Privacy Policy

Effective Date: October 9, 2026

This Privacy Policy describes how Divine Games, Inc. ("we," "us," or "our"), which operates Blazium Games, collects, uses, and discloses information when you use blazium.games, its game pages on *.blazium.games, the MCP server at mcp.blazium.games, the tools that upload builds and crash reports, and the payment features (together, the "Service").

1. Information We Collect

Information you provide

Account information: username, email address, password (stored as a hash), display name, avatar, and bio.
Uploaded content: game pages, descriptions, images, builds, and changelogs you publish.
Communications: messages you send to our email addresses or through support.
Email verification: when you verify your email, we record the time it was verified.
Authenticator app: if you set one up, we keep its secret encrypted, a hash of each unused recovery code, and the last time step a code was accepted for, so a code cannot be used twice. If you choose to skip it, we record when you skipped.
Legal acceptance: which version of the Terms of Service and this Policy you accepted, and when.
Time zone: the time zone you choose in settings, used to show dates to you.
Password check: when you choose a password, we check it against the Have I Been Pwned list of leaked passwords. Only the first 5 characters of the password's SHA-1 hash are sent; the password and the rest of the hash never leave our servers.
Reviews: whether you enjoyed a game, your quality rating, whether you'd play it with friends, your review text, your playtime when you wrote it, and the developer's reply. Reviews are public on the game's page.
Taste feedback: your "more like this" or "less like this" on a game, used only to recommend games to you.
Bug tickets: the message you send about a game, the build, your operating system and architecture, and any crash dump or log you attach. The game's developers see the ticket and your username; only they and our staff can download attachments.
Reports: when you report a game or page, we keep what you reported, the category and details you give, and, if you are not signed in, the email address you enter so we can follow up.
Friends: friend requests you send and receive, whether they were accepted, and when.
Presence: whether you are online or playing, which game and build, and when you started, while the Blazium Games app or an agent reports it. It expires on its own 10 minutes after the last report. Your friends see it and your recent play unless you turn sharing off.
Game keys: when you redeem a key or gift link, we record which code you redeemed and when. Only a hash of each code is stored. Developers see how many codes were redeemed, not who redeemed them.

Payment information

Card payments go through Stripe Checkout. Your card number and billing address are entered on Stripe's page and kept by Stripe; we never see or store your full card number. We keep the ID Stripe gives your customer record and the IDs of each payment.
Purchases and donations: the game, the price, tax, fees, how you paid, the status (paid, refunded, disputed), and whether an AI agent made the purchase and which one.
Account balance: a ledger of every top-up, purchase, sale, refund, and cash-out on your account.
Tax: Stripe Tax calculates tax from your billing address. For a balance purchase on the website with no billing address on file, your IP address is sent to Stripe Tax to estimate your location.
USDC top-ups (x402): the network, the amount, and the blockchain transaction hash. The paying wallet address is public on the blockchain and can be read from that hash; the payment is checked by Coinbase's x402 facilitator and recorded by Stripe.
Cash-outs (Creators): identity verification, tax details, and bank account details are collected by Stripe Connect, not by us. We keep your Stripe account ID, whether payouts are ready, and each cash-out's amount, fees, and status.
Playtime: how long you have played each game you own and when you last played, when the Blazium Games app reports it while a game runs. We use it for the 2-hour refund rule.
Agent spending settings and approvals: for each AI agent, its spending mode and limit, and each purchase it asked you to approve (the game, amount, and whether you approved or denied it).

Accounts you link

You can link GitHub, X, and Discord at Linked accounts and then use them to log in. For each one we keep the account's user ID and username. We do not keep access tokens. A verified email from GitHub or Discord is compared while you sign in and is not saved on its own. X does not provide an email. We do not copy your name or avatar into your profile.
If the service is already linked, you enter your password, then an authenticator code if you set one up, or an emailed code if you did not. If you have an authenticator, you can also use a recovery code or ask for an emailed code instead. You can send another emailed code 30 seconds after the last one.
If it is not linked and that verified email matches an account, you enter that account's password, then your second step (authenticator, recovery, or emailed code). The account is linked only after both match. Otherwise you choose a username, email, and password, accept the Terms and this Policy, and confirm a code sent to that inbox. The new account is created only after the inbox code matches; you then set up an authenticator app, or skip it (we record that you skipped) and confirm another emailed code.
You can also link Steam. Steam is not used to log in. Steam confirms your Steam ID, and we keep it with your public Steam name. Games that use Steam auth verification (below) can then tell their servers which Blazium Games account you are.
You can unlink an account at any time, and linked accounts are removed when you delete your account. See Permissions & Scopes for the exact scopes.
What we read from each service and the commitments we make about it: GitHub API disclosure, X API disclosure, Discord API disclosure, Steam API disclosure.

Steam games that check sign-ins through us

A developer can turn on Steam auth verification for their game. When you start that game, it sends us a Steam session ticket. We ask Steam who the ticket belongs to and whether that Steam account owns the game, then return a session token to the game.
For each session we keep your Steam ID, the Steam ID of the game's owner if it is borrowed through Family Sharing, your Blazium Games account if you linked Steam, when the token expires, whether it was revoked, and your IP address. The ticket itself is not stored.
The game's developer can check the token from their own servers. They see your Steam ID, whether you own the game, whether Steam reports a VAC ban, and your Blazium Games user ID if you linked Steam.
Developers who import a game from Steam give us their Steamworks Web API key. It is used once and discarded, unless they turn on Steam auth verification, in which case it is stored encrypted and never shown again.

Chat

Messages are not logged. We don't keep transcripts of game chat or IRC. Each channel keeps its last 50 lines for up to one day in the chat servers' memory so people who join can catch up; it is never written to disk and is gone when a server restarts.
Blocked spam: if spam filtering blocks a message, the server's log can record the blocked text and who sent it.
Connections: the chat servers keep a size-capped log of connections (account name, IP address, and time), with no messages, overwritten as it fills.
Chat token: if you create one in Settings, we keep only a hash of it, when you created it, and when it was last used.
Moderation: channel bans, mutes, and chat locks, with who set them, the reason, and when they end. The rules are on Chat Rules.

Information collected automatically

Visit analytics on game pages: a visit session ID, the page path without the query string, clicks and scrolls, whether the device is touch-capable, your browser's user agent, and the country derived from your IP address.
Only if you accept analytics cookies: your IP address, a browser fingerprint (hashes of canvas, font, feature, WebGL, network, and battery characteristics, which involves a request to Google's STUN server), your time zone and language, and Google Analytics.
If you decline, visits are counted by session only. We do not store your IP address or a fingerprint.
Request logs: our servers log requests, including IP address and user agent, to run and secure the Service.
MCP activity log: for each request an AI tool makes with your MCP key or token, the key, the game, the method, the path, and whether it came through the developer or player server. You can read your own log.
Build provenance: for each uploaded build file, which deploy key uploaded it, so a game's developers can see where a build came from.
Crash reports: games built with the Blazium engine can send crash reports when a player agrees. A report contains technical details about the crash, the game version, the device's operating system, and an optional message from the player. It is visible to the game's developers and to our staff.

We do not collect sensitive personal information such as racial or ethnic origin, political opinions, or health data.

2. How We Use Information

To provide the Service: host game pages and builds, run your account, and sign you in.
To process purchases, donations, top-ups, refunds, and cash-outs, collect taxes, and keep your library and balance.
To show game developers analytics and crash reports for their own games.
To detect and prevent fraud, abuse, and security problems.
To answer your messages.
To comply with legal obligations.

We do not sell personal information, use it for advertising, or use it to train AI models.

3. Cookies

Sign-in cookies are always on because the Service needs them. Analytics cookies are only set if you accept them in the cookie banner, and you can change your choice with Cookie settings in the footer. The full list, with lifetimes, is on the Permissions & Scopes page.

Subprocessors: services that host and run the Service for us, listed on Subprocessors. This includes Stripe for payments, tax, and payouts, and Coinbase for checking USDC payments.
Public content: game pages, profiles, and anything else you publish are public.
Game developers: see analytics and crash reports for their own games. For sales, they see the buyer's username, the amount, the date, and the status, never payment details.
Legal requirements: only when a federal or state court of the United States has ordered us to disclose it and the order was properly served, or when a United States statute requires a report, such as a report of child sexual abuse material or a tax information return for payouts. We do not answer subpoenas without a court order, informal requests, or requests from authorities outside the United States. See section 5 of the Terms of Service.
Business transfers: in connection with a merger, acquisition, or asset sale.

5. Retention

Analytics data: 1 year after the date it was gathered, we erase the IP address, user agent, and fingerprint data from visit records. Aggregate visit counts, the country, and page events are kept so developers keep their history.
Sign-in codes: emailed sign-in codes, unfinished linked-account sign-ins, and sign-in handoffs are removed a day after they expire.
Steam game sessions: removed 30 days after the session token expires.
Chat: channel history lasts at most a day in memory. A chat token's hash is removed when you regenerate or revoke it.
Mail delivery records: for each email we send you (the address, the kind of email, and when it was asked for, sent, and accepted by the receiving server), kept for 30 days so we can find delivery problems.
Account data: kept while your account exists.
Payment records: purchases, refunds, the balance ledger, top-ups, and cash-outs are kept for as long as tax, accounting, and anti-fraud laws require, including after your account is deleted.

6. Deleting Your Account

Email [email protected] from the address on your account. We process deletion requests within 30 days.

When we delete an account:

the account is deactivated and removed from the Service, and signing in, MCP keys, deploy keys, and tokens stop working;
your email address is erased from the account, so you can sign up again with it;
game pages you own are taken down, and your admin access to other games is removed;
your linked GitHub, X, Discord, and Steam accounts are unlinked, and Steam game sessions are revoked and no longer name your account.

Some records may be kept in a deactivated state for a limited time, for example so we can restore an account at your request or meet legal obligations. Downloaded content licenses persist. Before you ask for deletion, cash out any available earnings; credit cannot be paid out. Payment records are kept as described in Retention.

7. Your Rights

Access and update: sign in to view and edit your account information.
Data rights: depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, delete, or port your data. Email [email protected] to use them.

We do not knowingly collect data from children under 13. If we find out we have, we will delete it.

8. Data Storage and Security

Data is stored primarily in the United States. International users' data may be transferred to and processed in the US, where privacy laws may differ.
We use reasonable security measures, such as hashed passwords and keys, but no method is 100% secure.

9. Third-Party Links

The Service links to third-party sites and games. We are not responsible for their privacy practices.

10. Changes to This Policy

We may update this Policy. The effective date at the top shows the current version. When it changes, we show you what changed the next time you sign in and ask you to accept it before you continue; until then you can still view your account, sign out, or ask us to delete it. Significant changes will also be announced on the Service or by email.

11. Contact Us

Privacy questions and deletion requests: [email protected]
Everything else: [email protected], or see Support