Privacy & support
Updated 8 October 2026Nutmeg Street is operated by Vatsal Upadhyay. For support or requests about your account and saved progress, email vatsal.upadhyay20@gmail.com.
Playing as a guest
Your guest progress and sound preference are saved in this browser. They are tied to this website address and do not automatically follow you to a different browser or device. Clearing this site's browser data removes its local saves.
Signing in and saving progress
Google sign-in provides your Google account identifier, display name and profile picture. The server verifies your sign-in token. Your identifier links your account to saved stars, completed stages, resume stage and save timestamps in Supabase. This lets you restore progress when you sign in on another device. The game does not receive your Google password.
A protected session cookie keeps you signed in for up to seven days. Short-lived login cookies help verify sign-in requests. The browser also keeps a local copy of progress so you can continue if the save connection is temporarily unavailable.
Leaderboard
Only verified Google accounts with at least one saved star appear on the public Neighbourhood leaderboard. Your Google display name, profile picture, total best stars and number of completed stages are visible to other visitors. Your email address, Google account identifier and session details are never included in the public leaderboard. Scores come from your cloud save, including merged guest progress; this is a casual leaderboard, not a verified competition.
Contact support to hide your public profile without deleting your progress. Signing out does not hide an existing entry. Contact support to request deletion of your profile and progress.
Protecting the service
We limit excessive sign-in and save requests. Short-lived, hashed network identifiers help enforce these limits; the game does not store raw IP addresses in its rate-limit table.
Hosting and service providers
The game is hosted through OpenAI Sites, uses Google for sign-in and Supabase for account sessions and cloud saves. These providers process requests needed to run their services, subject to their own privacy policies. No background music or audio recording is used; game sound effects are generated on your device.
Recovery backups
Private daily backups of saved progress and leaderboard profiles are stored in GitHub for up to seven days. They exclude passwords and login sessions and are accessible only to authorized maintainers. Deleted account data may remain in these backups until they expire; deletion requests must also be reapplied if a backup is restored.
Optional game analytics
If you allow analytics, PostHog and Google Analytics receive gameplay events such as tutorial use, shots, stage results and sign-in success, plus browser/device details and limited referral/campaign information. Random browser identifiers help measure repeat visits; we do not send your Google account identifier, name, email, avatar, save contents or sign-in tokens. PostHog uses browser storage; Google Analytics uses first-party cookies configured to expire after 60 days without renewal. PostHog processes data in its US region, and Google may process data on servers in other countries.
Neither tracker loads until you allow it. You can decline or turn analytics off without affecting play or saved progress. We respect Global Privacy Control and Do Not Track. We do not record sessions, keystrokes, audio or the screen. Advertising features and Google signals are disabled. PostHog location enrichment is disabled; Google may derive approximate location from network requests.
Changing browsers or clearing storage can make a returning visitor look new. Turning analytics off stops future collection and removes analytics cookies/storage; it does not erase previously collected reports. PostHog privacy policy · Google privacy policy.
Your choices
Google sign-in is optional. Signing out ends that session but does not delete your cloud save. To request deletion of your stored account profile, sessions and progress, email the support address above from the Google account used to play. We may ask you to verify account ownership before handling the request. Do not send a password or sign-in token.
Cloud progress is retained so it can be restored on later visits, until you request deletion. You can separately remove local copies by clearing this site's browser data on each device.