The short version: you can play without giving us a name, email address, birthday, social login, location, or payment card. We do not use behavioral advertising or third-party analytics. The beta creates an anonymous game identifier so progress can be saved, and you may choose to send feedback.
Who operates Cereal Spillers
Cereal Spillers is a game owned and operated by Summit Fire Marketing. Questions and privacy requests can be sent to hello@cerealspillers.com.
Information used by the public beta
Game saves and anonymous identity
When the game starts, it creates a random guest identifier and session credential. The credential is stored in the game’s local browser storage and is also represented on our server by a security hash. This lets the game load and synchronize progress without asking for a name or email address.
A save may include completed cases, stars, unlocked content, selected partner, tutorials seen, settings, earned coins and spoons, booster inventory, active-case progress, and aggregated play results such as attempts, wins, exits, moves used, objective shortfalls, and booster use. This information is used to operate the game, restore progress, balance cases, prevent save conflicts, and troubleshoot problems. We do not store a replay of each move or the board history, and internal balance reports hide cases until multiple anonymous players have contributed results.
Optional email sign-in and recovery
Cereal Spillers is intended for players age 13 and older. You must confirm that you are at least 13 before requesting an email code. You can play as a guest without giving an email, but real-money purchases require a linked account. We use an address you enter to send an eight-digit, single-use sign-in code through our hosting provider. Codes expire after 10 minutes and permit no more than five guesses. This is not a marketing signup.
The account database stores a keyed security hash of the normalized email address, its associated player identifier, the verification time, and the age-eligibility confirmation version, rather than a birthday or plain-text email address. Our email infrastructure necessarily processes the delivery address and message. Security rate-limit records use keyed hashes rather than raw network addresses. Used codes are invalidated, and expired code challenges and rate-limit records are cleaned up in bounded batches.
Sign in with the same email on another device to load that account's campaign progress and server-owned purchase inventory. An unfinished campaign board remains device-local; Case Race rounds save on the server. Signing into an existing account does not combine it with a different guest's progress. Before switching, the game keeps a recovery copy of the previous save in that device's local game storage. Signing out revokes that device's server session; clearing browser site data removes its local copies. Keep access to your email inbox secure: it controls account recovery.
Case Race multiplayer
Case Race matches two signed-in players asynchronously. We store participating account identifiers, chosen race character and perk, board state, move count, score, and match timestamps to resume rounds and determine results. Your opponent sees a generated detective alias, move progress, and final scores—not your email address or board. There is no public chat, paid entry, or cash prize. Race history is associated with your account; contact us using the account-support details below if you need help with your data.
Optional profile photos and AI safety checks
Signed-in players can choose an optional profile photo when uploads are available. Before uploading, you must confirm permission to use the image and agree to the safety check. We resize and re-encode it to remove original file metadata, then send those image pixels to OpenAI to check suitability for this 13+ game. We do not use this feature to identify people or infer personal traits. See OpenAI’s Privacy Policy.
Only approved photos are made available through a public image link. Unapproved or uncertain images are not published, and their pixels are discarded by our application. AI checks can make mistakes; you can try a different appropriate image or contact support. Approved images remain associated with your account until replaced or removed using Account → Remove profile photo. Removing a photo stops our application from serving it; it cannot remove copies someone else has already saved. We retain the upload time, account reference, and check status for rate limiting and safety support, not the original filename or metadata.
To report an inappropriate profile photo or appeal a photo check, email hello@cerealspillers.com with the photo link or your account-support information. Do not send sign-in codes or sensitive images by email.
Feedback and bug reports
The website feedback form is for players aged 13 and over. A report includes the category, summary, details, and any optional email or case number entered. To help reproduce a bug and control spam, it also sends screen size, pixel ratio, time zone, browser user-agent information, and a one-way privacy hash derived from the network address. We do not store the raw network address in the feedback record, and reports are not posted publicly.
Routine hosting and security data
Our hosting provider may process ordinary web-request data needed to deliver the site, protect it from abuse, diagnose failures, and keep the service secure. This can include a network address, request time, requested page, browser information, and security logs.
What the beta does not currently use
- No targeted or behavioral advertising.
- No sale of personal information.
- No third-party analytics or advertising SDK.
- No camera, microphone, or precise location access.
- No social login, public profile directory, chat, or multiplayer messaging.
- No PlayFab account linking; email accounts use our own backend.
Intended audience
Cereal Spillers is not intended for children under 13. Do not enter an email or request an account if you are under 13. A parent or guardian who believes a child has submitted information may contact hello@cerealspillers.com for assistance. We still treat guest identifiers and other beta data carefully; an age statement does not remove our responsibility to handle data appropriately.
Service providers
Hostinger provides website hosting, database infrastructure, and sign-in email delivery. Stripe processes optional real-money purchases on its hosted checkout. Payment details, checkout contact information, and payment-device or fraud-prevention data are processed by Stripe under its Privacy Policy. Optional email accounts are handled by our own backend, not PlayFab.
Purchase records
Our server stores the account and transaction references, purchased item, payment and delivery status, and records of refunds or disputes. These records support delivery, account recovery, purchase support, fraud prevention, and accounting or legal obligations. We do not store full payment-card numbers or card security codes. Support emails may contain the contact address and receipt information you provide; never send passwords, sign-in codes, or full card details. See Purchases & Refunds for help with an order.
Retention and security
Session credentials are set to expire after a limited period, currently 30 days, although a new session can be issued to the same guest profile. Save, security, support, and feedback records are kept only while reasonably needed for beta operation, support, fraud prevention, legal obligations, or resolving disputes. We use access controls, hashed credentials, encrypted HTTPS connections, and database safeguards designed to protect the information we keep. No system can guarantee perfect security.
Your choices and requests
You may play without submitting feedback. Browser site-data controls can remove the local save and guest credential, but doing so may make existing cloud progress impossible to recover. You or a parent or guardian may request access, correction, or deletion by emailing hello@cerealspillers.com with “Privacy Request” in the subject. Include only enough information to locate the record, such as the approximate play date and device; do not send a child’s sensitive information. We may need to verify the request and may retain limited records when required for security, legal, or transaction-record obligations.
Changes to this notice
We will post changes on this page and update the effective date. A material change to child data practices, accounts, advertising, analytics, or payments will be disclosed before the new practice begins and will use any consent process required by law.