Privacy Policy

What Prism collects about you, why, and the choices you have.

Last updated October 14, 2026

This policy explains what Prism collects about you when you use the Prism website and desktop app, why, who sees it, how long we keep it and the choices you have. We collect what Prism needs to work and to keep you safe, and no more. We don't sell your personal data, and we don't use ad networks or third-party trackers.

1. Who we are

Prism is run by [Company legal name], a Nevada company ("Prism", "we", "us"). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we're the controller of the personal data this policy describes. You can reach us about anything in it at privacy@prism.games. [Confirm: postal address, and whether Prism must appoint representatives in the EU and the UK under Article 27 GDPR.]

Games on Prism are made by their creators, not by us. A game may collect data of its own while you play it, under its creator's privacy terms. This policy covers Prism itself, and the Creator Terms require creators to tell you what their games collect.

2. What we collect

What you give us

Your account: your email address and the display name others see, which doesn't need to be your real name. We make a handle for your profile from your name, or, if you sign up with Discord, from your Discord username; when you sign up that way, you confirm or change both before you start. You may add a profile picture, a short bio and a location, which are up to you. You sign in without a password: with a code we email you, a passkey, or Discord (see "What sign-in providers give us" below). A passkey stays on your device; we keep only its public key, its id and its name, such as "Edge on Windows", which you can change.
What you write and do with others: comments and replies on games, likes, the studios you follow, friend requests and friendships, direct messages and the invites to play in them, messages and reactions in game communities, the communities you join, your status (online, idle, do not disturb or invisible) and any status line you set, and the people you block.
Your library: the games you add and how you play each one, in the app or in the browser.
Reports and appeals: what you report, the reason you pick, and the words of any appeal. When you report a direct message, that one message is shared with our staff; nothing else from the conversation is.
Feedback: what you write when you send feedback or report a bug. Only if you choose to include them, technical details: the page you were on (its path, never its query or contents), the website's and the app's versions, your browser's user agent, language, time zone and theme, your window's size, whether you were online, and up to five of the page's latest errors.
If you publish: your studio, its members, your games' store pages and builds: the files you upload, what our checks found in them, and who uploaded each. An upload started before you sign in is counted against the IP address it came from, which caps what can be uploaded without an account, and is deleted after 24 hours unless you sign in and claim it. We also keep a record of each time you agree to the Creator Terms: your account, the version of the terms, the exact words of the box you checked and their language, the game it covered, the time, whether you used the website or the app and its version, your IP address and your browser's user agent. We keep that record to show what was agreed, which the law and rights holders may ask us to prove.
Messages to us: what you send to our email addresses.

What we collect as you use Prism

Sign-in and sessions: when you sign in, our sign-in service, Ory Kratos, which we run ourselves, starts a session and notes when, and the IP address and browser it started from. It also keeps the sign-in codes it sends, briefly, and when your address was verified.
Activity on Prism (the event log): which games came on screen, where on the page (the For you feed, Home, Explore, search, a game's page, your library, a friend's profile, a community) and in what position, how long a card or page stayed on screen, games you skipped, game pages opened and screenshots looked at, when you started and stopped playing and how long a game took to be playable, games you said you're not interested in, and the actions above, such as likes, comments, library adds, follows, invites and joining a community. Each event notes when it happened, whether it came from the website or the app, the language you use Prism in, the experiment groups you're in (see section 4), and who you are if you're signed in. Without an account, events carry only a random id for that browser tab, which the browser doesn't keep: a new tab or a reload starts a new one.
Playtime and presence: how many minutes you played each game in your library and when you last played it. While you're connected, Prism knows you're online, what you're playing and which voice room you're in; this lives in our servers' memory and isn't stored, but when your last connection closed is.
Voice: while you're in a voice room and not muted, what your microphone picks up goes through our voice server to the others in the room as you speak, and nowhere else. It isn't recorded or stored. The others in the room, and our voice server, see your name and account id while you're there.
Your language, kept on your account so our emails to you are in it.
Prism Points you buy: each purchase, which pack, its price and currency, when, and how it went (paid, pending, failed, cancelled or refunded), with PayPal's reference numbers for the order and the payment, and a record of every Prism Point in and out of your balance. PayPal tells us what happened to a payment; we don't receive your PayPal login, card or bank details.
IP addresses for limits: to stop scripts from flooding Prism, we count how often requests come from your account, your tab or your IP address, briefly and only in memory. These counts aren't stored and are gone within an hour.
Server logs: our servers and hosting providers keep technical logs of requests, which can include IP addresses, for security and to fix problems. [Confirm: log retention period.]

The event log doesn't record your IP address, user agent, screen size, time zone or hardware, and Prism doesn't fingerprint browsers.

You can sign in to Prism with your Discord account. When you do, Discord asks you to let Prism use two of its permissions, "identify" and "email", and with your approval it tells us:

your Discord user ID, which lets us recognize your Discord account when you sign in again;
your Discord username, which we suggest as your display name and handle when you sign up, and show on your account page beside the connection;
the address of your Discord avatar, which we don't keep or show; and
your email address and whether Discord has verified it. We use it to make your account or find the one you already have, and we accept only an address Discord has verified.

Discord also gives our sign-in system a token for your Discord account, which it keeps encrypted with the connection and which we don't use to read anything more from Discord. We don't get your Discord password, your servers, your friends, your messages or anything else you do on Discord. You can disconnect Discord on your account page, as long as you can still sign in another way: disconnecting removes the connection and its token. The Discord user ID and username you signed up with stay on your account's record until you delete your account.

We may add signing in with Google and Apple. If we do, they'll give us the same kinds of information, your account's ID there, your email address and whether they verified it, and the name you go by there if they send one, used in the same ways, and we'll update this policy first.

What Discord, and any other sign-in provider, collects itself is under its own privacy policy.

The desktop app

Other game libraries stay on your device. The app can find games you've installed or own through other launchers, such as Steam, Epic Games, GOG, Ubisoft Connect, Riot Games, Amazon Games, itch.io, Heroic and Lutris, by reading their files on your computer, so it can list and launch them. It never reads their sign-in credentials or tokens, and that list isn't sent to Prism. To show art for a Steam game, your device fetches Steam's public picture for it from Steam, which sees your IP address as it would for any website.
Playtime: the app notes when a game it launched starts and stops, in two small files on your device (play-sessions.json and playing.json), with the id of the account that was signed in when it launched. The Prism page in the app sends that time to your account, using your sign-in; the app itself never holds your sign-in. Time not yet sent waits on the device for up to 30 days. A game launched while nobody is signed in counts for nobody.
Other local data: the games Prism installed and your mod settings and projects stay on your device. If you use an AI coding tool from Prism, such as Claude or Codex, the app runs the copy installed on your computer under your own account with that provider, and what you send it goes to that provider under its terms, not to Prism. Free open-source games the app installs, and the tools it needs to unpack or run them, download from where their projects publish them, such as the projects' own sites, GitHub, GitLab and SourceForge, and from mirrors those projects name, which others run, such as Xonotic's community mirrors and the ones SourceForge sends downloads to. A game can download in parts from several of these sites at once, and each one sees your IP address, as any website would.

What we don't collect

No passwords, no card or bank details (PayPal handles paying), no contacts from your phone or other services, no precise location, and no voice recordings. We don't read your direct messages; see section 5 for the one case where staff see one.

3. How we use it, and on what legal basis

The GDPR asks us to name a legal basis for each use. Where we rely on our legitimate interests, we've weighed them against your rights, and you can object (see section 9).

Running your account and Prism's features: signing you in, your profile, library and playtime, friends, messages, communities, presence, comments and likes, sending sign-in codes, and the desktop app's installs and playtime. Basis: our contract with you (the Terms of Service).
Recommending games and improving Prism: ordering the For you feed and Home's rows, testing changes to how games are picked, and measuring which games people play, so that new games and new creators get a fair chance to be found. Basis: our legitimate interest in making Prism useful and fair to players and creators. [Confirm: whether consent is needed for the event log in the EU.]
Keeping Prism safe: rate limits, preventing abuse, spam and fraud, enforcing blocks, reviewing reports, taking down what breaks the rules, suspending accounts, and keeping a log of each staff decision. Basis: our legitimate interest, and yours and other players', in a safe service; and legal obligations, such as acting on illegal content.
Telling you about decisions: when we act on something of yours, or on something you reported, we tell you why, in Prism and by email, and let you appeal. Basis: legal obligation (the EU Digital Services Act) and our contract with you.
Records of the Creator Terms: to show who agreed to what, and to deal with copyright notices and repeat infringers. Basis: our legitimate interest in establishing and defending legal claims, and legal obligation.
Fixing problems: reading feedback and bug reports, and server logs. Basis: our legitimate interest in a working service. Technical details in feedback are sent only when you choose to include them.
Answering you and meeting the law: replying to your messages and requests, and responding to valid legal requests. Basis: legal obligation, or our legitimate interest in answering you.

We don't send marketing emails. If we ever do, we'll ask first where the law requires it, and every one will let you stop them.

4. Recommendations

Prism picks some of the games you see: the For you feed and the rows Home and Explore open on. If you're signed in, those picks use the games in your library and how much you play them, what your friends play, and what you've said you're not interested in, mixed with popular and new games so new games get seen. As recommendations improve, they'll also learn from the activity in section 2, such as what you look at, play and like. Without an account, you see popular and new games. Search, filters, a game's page and your library aren't personalized.

To improve how games are picked, we sometimes compare two ways of doing it. Your group comes from a calculation on your account id, or a visitor's tab id, so nothing extra is stored, and it's noted on your events. None of this has legal or similarly significant effects on you.

Your choices:

Not interested: in a card's menu, it keeps that game out of what Prism picks for you. It never hides a game from search or its own page.
Delete my activity history: on your account page, it deletes everything the event log holds about you, including what you did before signing in on the same tab, and lets the games you said you're not interested in come back. Your likes, comments, library and friends stay.
Personalized picks: on your account page, you can turn personalization off. The For you feed and the rows Prism picks then show you popular and new games, as they do to someone who isn't signed in, instead of picks based on your library, your playtime, your likes or your friends. Your library, likes and "Not interested" choices stay yours, and you can turn it back on at any time.

Other people on Prism

Everyone, including people who aren't signed in: your name, handle, profile picture, bio, location, when you joined, and your status line; your comments and replies, with your name; and what you write in a community anyone can read. People signed in can see the communities they share with you.
Your friends: whether you're online and your status, what you're playing now, and the games you've played lately with their hours. Choose invisible to appear offline.
The people you message: what you send them.
Communities: anyone who can see a community sees who its members are and who's in its voice rooms. Its owners and developers see the messages reported there, how often and why, but never who reported them.
People you block no longer see your presence or status line, and can't message you or send you friend requests. They aren't told they were blocked.

Creators

Creators see totals for their games, such as how many players they have and how many comments, not which players. They see public comments as everyone does. They never see who reported their game, or that anyone did.

Our staff

A small number of Prism staff review reports, appeals and feedback. Staff see what was reported in its context: a comment with its game, a community message with the few around it, and a direct message alone, as the person who reported it shared it, never the rest of the conversation. Every staff decision is logged.

Service providers

Companies that work for us under contract, and only on our instructions: our hosting and content delivery providers (planned: OVHcloud for servers and Cloudflare in front of the website), and our email provider, which delivers sign-in codes and notices. They may not use your data for their own purposes. [Confirm: final providers, where they host data, and their data processing agreements.]

Sign-in providers

If you choose Discord, signing in goes through Discord, and Discord learns that you signed in to Prism. The same will hold for Google and Apple if we add them.

PayPal

When you buy Prism Points, you pay PayPal, which processes the payment as its own controller under its privacy policy. We send it the purchase, its price and our reference for it; PayPal's buttons on the wallet page load from PayPal, which sees your IP address and your browser as any website would. [Confirm: PayPal's role and terms for Prism's account.]

The law and safety

We disclose personal data when we believe in good faith that the law requires it, such as a valid court order, or that it's needed to protect someone's safety, to stop fraud or abuse, or to defend Prism's rights. Where the law allows, we tell you first.

If Prism changes hands

If Prism is merged, acquired, or sells its assets, personal data may pass to the new owner, who must keep to this policy for the data it receives, and we'll tell you before that happens.

We don't sell personal data, and we don't share it with anyone for advertising, including the cross-context behavioral advertising California's law describes. Prism has no advertising or analytics partners.

6. International transfers

Prism is based in the United States, and our providers may process data in other countries. When we transfer personal data from the EU, the UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, with the UK's addendum, or another mechanism the law recognizes, and add safeguards where needed. You can ask us for a copy.

7. How long we keep it

We keep personal data as long as we need it for the purposes above, and then delete it or keep it only in a form that no longer identifies you.

Your account and what's tied to it, your profile, library, likes, follows, friends, messages, comments, community membership, blocks, reports, notices, appeals and feedback, for as long as you have the account. Deleting your account deletes them, with the exceptions below, 14 days after you ask, unless you sign in again before then. It also deletes your sign-in account, its email address, passkeys and Discord connection, your profile picture and the files you attached to messages. A comment of yours that others replied to stays as a removed comment, without your name or words, so their replies keep their place.
Purchases of Prism Points and the record of your balance, for as long as the law on accounts and taxes asks, even after you delete your account, when they're kept apart from your profile under a record that no longer names you. [Confirm: the retention period.]
Sign-in sessions last 30 days; sign-in codes expire after 15 minutes. [Confirm: how long ended sessions' records are kept.]
The event log: until you delete your activity history or your account, or until the retention period passes. [Confirm: raw event retention period; 180 days is proposed.] Daily totals per game, which count events but not people, are kept longer.
Desktop playtime: time the app hasn't sent waits on your device for up to 30 days. We keep the id of each play session we received for 30 days, to avoid counting it twice.
Links in our emails about a decision work for six months, which is also how long you have to appeal.
Moderation records: the log of staff decisions, including what was taken down and the handle of who it was about, is kept after the account it concerns is deleted, to answer appeals and complaints and to show we acted lawfully. [Confirm: retention period; today it is kept indefinitely.]
Creator Terms records: for the life of the account plus the period in which legal claims can be brought.
Feedback from people who aren't signed in, which names nobody, is kept until it's no longer useful.
Backups may hold deleted data for a short time before they're overwritten. [Confirm: backup retention.]

We may keep data longer when the law requires it or to deal with a dispute, an investigation or a legal claim.

8. Security

We protect your data with measures that fit the risk. Prism has no passwords to steal: you sign in with a passkey, a provider, or a code that expires in 15 minutes. Connections are encrypted, links in our emails are stored only as a hash, staff access is a role few people hold, and every staff decision is logged. The desktop app never holds your sign-in. No system is perfectly secure, though. If a breach affects your personal data, we'll tell you and the authorities as the law requires.

9. Your rights and choices

On Prism, at any time, you can:

change your name and email address, and add, rename or remove passkeys and connected sign-in accounts, on your account page;
delete your activity history, on your account page;
edit or delete your comments and direct messages, and delete your community messages;
see and change whom you block, on your account page;
appear offline by choosing invisible, and clear your status line;
remove games from your library, unlike, unfollow and leave communities;
change your profile picture, bio and location, on your profile;
turn personalized picks off, download a copy of your data and delete your account, on your account page.

If you're in the European Economic Area or the UK, and in many other places, you also have the right to:

access the personal data we hold about you and get a copy;
correct it if it's wrong;
delete it, including your whole account;
portability: get the data you gave us in a common, machine-readable format;
object to uses based on our legitimate interests, including personalization;
restrict how we use it while a concern is looked into;
withdraw consent wherever we rely on it, without affecting what came before; and
complain to a data protection authority, such as the one where you live or work, or in the UK the Information Commissioner's Office. We'd like the chance to help first.

You can get a copy of your data and delete your account yourself, on your account page. The copy is a file in a common, machine-readable format (JSON) holding your profile, how you sign in (never a credential itself), and what you've added and done on Prism, including the messages you sent, your purchases and your activity history. Deleting your account signs you out everywhere and waits 14 days, so a mistake can be undone: signing in again before then cancels it. After that, we delete your account as section 7 says.

To use any other right, or if you can't sign in, email privacy@prism.games from the address on your account. We'll confirm it's you, and answer within one month, or tell you if we need longer, as the law allows. We may keep some data when the law lets us, such as the records in section 7, and we'll say so.

10. Privacy rights in US states

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to get a copy, to correct it and to delete it, and to not be treated differently for using these rights. In the last 12 months we collected identifiers (such as your email, name, handle, account id and IP address), activity on Prism, what you write to others, and a location if you add one to your profile, from the sources and for the purposes in sections 2 and 3, and disclosed them only as section 5 says. Your sign-in credentials and the contents of your messages are used only to provide Prism.

We don't sell or share personal information, as California defines those words, and haven't in the last 12 months, so there's nothing to opt out of. We treat a Global Privacy Control signal as an opt-out all the same. We don't knowingly sell or share the personal information of anyone under 16.

Nevada residents: we don't sell covered information under Nevada law (NRS 603A). You may still send us a request not to, at privacy@prism.games, and we'll honor it if that ever changes.

You can get a copy of your data and delete your account yourself on your account page, as section 9 says. To make any other request, email us from your account's address. An authorized agent may ask for you with your signed permission, and we may check it with you. If we turn down a request, you may appeal by replying to our answer; where your state allows, you may then contact its attorney general.

11. Children and teens

You must be at least 13 to have a Prism account, or older where the law where you live sets a higher age to consent to the processing of your personal data. If you're under 18, you need your parent's or guardian's permission. Prism doesn't knowingly collect personal data from children under 13. If we learn we have, we delete it and the account. If you believe a child under 13 has an account, tell us at privacy@prism.games. [Confirm: how sign-up confirms age, and extra protections for teens.]

12. Cookies and storage on your device

Prism uses only cookies it needs to work or that remember a choice you made. None track you across other sites, and there are no advertising or analytics cookies.

Your session (set by Ory Kratos), which keeps you signed in for up to 30 days, and the short-lived cookies that protect signing in from forgery.
Your choices, each kept for about a year: your language (PARAGLIDE_LOCALE) when you pick one, your theme (theme), a collapsed sidebar (sidebar), and your answer to the offer to add a passkey (passkey_offer).
Your time zone (time_zone), so pages show times in yours, and in the desktop app the app's version (prism-app); a year each.

Your browser also keeps a few preferences in its own storage, such as the AI tool you last chose. Because all of these are strictly necessary for a service you asked for, or keep a choice you made, the law doesn't require a consent banner for them, and Prism doesn't show one. If we ever add cookies that aren't necessary, we'll ask first. Clearing cookies signs you out and forgets these choices.

13. Changes

When this policy changes, the date at the top changes. If a change matters to you, such as a new use of your data, we'll tell you by email or in Prism before it applies, and ask for your consent where the law requires it.

14. Contact

Questions, requests and complaints about your privacy go to privacy@prism.games. Our Terms of Service cover using Prism, and the Copyright Policy covers reporting content that infringes your rights.