Privacy Policy

Last updated: October 27, 2026

What Batchly collects, who can see it, and what you can do about it. Written to be read before you connect anything, not after.

• Overview
• Your account
• Games and progression
• College Hub: Canvas, Calendar and mail
• Google user data and Limited Use
• Workouts, food and progress photos
• Sleep log
• Health data
• AI features and what they send
• Email from Batchly
• Emailing support
• Booking a meeting
• Copyright notices
• Diagnostics and error reports
• Who can see what
• Companies that receive your data
• Where it lives and how it is protected
• Keeping, disconnecting and deleting
• Your choices
• If you are in the UK, the EU or a similar place
• Cookies and local storage
• Children
• Changes to this policy
• Contact

Overview

Batchly is batch-ly.com, run by one person as a personal, non-commercial project. There is no advertising, no third-party tracking SDK, and nothing is sold or shared for marketing. One game is the exception to the first two: Rally Racer Dirt is played inside a page from CrazyGames, which runs under CrazyGames' own privacy policy and may show ads or set cookies (see Companies that receive your data).

Most of the site works without an account. You can browse and play games signed out. You only create an account for cloud saves, leaderboards, achievements and a public profile.

The extra modules are not all open to everyone:

• College Hub is available to any signed-in account with a confirmed email address. Nothing is collected until you connect Canvas or Google yourself.
• College Hub grades are a further opt-in inside College Hub, off by default even once Canvas is connected. Turning it off again deletes what it stored.
• Letting your own AI app read College Hub, through Batchly's MCP connection, is a further opt-in. Nothing is shared unless you create an MCP token with the College Hub box ticked, and then only the parts you leave ticked under it: your courses always come with it, assignments, class times and calendar events start ticked and can each be unticked, and grades and coursework mail each need their own box ticked. What a token can read is fixed when it is made, and tokens you already have never gain it.
• The College Hub AI assistant sits behind a separate invite list. Having College Hub does not give you the assistant.
• The workout tracker is invite-only: a small private group.
• The sleep log is invite-only, one account at a time. Nothing is recorded until you log a night yourself.
• The sleep helper (AI) comes from the same invite as the sleep log.
• Meeting booking pages are set up by administrators and by hosts an administrator adds. Anyone with the link can book through one without an account; what that collects is in Booking a meeting.

“We”, “us” and “Batchly” mean the individual who operates the site. This policy describes how Batchly handles information; it is a notice, not a contract. The rules for using the site, including what you allow Batchly to do with games you upload, are in the Terms of Use.

Your account

• Sign-in details. Your email address and a password, or your Google account (name, email address, profile picture URL and Google account ID) if you use Continue with Google. Passwords are handled by our authentication provider and stored only as a hash; Batchly never sees or logs the plaintext.
• Profile. A display name, an avatar (an emoji emblem, or a photo you upload), an optional bio, and an equipped title and cosmetic loadout. Your avatar is never imported from Google; it is only what you set.
• Account ID. A generated UUID. It is public: it is the address of your profile page at /u/<id>.
• Age confirmation. That your account confirmed it is 13 or over, and when. Your month and year of birth are asked but not stored; see Children.
• Sign-in sessions. When you sign in, our authentication provider records the session's start time, your IP address and your browser's User-Agent, so the session can be secured and misuse investigated. The record is kept while that session exists.

Your email address is never shown on a leaderboard or a public profile. Your display name is public. If you type one when you sign up, that is your name, unless it contains a word the site does not allow or is just the part of your email address before the @. Otherwise a new account is called “Player” and a random number (for example Player 4821). The name on your Google account is never copied into it. Accounts made before this changed keep the name they already had, which may be the part of an email address before the @ or the name on a Google account. You can change your name at any time on your Profile page.

Games and progression

If you are signed in, playing writes: leaderboard scores (with the per-game details attached to a run), cloud saves, achievement unlocks, streaks, Watts balance and ledger, cosmetics you own, season and goal claims, notifications, and activity entries. Social features add follows, likes, ratings, comments, jam votes, challenge scores and referrals.

A cloud save is a snapshot of what a game stored in your browser for that game: progress, high scores, settings. Batchly does not inspect it.

If you turn on notifications, your browser hands Batchly a push address for that device (a delivery URL plus two keys), and it is stored so a notification can be sent to you. It identifies the browser installation, not you; turning notifications off removes it. Notifications travel through your browser maker's push service (for example Google, Mozilla, Apple or Microsoft), which receives the delivery address and the encrypted notification but cannot read it. A phone notification about a comment on your game says only that someone commented; the bell on the site shows the first few words.

If you upload a game, the game's code, cover image, tags, description and moderation history are stored. Every upload and every edit is checked by an automated moderation step: an AI model reads it, and a check notes anything it loads from, sends to or links to other websites. Then a person approves it before it is published; until then it stays private. The automated step can turn an upload down on its own, and you are told why. What the automated step concluded is kept with the game, and only the site's admins can see it. If one of your games is taken down, by an admin or after reports from other players, everything you upload or change afterwards waits for a person until an admin lifts that hold. The operator can switch off the person's approval for web uploads; while it is off, a web upload the automated step approves goes live without a person looking at it first, and Python games, uploads made through MCP, very large files, anything flagged and uploads from an account on hold still wait for a person. You get a notification when your game is approved or needs changes.

Once a game is published, its icon and cover appear on the downloads index, and its source file is offered there for download if you leave the “share the source” box ticked on the upload form. You can change that at any time on your creator dashboard, and games uploaded before 2 September 2026 are not listed for download unless their creator turns it on. To be straight about what that box does and does not do: an approved game's code is already sent to every player's browser in order to run, so the setting keeps no secret; it decides only whether Batchly advertises your file for download in your name.

You can also send feedback and bug reports. Those carry your message, optional contact details, the page you were on, device details you choose to include, any screenshots you attach, and, if you are signed in, your account and email. Feature ideas sent from the box on the homepage are stored as text with no account attached.

If you report a game, the report stores your account, the game, the reason you chose and any details you write. How much a report counts toward taking a game down automatically depends on your account: reports from accounts less than 7 days old, guest sessions, accounts without a confirmed email address and suspended accounts count for nothing, and accounts 7 to 30 days old count half. Admins see every report either way.

Reports, blocks and moderation. If you report a player or a comment, the report keeps your account, who or what you reported, the reason you chose, anything you add and a copy of the comment, so a moderator can review it. The person you report is not told who reported them. A report is deleted when either account is deleted.

If you block someone, Batchly records it so it can hide their comments from you, stop notifications from them, end follows between you, and stop them commenting on your games or following you. Their comments already on your own games are hidden from everyone until you unblock them. Only you can see who you have blocked, and you can unblock them in Settings.

A game's creator and the site's moderators can hide a comment. A hidden comment stays visible to the person who wrote it, to the game's creator and to moderators. When a moderator deletes a comment, resets a name, picture or bio, or suspends an account, Batchly records who did it, when and why, and keeps the deleted comment or the old values so the decision can be reviewed. These records are deleted when the account they are about is deleted.

An account that breaks the rules can be suspended. A suspended account can't sign in, and its profile, comments and collections are hidden; games it already published may stay up. To appeal, write to support@batch-ly.com from the account's email address.

Names, bios, comments and collection titles are checked automatically against a short list of slurs and explicit words, and a post that contains one is refused. Comments and reports are also limited in how fast they can be sent.

College Hub: Canvas, Calendar and mail

College Hub is off until you connect something. It has two connections, and they are independent; you can use one without the other.

Canvas

You paste a Canvas personal access token that you create yourself in Canvas. Batchly then reads, on a sync:

• Your Canvas profile (to confirm the token works and name the account)
• Your active courses: id, name, short name, term, colour and course URL. If you have switched grades on, this same request also asks for your course totals; if you have not, it does not.
• The assignments in those courses, with your own submission record attached

Those are the only three Canvas endpoints the code calls, and all three are reads. College Hub has no write path to Canvas anywhere in it.

Being exact about the assignment call, because “reads” and “keeps” are not the same thing: the request asks Canvas to include your submission, and Canvas's reply to that carries your grade whether or not anything wants it. For as long as College Hub has existed nothing wanted it: there was no column for a score, and the grade was dropped as the reply was parsed. That changed on 2 September 2026; Grades, below, is the whole of the new position.

Grades

Grade tracking is off unless you turn it on, in College Hub, on the Grades card. It is off for every account that already existed, because those accounts connected Canvas under a version of this policy that promised no score was kept, and a promise is not something to withdraw quietly. While it is off, the sync does not ask Canvas for your course totals at all, writes no score, and blanks any grade field it finds.

If you turn it on, this is the whole of what is stored, and the list is the whole list:

• Per assignment: your score, the grade Canvas displays for it (a letter, a percentage, or “complete”), and whether it was excused.
• Per course: the current percentage and current letter grade Canvas computes for you, whether that course hides its total, and when grades were last fetched.

Not stored: your final grade, your score before any late penalty, submission comments, rubric or per-question detail, and anything about anyone else. Canvas offers all of those in the same replies; none of them has a column.

Grades are not sent to the AI assistant. The assistant rebuilds what it knows from the database on every question, and its list of fields does not include any of the ones above. Your deadlines, class times and mail subjects do go to the model (see the AI section), and your grades do not. They also stay out of anything you connect through MCP unless you tick Grades under College Hub when you create that token, and even then only while Grades is on here (see the AI section).

Turning it off is a deletion. Switching the Grades card off erases the stored scores and course totals in the same action, immediately, rather than hiding them. Disconnecting Canvas goes further and deletes the whole coursework cache, described under Keeping, disconnecting and deleting.

One thing this cannot do: show you a grade Canvas will not state. Instructors can hide a course total, and a course with nothing graded yet returns the same silence, so College Hub says which of those it is when it knows and says it cannot tell when it does not. It never fills a missing grade with a zero.

Google Calendar

If you connect Google, College Hub reads your calendar list and then the events on every calendar in it (including calendars shared with you or that you subscribe to) for a window from 7 days ago to 28 days ahead. It stores each event's title, start and end, all-day flag, location, link, and the event's full description text. If your calendar descriptions contain private notes, meeting links or dial-in details, those are stored.

Two details that cut in opposite directions, so both are here. Hiding a calendar inside College Hub changes what is displayed; it does not stop that calendar being fetched. But guest and attendee lists are not stored at all (no column holds them), so who else was invited to your events does not end up in the database.

Email

College Hub can show course-related mail. It searches your Gmail with a query you write and control in College Hub's settings, and stores, for each match: the sender's name, the sender's address, the subject line, the date, the message and thread ids, read/archived state, and which course it matched.

Message bodies are never requested and never stored. The sync calls Gmail with format=metadata and an explicit header list of exactly From, Subject and Date. No body is asked for, and the mail table has no column that could hold one; a database test enforces that, failing the migration if a body, snippet, payload or content column is ever added. Only the three headers above are read out of Gmail's reply; anything else it returns alongside them is discarded in memory and never written down.

To be equally clear the other way: a subject line is content. Subjects can be sensitive on their own: grades, health, money, discipline. Those are stored, and they are included in what the AI assistant sees if you use it, and in what an AI app you connect through MCP can read if you tick Coursework mail on that token. Write your mail query narrowly.

The rest of College Hub

You can also enter your class meeting times and locations by hand, set an available-hours-per-day figure, and record or accept workload estimates per assignment. Sync status rows record when the last sync ran and, if it failed, the error text, which can quote a hostname or an upstream API response.

Where the Canvas token and Google tokens are kept

Both live in one table that is locked down harder than anything else on the site. It has row-level security on with zero policies and no grants at all to signed-out or signed-in users. That means it cannot be read through the public API by anybody, including you, the row's owner. Only server-side functions using the service role can read it.

What the app can ask about that table, precisely: whether Canvas is connected, whether Google is connected, the address of your Canvas site, and the expiry date you set on the Canvas token. Never a token value. Two more calls can write to it (saving a Canvas token, and clearing one), and both act only on your own row.

Honest limit on that: the tokens are stored as ordinary text. They are protected by access control and by the database provider's encryption of the disk they sit on. They are not separately encrypted by Batchly at the application level.

Google user data and Limited Use

Sign in with Google, College Hub's Google connection and a meeting page's calendar connection are three different things and ask for different permissions.

• Signing in with Google uses only the basic scopes openid, email and profile. It is used to create and sign you into your Batchly account, and for nothing else. It does not set your display name (see Your account).
• Connecting Google inside College Hub is a separate, explicit consent screen. It always asks for calendar.readonly, and asks for gmail.readonly only if you also choose to connect mail:
  • calendar.readonly: to read your calendars and the events in the window described above, so College Hub can show your week alongside your assignments.
  • gmail.readonly: a restricted scope. It is used only to fetch the From, Subject and Date headers of messages matching your own search query, so College Hub can show course mail next to the course. It is not used to read bodies, send mail, or change anything in your mailbox.
• Connecting a meeting booking page to Google Calendar (done by the page's host: an administrator, or a host an administrator has added) is a third, separate consent screen. It requests:
  • calendar.freebusy: to see when the host's calendars are busy, so the page offers only free times. Google returns busy periods only, never event titles, descriptions or guests. They are read when someone looks at the page or books, held in the server's memory for at most a minute, and never stored.
  • calendar.events.owned: to create, move and delete the event for each booking, on calendars the host owns. For each booking Batchly keeps the event's id and its two links (the event and its Google Meet room), and nothing else from Google.
  • openid and email: so the host's settings can show which Google account is connected.
  This connection uses the same Google client as College Hub, so Google's consent screen and the list of connected apps in a Google account show the two as one app. Disconnecting it in Batchly deletes Batchly's stored copy of the token but does not ask Google to revoke the grant, because revoking would also cut off College Hub for the same Google account; remove it at myaccount.google.com/permissions to end it on Google's side.

Google's tokens are requested with offline access so a sync can run without you being present. You can disconnect from inside College Hub, which asks Google to revoke the token, or from myaccount.google.com/permissions.

Connecting College Hub to Google takes two steps, so that the connection can only land on the Batchly account that started it. When you approve Google's consent screen, Google sends Batchly a one-time authorization code. Batchly holds that code, not your tokens, for at most 10 minutes, until you finish connecting on the College Hub page while signed in to the same Batchly account. The code is then exchanged for the tokens and deleted. If a different account tries to use it, it is deleted unused and nothing is connected. A code nobody uses in time can no longer be used, and is deleted the next time anyone connects Google. Like the tokens, it is kept in a table that only Batchly's server functions can read.

One honest wrinkle. Google keeps its own record of every permission you have granted this app, and a permission you granted before can come back attached to a new token even though Batchly no longer asks for it. College Hub used to ask for read-only Drive file metadata; that was removed on 26 August 2026 because no code ever called Drive. Narrowing what is asked for does not retract what was already given, so if you connected before that date, the old permission can still sit on your grant until you remove the app at myaccount.google.com/permissions. Nothing in Batchly calls the Drive API.

Batchly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Specifically, and in keeping with Limited Use:

• Google user data is used only to provide and improve the user-facing College Hub and meeting booking features described above, which are prominent in the interface.
• It is not transferred to anyone except as needed to provide those features with your consent, to comply with law, or in connection with a merger or acquisition where users are notified. Two such transfers exist today, both opt-in and described in the AI section: the College Hub assistant sending your context to an AI provider, and, if you create an MCP token with College Hub ticked, Batchly sending your calendar events (title, time, place and calendar name only) if you leave Calendar events ticked, and your coursework mail senders and subjects if you also tick Coursework mail, to the AI app you connected with that token, when that app asks for them on your behalf.
• It is never sold or transferred to advertising platforms, data brokers or information resellers, and never used to serve advertising of any kind, including personalised, retargeted or interest-based ads.
• It is never used to determine credit-worthiness or for lending purposes.
• It is not transferred, sold or used to create, train or improve any machine-learning or artificial-intelligence model. Asking a model a question is not training it: the AI features described below send context to a provider to get an answer back, and the providers used are under terms that do not train on it. The one exception to that last point is an AI app you connect yourself through MCP: which provider it uses, and on what terms, is your choice rather than Batchly's, so check that provider's terms if training matters to you.
• No human reads it, except with your affirmative agreement (for example, when you ask for support and send us the detail), where it is necessary for security or to investigate abuse, to comply with law, or where the data has been aggregated and anonymised for internal operations.

The operator ensures that anyone acting on Batchly's behalf, and any successor to it, complies with the Google API Services User Data Policy.

Workouts, food and progress photos

The workout tracker is invite-only. If you are in it, these are the things it records, all entered by you:

• Workouts: start and end time, a title, and free-text notes.
• Sets: exercise, weight and unit, reps, duration, distance, RPE, warm-up flag, completion time. Exercise names you create are shared with the group's exercise list.
• Progress photos: the image itself, plus pose, caption and date.
• Nutrition: calories, protein, carbs, fat, a note and the date.
• Commitments: a weekly session target, allowed misses, and if you set one, a stake amount in money and where a forfeit would go. Nothing is charged; this is a tracker, not a payment.
• Screenshot imports: the screenshot you attach. It is sent to an AI provider to be read (see the AI section) and, when you confirm the entry it produced, the image is kept in private storage attached to that entry.
• Body measurements: bodyweight, body-fat percentage, waist, chest, arm, thigh, hips, neck and calf. Listed for completeness and because the capability is built, but stated plainly: no part of the app writes a measurement today and none has ever been recorded. If that changes, the group-by-default rule below would apply to it and this page will be updated first.

Progress photos, nutrition and body measurements are health data. In most privacy regimes they are a sensitive category, and Batchly treats them as one. Photos and import screenshots go into private storage buckets, not the public ones used for avatars and game covers.

Sleep log

Invite-only: the operator adds people one account at a time, and the account also needs a confirmed email address. It records the night's date, bed time, wake time, a 1–5 quality rating and free-text notes, and only once you enter them.

Sleep entries are readable only by the account that wrote them, enforced in the database rather than only in the page (not by the workout group, and not by other people using the sleep log). It has never been a shared space: an invite gives you a log of your own, not a view of anyone else's. Administrators are not an exception to it either; the note below about direct database access still applies, and it is the only route by which the operator could ever see an entry.

The sleep helper (the AI you can ask about your own nights) comes from the same invite as the log. If it is not switched on for you, the helper is not offered and the server refuses the request. If an invite is ever withdrawn, the log and the helper close for that account, and the nights already logged are not deleted: they go when the account is deleted, or sooner if you ask (see Contact).

Health data

Some laws, such as Washington State's My Health My Data Act, give extra protection to information about a person's health, and define it broadly. On Batchly that means what you record in the workout tracker (workouts, sets, progress photos, nutrition, and body measurements if that is ever used) and the sleep log, and what you ask the sleep helper. All of it is described in those sections; in short:

• It is collected only when you enter it yourself. Nothing is inferred from your games or anything else.
• It is used only to show it back to you, and, for the workout tracker, to the group as described above; and to answer you when you import a screenshot or ask the sleep helper.
• It is never sold, never used for advertising, and never shared except with the providers that store and carry it (Supabase and Amazon Web Services), the AI providers listed in the AI table for the features you use, and where the law requires it. The operator's admin AI assistant has no access to it.
• You can delete it at any time, an entry at a time or with your account, and you can ask for a copy of it, or which of these providers have received it, by writing to the address in Contact. Asking never costs you anything on the site.

AI features and what they send

Six features can send your content to a language model. Four of them run only when you press something; one runs when an AI app you connected yourself asks for it; the sixth, support email, runs the moment your message arrives. For the features Batchly runs itself, two providers are used: a self-hosted model (a Qwen model on a computer owned and run by the operator's family, which the site's servers reach over an encrypted connection with a key only they hold) and the Anthropic Claude API. Where a feature tries the self-hosted model first and falls back to Claude, that is stated.

The self-hosted model runs on a machine the operator's family controls. Data sent to it does not leave that machine, and it is not used to train anything.

Requests to the Claude API are sent under Anthropic's commercial API terms, under which Anthropic states it does not train its models on data submitted through the API. Anthropic is a third party with its own policies; if you are not comfortable with that, do not use the features in the table.

Conversations themselves are not stored as transcripts. For each of these features, what the database keeps is a row holding your account id and a timestamp: enough for the rate limits to work, and nothing of what was said. Two AI records hold more. One is the moderation verdict on each submitted game (see below). The other is the operator's own: when an admin uses the description-writing tool, a row records the feature, the game and that admin's email address.

Reads through MCP are not logged either, beyond the time a token was last used. What an AI app you connect does with what it reads, including whether it keeps it, is up to that app and its provider: Batchly cannot see it or take it back. Revoking the token in Settings under MCP access stops further reads at once.

Separately, a game you submit is passed to a model for automated moderation, and the operator can use a model to draft a game's description from its code. Both try the self-hosted model first and fall back to the Claude API. The moderation step's latest verdict on each game (approve, flag or reject, its short reason, which model answered, and a fingerprint of the version it read) is kept with the game, and only the site's admins can read it.

The operator also uses an AI assistant (currently Anthropic's Claude) to help run the site. Through an admin-only connection it can read feedback and its screenshots, reports about games, error reports, posts on the internal admin board and games waiting for review, and it can look up an account by name or id. Email addresses are hidden from it unless the operator asks for one, and each such lookup is logged. What it reads is sent to Anthropic. That connection has no access to College Hub, workout or sleep data.

Email from Batchly

Anyone can give an email address to hear about new games; it does not need an account. Batchly's own email is switched off at the moment (see Companies that receive your data), so for now an address is stored but nothing is sent to it. When it is on, this is how it works:

• One confirmation message first. Nothing else is sent until you confirm, using the link in it. An address that is never confirmed is kept as unconfirmed and never mailed.
• After you confirm, you get a weekly digest of new community games and occasional Batchly announcements. Every one of them has an unsubscribe link, and your mail app's own Unsubscribe button works too.
• What is kept: the address, and when you signed up, confirmed and unsubscribed. After you unsubscribe, the address stays on the list marked as unsubscribed, so it is never mailed again unless you sign up and confirm again. Ask and it will be deleted.
• The links in these emails open a page on batch-ly.com. The code in the link stays in your browser and is sent to Batchly's server only when you press the button on that page, so opening the link alone, as some mail scanners do, changes nothing. These pages record no analytics.

The sign-up form is also covered by the abuse limits described in Diagnostics.

Emailing support

The address at the bottom of this page is not a plain mailbox, and you should know that before you use it. Mail to support@batch-ly.com goes through this, every time:

• It arrives at Amazon's mail service, which stores the raw message (headers, text and attachments) in a private storage bucket belonging to the site.
• The sender address, subject and body text are sent to a language model (the self-hosted model, or the Claude API when that is offline; see AI features), which drafts a reply and decides whether a person needs to see it.
• If the model is confident it can answer and has not flagged the message, and the message passes the standard checks that it really came from the address it names (SPF, DKIM and DMARC), that reply is sent back to you automatically, with no human involved.
• Otherwise the message and the draft are forwarded to the operator's personal Gmail account for a person to handle.
• Mail that looks machine-generated (bounces, no-reply senders, automated reports) is not drafted, answered or forwarded at all. The raw copy is still retained.

The model is instructed to hand certain things to a person rather than answer them itself: anything about account deletion, data access or a privacy or legal request; anything about payments; security reports; and anything involving another person, such as harassment or abuse. So a deletion request reaches a human. It is still read by a model on the way, and it is still stored.

If that is not acceptable for what you need to send (and for some requests it reasonably will not be), say only that you would like to be contacted, and the rest can be arranged another way.

Booking a meeting

An administrator of Batchly, or a host an administrator has added, can publish a booking page at an address like batch-ly.com/meet/<name>, usually linked from their email signature, so people can pick a time to meet them. Anyone with the link can use it, with or without a Batchly account. The page shows the host's name, picture, meeting details and free times; it never shows what fills the rest of their calendar.

When you book a meeting, this is what is collected and where it goes:

• What you type: your name, your email address and, if you write one, a note for the host. Your browser's time zone is sent too, so the host can see when the meeting falls for you.
• Stored by Batchly: those details, with the meeting's time and status; a keyed hash of your network (IP) address; and a hash of the private code in your reschedule-or-cancel link. The address hash is used only to stop one connection booking many meetings in a day, and it cannot be turned back into your address without a key that only Batchly's server holds. If you cancel and give a reason, the reason is stored as well. Bookings are not attached to a Batchly account, even if you were signed in when you booked.
• Sent to Google: the meeting is created as an event on the host's Google Calendar, with you added as a guest. The event's title names you, and its description carries your note and your reschedule-or-cancel link. Google, not Batchly, then emails you the invitation, and any later change or cancellation, from the host's calendar. From there the event is held in the host's Google account under Google's own privacy policy, and in yours too if you add it to your calendar.
• Seen by the host: your name, email address, note and time zone, in Batchly's admin panel, in the calendar event, and in a notification sent to their devices when you book, move or cancel.

Nothing from a booking is sent to an AI model. The booking page sets no cookies and records no product events. Like every page on the site, it can record page-speed measurements and, if something breaks, an error report (see Diagnostics), and it saves the site's language setting in your browser. A host can choose to show the picture from their Google sign-in on their page; that picture loads from Google, which sees your IP address when it does.

Copyright notices

Anyone can send a copyright notice, or a counter notice, from the Copyright page, with or without an account. When you do, Batchly stores what you type in the form: your name, email address, postal address and phone number (if you give them), the work, the batch-ly.com addresses, your explanation and your typed signature, plus which version of the sworn statements you ticked. It also stores a keyed hash of your network (IP) address, used only to stop one connection sending a flood of notices; it cannot be turned back into your address without a key only Batchly's server holds, and administrators cannot see it.

• Who sees it. Only the site's administrators can read notices. A new notice raises an alert in their notifications (at most one an hour while the last is unread) that says a notice arrived and how many are open, and nothing of what you wrote. Notices are not sent to an AI model.
• Who it may be passed to. As the Copyright page says, a notice may be sent to the person who uploaded the material, including your name and email address, so they can respond; a counter notice, with the uploader's contact details, is sent to the person who sent the original notice. Notices may also be shared where the law requires it.
• How long it is kept. Notices are kept as the record of what was received and what was done about it. They are not attached to an account, so deleting an account does not remove them; to ask about one, write to the address in Contact.

Diagnostics and error reports

Batchly runs no third-party analytics or tracking SDK: no Google Analytics, no advertising pixel, no Sentry. It does keep four small first-party diagnostic logs, and it is worth being precise about what is in them, because an earlier version of this policy said there was nothing at all.

• Product events. Five events only: arriving on the site, opening a game, copying an embed code, starting a remix, and submitting a report. Each row stores the event name, a small properties object, the page path, and a random per-tab id that is regenerated whenever you open a new tab. There is no account id on these rows, by design. For an arrival, recorded once per tab, the properties say where you came from: the domain of the site whose link you followed (for example reddit.com, never the full address of the page), any campaign tags in the link itself (utm_source, utm_medium and utm_campaign), and, on a browser where a site administrator has signed in, a mark that keeps the operator's own visits out of the counts. Arrivals are not recorded on embedded games or the meeting booking page, or for automated browsers.
• Performance. Page-speed measurements (LCP, INP, CLS, FCP, TTFB) with the page path. No account id, no session id.
• Errors. When something breaks, the error message (up to 2,000 characters), the source, up to 8,000 characters of stack trace, the page path and your browser's User-Agent are recorded, and if you are signed in, your account id is attached. Rapid duplicates are collapsed. This exists so bugs get found and fixed.
• Security reports. If a page tries to load something the site's security policy blocks, your browser sends a report. Batchly keeps the page path, the blocked address, the file and line involved and your browser's User-Agent, with no account id, for 30 days.

The first three are write-only from the browser: the database accepts inserts from anyone and returns rows only to an administrator (security reports arrive through a server function instead). Product events, page-speed measurements and error reports are kept until the operator deletes them; there is no automatic deletion yet. When you delete your account, your account id is removed from any error report, but the report itself is kept.

One thing that is not a log but is worth naming here. So the site can show how many people are on it, your browser joins a shared live channel while you have Batchly open, and announces itself there with a random id made for that tab, whether or not you are signed in. Nothing else is broadcast, nothing is stored, and the channel cannot tell anyone which account is online. (Until 21 October 2026 a signed-in browser announced its account id there.)

Global Privacy Control and Do Not Track. If your browser sends either signal, Batchly records no product events from it at all, arrivals included. The signal does not stop page-speed measurements, error reports, security reports or the online count, which are there to keep the site working.

Abuse limits. So that the email sign-up form, and tip checkout once payments are switched on, cannot be used to send spam or to test stolen cards, Batchly counts recent attempts from each network address (for a signed-in tip, from each account). Only a keyed hash of the address or account is stored, never the address itself. The key changes every day and is deleted after two days, after which nobody, Batchly included, can tell which network or account a count came from, and the counts themselves are deleted after 25 hours. They are kept whatever privacy signal your browser sends, because they exist to stop abuse.

Beyond these, our hosting and CDN providers receive the ordinary request information any website receives: IP address, User-Agent, and the URLs you load.

Who can see what

These are enforced in the database itself with row-level security, not only in the interface. The operator, as the person who runs the database, can technically reach anything stored in it, which is true of every site, and worth saying plainly rather than implying otherwise.

Companies that receive your data

Batchly does not sell your personal information and does not share it for advertising. It relies on a small set of providers, each receiving only what it needs.

• Supabase: the database, authentication and file storage. Everything described in this policy that is stored is stored here, except mail sent to support@batch-ly.com and the standalone OVERCLOCKED high-score board, which AWS stores (see Emailing support). The project is hosted in the United States (AWS us-east-2).
• Amazon Web Services: hosts and delivers the site from S3 and CloudFront, so AWS receives ordinary request data. The app's API also now runs through api.batch-ly.com, a CloudFront distribution in front of the database, so your API requests transit AWS as well. AWS additionally: receives and stores mail sent to support@batch-ly.com (see Emailing support); runs the server-side Python used by certain “Server” Python games, which receives files you upload to those games and your sign-in token; and runs the standalone OVERCLOCKED high-score board (score plus the name you type; no account needed). AWS (Amazon SES) also sends Batchly's own email: subscription confirmations, the weekly digest and announcements if you subscribe, notices about games you submit, and replies to mail sent to support. It receives the recipient address and the message. Batchly's own email is switched off at the moment; sign-up confirmation and password-reset emails come from Supabase's authentication service.
• Google: the identity provider for Sign in with Google; the source of Calendar and Gmail-header data if you connect College Hub to it; the calendar a meeting you book lands on, which receives your name, email address and note and sends you the invitation (see Booking a meeting); the font CDN, which sees your IP and User-Agent when page fonts load; and the operator's personal Gmail, which receives support mail that gets escalated to a person. There is also an admin-only export that can copy account email addresses, display names and join dates, email subscriber addresses, feature ideas and top leaderboard scores to the operator's own private Google Spreadsheet; a copy made there is not removed automatically if you later delete your account. Nothing schedules it (it runs only if an administrator triggers it by hand), and it is disclosed because the capability exists.
• Anthropic: receives the content listed in the AI table for the features that use the Claude API, including workout and nutrition screenshots, and what the operator's AI assistant reads (see AI features).
• Your own AI app (for example Claude, ChatGPT, Cursor or VS Code): not a provider Batchly chooses or has an agreement with. If you connect one through MCP with a College Hub token, it receives what the AI table lists for that row, under its own terms.
• The self-hosted “Spark” model host: a machine owned and run by the operator's family, which the site's servers reach over an encrypted connection with a key only they hold. Receives the AI content listed for the features that route to it.
• Outside services some games use: Shiritori checks each word you play with a public dictionary service (dictionaryapi.dev). Online play in Shiritori, The Arena and Casino Trio connects players through PeerJS's matchmaking server and public connection servers (from Google, Cloudflare and Metered), and the players you connect to can see your IP address. Memeinator loads posts and pictures from Reddit through meme-api.com and allorigins.win. AirPaint downloads its hand-tracking model from Google. Rally Racer Dirt is played inside a page from CrazyGames, which runs under CrazyGames' own privacy policy and may show ads or set cookies.
• Public code libraries (jsDelivr, unpkg, cdnjs and esm.sh): serve code that some games load, including the in-browser Python runtime. They see your IP address and User-Agent when those games load; no account data is sent to them. A community game can also load pictures, sound, video and fonts from any web address its creator chose, and that host sees the same. Community games run walled off from your session and cannot read your account.
• Stripe: not currently receiving anything. Payment features (creator tips and a supporter membership) are built but ship switched off behind a feature flag that is set to off. No payment has been taken and no card data has ever reached Batchly. If that changes, this policy will be updated first, and Stripe would handle card details directly; Batchly would never see or store them. Batchly would keep Stripe's ids for each checkout, customer, subscription or payout account, with its status and dates (for a tip, also who sent it if they were signed in, the creator and game it was for, and the amount), and a log of the payment events Stripe sends: their ids, types and times, with no names or addresses. No time limit has been set yet for keeping that log.
• Legal and safety: information may be disclosed where required by law, or to protect the security and integrity of the site and its users.

Where it lives and how it is protected

Data is held in a Supabase project in the United States, delivered through AWS. Both encrypt data in transit over HTTPS and at rest as part of their managed infrastructure.

Access is enforced at the database level rather than only in the app, so a bug in the interface does not open a door. Concretely: your saves, settings and College Hub data are readable only by your account; the workout rules are exactly as described above; credentials are in a table with no user-facing access at all; and the diagnostic tables accept writes but return nothing to anyone except the operator.

Progress photos and import screenshots are in private storage buckets. A member of the workout group can retrieve another member's photo only when the matching row is one this policy says they can see.

Passwords are never stored or logged in readable form; the authentication provider keeps only a hash.

No online service is completely secure. Batchly is a personal project run by one person, not a company with a security team. That is a real limitation, and it is a reason to think about what you connect. If you would rather not have coursework or health data in one hobbyist's database, use the parts of the site that do not need it.

Keeping, disconnecting and deleting

Account data is kept while your account exists. Feedback is kept while it is useful. What is kept from an email sign-up is described in Email from Batchly. Diagnostic logs are covered in Diagnostics. Provider request logs follow those providers' own retention policies.

Disconnecting is not the same as deleting, so here is exactly what each one does today:

• Disconnecting Canvas deletes the stored token and the whole coursework cache it filled: every course row, every assignment row (including any grades stored under the opt-in above) and the deadlines sync record. Nothing Canvas-derived is left behind. (This is stronger than an earlier version of this page described; the page was behind the code.) Your hand-typed timetable is yours rather than Canvas's, so it stays.
• Disconnecting Google asks Google to revoke the token, deletes every stored Google token field, and deletes the cached calendar list, calendar events and mail rows (sender names, addresses and subject lines included), along with the calendar and mail sync records. One caveat remains: the upstream revoke is best-effort, so if Google does not confirm it, the app says so and tells you to finish the job at myaccount.google.com/permissions. (An earlier version of this page said the mail rows survived a disconnect. They no longer do.)
• Revoking an MCP token stops it reading your College Hub at once. Batchly cannot delete what an AI app has already read through it; that copy is held by the app under its own terms.
• Deleting your account removes your profile and every row keyed to you. That does include all College Hub coursework, calendar and mail rows, the stored Canvas and Google credentials, and every workout, nutrition and sleep record; those all fall with the account automatically. It also erases the files you uploaded: your profile picture, the covers of your community games, feedback screenshots, progress photos and workout or nutrition import screenshots, plus For Claude drops for administrators. The deletion does not go ahead until those files are gone; if some cannot be removed, nothing else is deleted and you are asked to try again. What it does not do, stated because it would otherwise surprise you:
  • Cached copies of public images can linger. Profile pictures and game covers are public, so a copy already held by the delivery network, a browser or a feed reader can take a while to expire after the file itself is erased. The site's public game feed (feed.xml and feed.json) also keeps a published game's title, your display name and its cover link until the site is next rebuilt.
  • Administrators only: files attached to posts on the internal admin message board stay with those posts, which other administrators still use.
  • Mail you sent to support is not removed by deleting your account. Ask and it will be.
  • Error reports stay, with your account id removed from them, and so do the anonymous diagnostic logs, which never carried it.
  • Meetings you booked on someone's booking page are not removed either, because a booking is not attached to an account. Ask and they will be (see Meeting bookings, below).
  • The Google grant is not withdrawn. Deleting the account destroys the stored token, which is also the only thing that could have been used to call Google's revoke endpoint. Remove Batchly at myaccount.google.com/permissions yourself. The same is true of a Canvas token: delete it in Canvas.

Age-question flags are deleted with the account they concern. Copyright notices are kept as a record, as described in Copyright notices.

Meeting bookings are kept after the meeting has happened, and after a cancellation, so the host has a record of them. To have the details of a booking you made deleted, email the address in Contact from the address you booked with; you do not need an account. That deletes Batchly's copy. The event in the host's Google Calendar and the invitation in your inbox are held by Google, and are the host's and yours to remove. If a host's account is deleted, every booking made on their page is deleted with it.

You can delete your account yourself at any time: open Settings, go to Delete account and type DELETE. It removes your uploaded files first and then your data, and it cannot be undone. To ask for deletion by email instead, or for anything above to be removed sooner, write to the address in Contact from your account email.

Your choices

• Do not connect what you do not want stored. This is the strongest control you have. Canvas, Google, the workout tracker and every AI feature are opt-in, and the rest of the site works without them.
• Narrow your mail query. College Hub only fetches what your own Gmail search matches. Make it specific.
• Leave grades off, or turn them off again. Connecting Canvas does not switch grade storage on; that is a separate choice on the Grades card, and switching it back off deletes the scores it had stored rather than hiding them.
• Leave College Hub off your MCP tokens, or tick only the parts you want when you add it, or revoke a token in Settings under MCP access to stop it at once. A token's permissions cannot be widened after it is made, so a token you made for uploading games never starts reading College Hub, and a College Hub token never starts reading a part you left unticked.
• Mark health entries private. Progress photos and nutrition each have a private checkbox at the moment you save them, and it defaults to sharing. Remember that workouts and sets have no private option at all.
• Set an expiry on your Canvas token. The connect form asks for one and suggests 90 days. Canvas will not let you make the token itself weaker, so this is the strongest limit available on it.
• Edit or delete your entries. Anything you entered you can change or remove.
• Access and edit your profile: display name, avatar and bio, on your Profile page.
• Revoke tokens at the source. Delete the token in Canvas; remove Batchly at myaccount.google.com/permissions. Both work whether or not you also disconnect in Batchly.
• Move or cancel a meeting you booked from the link in your invitation, at any time before it starts. Cancelling keeps the record; to have it deleted, ask by email.
• Unsubscribe from Batchly's email with the link in any of its messages, with your mail app's Unsubscribe button, or by writing to the address in Contact.
• Send Global Privacy Control or Do Not Track from your browser, and Batchly records no product events from it (see Diagnostics).
• Delete your account yourself in Settings, or ask for a copy, a correction or a deletion of your data by email.

If you are in the UK, the EU or a similar place

Laws such as the GDPR give you rights over your personal data. Batchly honours them for anyone who asks, wherever they live:

• Access: a copy of the personal data Batchly holds about you, in a form you can reuse.
• Correction of anything that is wrong. Much of it you can change yourself, on your Profile page and inside each feature.
• Deletion: delete your account in Settings, or ask. What deletion covers is in Keeping, disconnecting and deleting.
• Objecting to or limiting a use of your data, and withdrawing consent you gave, for example by disconnecting Canvas or Google, revoking an MCP token, turning notifications off or deleting entries. Withdrawing consent does not undo what was done before it.
• Complaining to your data protection authority (in the UK, the Information Commissioner's Office) if you think Batchly has handled your data wrongly. Telling us first gives us the chance to put it right.

To use any of these, write to the address in Contact from your account's email address, so the request can be matched to the account, or send it as feedback while signed in (feedback can also be read by the operator's AI assistant; see AI features). Batchly aims to answer within one month.

In the terms these laws use, Batchly relies on: providing the service, for your account and the features you use; your consent, for the connections and optional features you switch on and for health data you choose to record; legitimate interests, for keeping the site secure, preventing abuse, checking uploads and fixing errors; and legal obligations, such as handling copyright notices.

Batchly stores data in the United States (see Where it lives), so using it from elsewhere means your data is transferred there.

Cookies and local storage

No tracking or advertising cookies, and in ordinary use the site sets no cookies at all.

Your browser's local storage is used to keep you signed in (your session token), to remember your light/dark choice and which notices you have dismissed, to hold a score captured before you signed up, to keep a list of games you recently played, to hold an unsubmitted game draft you were writing, to keep each game's own saved progress, to keep your language choice and which views you last used, to hold the account id from an invite link you followed until you sign up, and, if you use the sleep log, a copy of the nights you logged on that device (read back only for the account that logged them). On a browser where a site administrator has signed in, it also keeps a mark so that browser's visits are left out of the visitor counts. If the age question was answered under 13 in a browser, local storage keeps the month in which it may be asked again; that month is worked out from the answer, so it says roughly when that person turns 13, but the month and year chosen are not stored, and the note lapses in that month and is then removed. Session storage holds the random per-tab id used by the product events and by the online-count channel, a note that this tab's arrival has already been counted, and, after an age answer of 13 or over, the time it was given, so the sign-up form and a Google sign-up in the same tab do not ask twice. These stay on your device; the session token is sent only to Batchly's own backend. The meeting booking page adds nothing to this list beyond the language setting every page keeps.

Children

Batchly is a general-audience site. Anyone can play games without an account, but accounts are only for people 13 and over, and Batchly does not knowingly collect personal information from children under 13.

When you create an account, Batchly first asks a neutral question: the month and year you were born. Signing in to an account you already have does not ask it. The answer is not stored. If it is 13 or over, your account records only that it confirmed that, and when. If it is under 13, sign-in and sign-up close in that browser, and the browser keeps a note of when the question may be asked again (see Cookies and local storage). An account that has never answered, such as one made before the question existed or one made with Continue with Google from the sign-in form, is asked it once, the next time it uses the site signed in. If an account answers under 13 there, Batchly signs that browser out and flags the account for an administrator, who decides what happens to it; nothing is deleted automatically.

If you are a parent or guardian and believe your child under 13 has an account or has given Batchly personal information, write to the address in Contact and it will be deleted.

Changes to this policy

This policy is updated as the site changes. When it is, the “Last updated” date at the top changes and the new version is posted at this same URL. Significant changes may also be announced on the site. If a change would newly send your data somewhere it does not go today, this page will say so before it happens.

Contact

Questions, data requests, corrections or account deletion: support@batch-ly.com.

Read Emailing support first. Mail to that address is stored, read by an AI model, and may be answered automatically. Privacy, deletion and legal requests are always routed to a person, but they are read by the model on the way there, so do not put anything in that message you would not want processed that way.

Batchly is operated by an individual as a personal project.