Privacy Policy

JackedUp Gaming ("JackedUp Gaming", "we", "us") operates the website and services at jackedupgaming.com, including Majic Realm, a shared open world played in the browser (currently in open beta). This policy explains what we collect, why, and how to control it.

What we collect

• Account data: username, email address, password (hashed with SHA-256), and verification status.
• Payment data: handled by Stripe — we store a Stripe customer id and the last-4 digits of your saved card to label receipts. We never see or store full card numbers.
• Token ledger: every top-up, token spend, and admin grant is logged with a timestamp. (Play time was metered at 1 token / hour before 2026-09-19; those rows remain.)
• Game state: your one persistent character (name, level, points, look and items), the lots, vehicles and other things you own or build in the realm, and, for older accounts, records kept from games we no longer run (XP, hero kit, kills/deaths) - all kept on the platform's Cloudflare D1 database.
• Session cookies: a single random opaque session id stored in a HttpOnly cookie — used only to identify your browser between requests. No third-party tracking cookies.
• Server logs: standard request logs (IP address, user-agent, path) retained 30 days for security + abuse mitigation.
• Avatar pictures: if you upload a picture for your avatar on your account page, your browser crops and shrinks it first, so the photo itself never leaves your device: we receive only a small square, remove any hidden details from it (the camera, the time, the location), and keep only that square. Before anyone else sees it, our own AI model (on our own servers, not a third party's) checks it for nudity, violence, hate and readable personal information; a picture it refuses is deleted at once. You can take your picture off, or replace it, on /account, and it is deleted then too. A child under 13 can use a picture only if a parent has allowed it, and then only family can see it.

What we do NOT collect

• We do not run third-party analytics (no Google Analytics, no Facebook Pixel, no advertising trackers).
• We do not sell, rent, or share personal data with advertisers.
• We do not access your Gmail or Google account beyond what you explicitly authorize via OAuth — see "Google APIs" below.

Google APIs (the JackedUp Gaming OAuth app)

We no longer read any mailbox: the old feature that imported avatar pictures emailed to a designated address is gone, and avatars are uploaded on your account page instead. We never had access to your own Gmail or Google account. If our site's own Gmail account is used to send you the site's mail (for example, a confirmation link), only that sending is done through Google.

Google's privacy policy applies to data Google holds about you. We are bound by Google's API Services User Data Policy including the Limited Use requirements: nothing obtained through Google's APIs is used for ads, sold or shared.

GIFs and memes in the Realm's chat (GIPHY)

The Realm's chat can show GIFs from GIPHY. When you search for one, your search words go to our server, which asks GIPHY for G-rated results on your behalf. GIPHY is told the words and your country (worked out from your connection), never your account, name or email. We keep no record of what you searched: we count your searches for a minute to stop floods, and we remember which GIFs we offered for one day, so a GIF can be checked when someone sends it.

The GIF pictures themselves load in your browser straight from GIPHY's servers, as GIPHY's terms require - so, as with any picture from another website, GIPHY receives your IP address and browser details when a GIF is shown to you (we send it no referrer). GIPHY's privacy policy applies to that. You can switch GIFs off for your device in the game's Settings (Chat → Show GIFs); then nothing is loaded from GIPHY at all.

Memes are drawn in your browser from our own pictures and your words; nothing is uploaded. A GIF or meme you send is handled like any chat line: the words are filtered, and the last few lines are kept briefly so that a report has context.

How we use your data

• Run Majic Realm and the site — character persistence, points and tokens, items, lots and what you build.
• Process payments and credit token purchases (via Stripe).
• Send transactional email (account verification, receipt confirmations) via Resend.
• Enforce community rules and detect abuse / cheating.

Your controls

• Update or delete your account: contact Jacksonmilesmorris@gmail.com. Account deletion wipes the row from our Players table and unlinks your character + inventory; payment records are retained as required by law (typically 7 years).
• Revoke Google OAuth: Google Account → Third-party access → remove "JackedUp Gaming". Effective immediately on Google's end.
• Manage your saved card: log in, go to /account, and remove the saved payment method.

Data retention

• Active accounts: data retained while the account is active.
• Inactive accounts (no login for 24 months): we may delete the row.
• Payment + ledger records: retained 7 years for tax/audit compliance.
• Server logs: 30 days.

Kids under 13

This part was last updated 2026-09-25. Majic Realm is a family-friendly world, and kids under 13 can play with a parent's or legal guardian's consent. Here is exactly how we handle their information.

Who we are. JackedUp Gaming · 603 Seib Dr, O'Fallon, MO 63366 · (636) 224-8192. Email: Jacksonmilesmorris@gmail.com. We are the only operator collecting information from kids on this site.

Before a parent says yes. Sign-up asks for a month and year of birth, and nothing else, before we know a player's age. For a player under 13 we then ask only for a username and password and a parent's email address. We use the parent's email only to ask for consent. The account can't play, chat or upload anything until a parent consents, and if no parent does within 14 days we delete the parent's email address, the username and the account.

How a parent consents. From their own account, in one of two ways. A quick check of a credit or debit card in the parent's name through Stripe (we charge a small amount and refund it right away; prepaid cards can't be used): we never see the card number, and we keep only Stripe's reference for the check as our record of consent. Or a consent form the parent prints, signs and uploads as a photo or scan: one of our team checks it, we keep the file privately and delete it 14 days after we decide, and we keep only a note of the decision as our record of consent.

What we collect after consent, and why.

• The username and password, to sign in; a character name the child chooses; and what they do in the game (level, points, items, pets, lots, where they left off), to run the game and remember their progress.
• An IP address and a sign-in cookie, used only to run the site and keep it secure (support for our internal operations). We do no advertising, no ad tracking and no profiling.
• Only if the parent allows chat: what the child types in the game's chat and posts to the Realm Daily. Other players can see it, so it is made public in the game. For kids under 13, chat lines with an email address, phone number, street address, link or social media handle are blocked, and rude words are starred out. We don't save chat.
• Only if the parent allows uploads: a picture the child uploads to make their avatar.
• Only if the parent allows AI characters: what the child says to the game's AI characters and the in-game helper, so the AI can answer. It isn't saved; a character remembers only a few things from a set list, never what the child said about themselves.
• We never ask a child for more than a game activity needs.

Who we share it with. Other players see the character's name and, if chat is allowed, what the child types. Service providers that help us run the site see information only to do that job: Cloudflare (hosting, the database and email) and Stripe (the parent's card check and any purchases). The game's AI characters run on our own computers, or on AI companies' computers through OpenRouter, set so they keep nothing (zero data retention); a child's words reach them only if the parent allows AI characters. GIFs from GIPHY are switched off for kids under 13. We never sell a child's information and never use it for advertising. A parent can consent to their child playing without allowing chat, uploads or AI characters.

How long we keep it (our data retention policy).

• Waiting for a parent: at most 14 days, then deleted.
• The account and game information: while the account is in use. It is deleted when a parent asks, when a parent takes back their consent, or after 24 months without a sign-in.
• Chat: not saved. The last few lines are held in the game's memory for a short time so a report can be checked; a report keeps those lines for our moderators.
• Server logs with IP addresses: 30 days.
• The consent record (Stripe's reference for the card check, or the note of our decision on a signed form): as long as the account exists. A signed form's photo or scan: 14 days after we decide.

A parent's rights. A parent can, at any time and at no cost, see the information we have about their child (and download it), change it, delete what their child has posted, stop us collecting more, and take back their consent, which deletes the account. All of this is on the parent's Family page, or write to us at Jacksonmilesmorris@gmail.com. If we ever change how we handle kids' information in a way that matters, we will ask the parent again first.

Accounts made before we asked for ages. If your child under 13 already has an account, link it to yours from your Family page and give consent there, or write to us and we will delete it.

Changes to this policy

If we materially change how we handle your data, we will email registered users at least 14 days before the change takes effect and update the "Last updated" date at the top of this page.

Contact

Questions, complaints, GDPR / CCPA / data-deletion requests: Jacksonmilesmorris@gmail.com.