately. Backups can retain deleted records for up to 30 days; after restoring a backup we reapply the deletion ledger before reopening the service.

Friend invites

Your browser creates a random private invite key. We store an identifier derived from it, its public invite code, the invite code that first brought you here (if any), and when your profile was created and first confirmed by play. An eligible friend counts once they have played for 30 seconds, observed by our game server. We limit referral credits per referrer per UTC day and do not credit friends whose play connection matches a network recently used with the referrer's private invite key. These checks may exclude friends on a shared home, school or carrier connection. For this check we retain keyed network hashes only in server memory for up to 24 hours, using a temporary key that changes at restart; raw IP addresses and these network hashes are not written to the referral database. A minimal credit ledger retains invite identifiers, referrer codes and credit timestamps for the current and previous UTC day to enforce limits. Your invite link contains only the public code. We use no device fingerprinting and need no name or email for invites. When you are signed in, your invite and supporter records are linked to your account by proving ownership with the private keys; the keys themselves are not stored.

Supporter donations

Donations are processed by Buy Me a Coffee under its own privacy policy; we never see card or bank details. Its signed donation and refund events reach our verification endpoint, and we store the payment and event IDs, the supporter code from your message, refund status and timestamps — not donor names, email addresses or full messages. The code is derived from a private key that stays in your browser.

App Store purchases

Color Shift is an optional non-consumable purchase in the iOS app. Apple handles payment, receipts and refunds; we do not receive card or bank details. Our server verifies signed App Store transaction information and retains transaction and product identifiers, purchase-owner linkage, a random app-account token, verification/event timestamps and refund or revocation state. These records deliver the cosmetic, restore it on your account and prevent another account from claiming it. Purchases and refunds can update your account's cosmetic entitlement. The Restore purchases control contacts Apple and our server to reconcile ownership. Using an account on multiple devices links the entitlement across those devices. Steam Color Shift ownership is checked with Steam.

Player reports and restrictions

A report stores the reported player's chosen name and public player identifier, the reason and detail you enter, the reporting account ID when signed in, and timestamps. Operators record review status, resolution notes and any restriction. Reports are removed after 90 days or when their reporting account is deleted; a restriction can remain until its recorded expiry or an operator removes it. Avoid putting real names, contact details or other sensitive information in report text. Your local block list hides players for you and is not published to other players.

Our hosting provider may also use essential security cookies to prevent automated abuse. These are separate from optional analytics.

Visit totals (Cloudflare Web Analytics)

When configured, Cloudflare Web Analytics counts page views and visits and measures page-loading speed on our public website pages. It uses no cookies, local storage, persistent visitor IDs or fingerprinting, and it does not see your game actions, name, account or rewards. It runs independently of the Google Analytics choice below. Neither website analytics integration runs inside the iOS or Steam game bundle; a website opened separately in your browser follows that website's choices.

Optional Google Analytics

Google Analytics is off until you allow it on the banner or under Settings → Optional analytics. When allowed, Google Tag Manager loads Google Analytics to measure page views, game starts, first pickups and hops, second rounds, run size, length and splats, join failures, shares, trophy unlocks, invite totals and supporter-page and verification events, plus your control type (touch, pointer or keyboard). We send no player names, keys, invite or supporter codes, or donation details, and page addresses are sent without query strings. Google receives ordinary connection and device information and may set analytics cookies. With your consent this browser also remembers your last visit date (no ID) to count returns within 90 days. Advertising storage, ad personalization and Google signals stay off.

Turning it off stops our events and removes the Google Analytics cookies we can reach; it does not erase data Google already received. See Google's privacy policy.

Hosting

The website, multiplayer arena and account records are hosted on Oracle Cloud Infrastructure, reached through Cloudflare. Database backups are stored in Cloudflare R2. These providers process connection information such as IP addresses and may keep short-lived operational logs. Our own server counters (connections, pond sizes, performance) contain no names or identifiers.

Children

JellyHop does not ask for personal information to play. Player names are filtered for offensive words. Please don't use your real name as your jelly's name.

Contact and deletion

Questions, reports, appeals or reward-record requests: email support@lumiora.ai. Tell us which sign-in you used (Google, Discord, Apple or Steam), the in-game report number, or your public invite/supporter code. We will arrange a private ownership check when needed. Use the in-game Delete account control for account deletion. Never post a private key, session token or Apple authorization publicly.

Last updated: October 19, 2026.