Privacy Policy

Effective 11 November 2026 · Portfolio & games of Yash Karanjavkar

1. Introduction

This Privacy Policy explains what information Yash Karanjavkar ("I", "me", "us") collects when you visit yashgk.com (the "Website") and play the games on it, and how that information is used and protected.

The Website is a personal design portfolio run by an individual based in India. It includes free learning games: Robot Run, Shadow Swap, Kagaz Karkhana and Every Side Counts. You can play them as a guest or with an optional player account.

This policy is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and follows common international privacy practice. By using the Website or its games, you agree to the practices described here. If you do not agree, please do not use the games.

2. Summary

• No sensitive data. I do not ask for or collect financial, health, government ID, biometric or precise location information.
• What I collect: if you create an account, a username, a password (stored only in scrambled, hashed form), and optionally your name and email. For everyone, I record how the games are played (levels, scores, clicks, time played) and basic browser details.
• Why: to save your game progress, let you continue where you left off, and understand how the games are used so I can improve them.
• Never sold. I do not sell, rent or trade your information. There are no ads, no advertising trackers and no third-party analytics.
• Your choice. You can play as a guest without an account. You can ask me at any time to see, correct or delete your data.

3. Information I collect

I collect only what the games need to work and to save progress. The portfolio pages themselves collect nothing.

Guests are not asked for any personal details. Their activity is linked only to the random browser ID.

IP addresses are not stored in my database. They are briefly used to block repeated wrong-password attempts, and are processed by my hosting providers to deliver the Website (see Section 7).

I do not record what you type anywhere except the sign-up and login form and a game's own name field. I do not record keystrokes, mouse movement or screen recordings.

4. Information I do not collect

I do not ask for, collect or store any sensitive personal data, including:

• Bank, card, UPI or other payment details
• Government identifiers such as Aadhaar, PAN, passport or driving licence numbers
• Health, medical, genetic or biometric information
• Precise location (GPS)
• Phone number, home address or date of birth
• Photos, camera, microphone or contacts
• Caste, religion, political views, sexual orientation or other special categories of data

Please do not enter any of this information into a username, name or in-game name field. If I find that such information was entered, I will delete it.

5. How I use your information

I use your information only for these purposes:

1. Saving your progress so you can continue from the level where you left off, on any device.
2. Running your account: signing you in, keeping you signed in, and showing your stars and progress.
3. Improving the games: seeing which levels are too hard, where players stop, and how long games take. This is the purpose of the gameplay activity record.
4. Keeping the service safe: blocking repeated wrong-password attempts and preventing abuse.
5. Replying to you if you contact me, for example about a deletion request. I will not send newsletters or marketing emails.

I will not misuse your information. In particular, I will not:

• sell, rent, trade or give away your information;
• use it for advertising, or let advertisers or data brokers access it;
• build marketing or behavioural profiles about you;
• use it to make decisions that have legal or similarly significant effects on you;
• use it for any purpose not listed above without first asking for your consent.

6. Your consent

When you open a game, a notice explains what is recorded and asks you to choose how to play. By choosing Log in or sign up or Play as guest, you consent to the processing described in this policy for that choice.

• Guests consent to the recording of gameplay activity and browser details.
• Account holders also consent to the storage of their account details and saved progress.

You can withdraw your consent at any time by emailing me (Section 14). I will then stop processing your data and delete it, except where the law requires me to keep it. Withdrawing consent does not affect processing that already happened.

If you are in the European Union or United Kingdom, the legal basis is your consent and, for keeping the service secure, my legitimate interest in preventing abuse.

7. Who your information is shared with

I am the only person who can see player data. I do not share it with anyone, except the service providers below that are needed to run the Website. They process data on my behalf or to deliver web pages, under their own privacy policies.

I may also disclose information if required by law, a court order or a government authority, or to protect the safety of users or the Website. If that happens, I will share only what is legally required.

8. Cookies and browser storage

The Website does not set cookies and uses no advertising or third-party analytics tools.

The games use your browser's local storage, which stays on your device, to:

• save your game progress and settings, such as sound on or off;
• remember the random browser ID and, if you are logged in, your login token and display name;
• remember for the current browser tab whether you chose to log in or play as a guest.

You can clear this storage at any time in your browser settings. Clearing it removes guest progress on that device and signs you out. Account progress stays safe on the server.

9. How long I keep your information

When you ask me to delete your data, I will delete it from the live database within 30 days. I may keep information longer only if the law requires it.

10. How I protect your information

• Passwords are never stored in readable form. They are salted and hashed, so not even I can see them.
• All connections to the game server use HTTPS encryption.
• Login tokens are stored on the server only in hashed form and expire automatically.
• The admin dashboard that shows player data is protected by a password that only I hold.
• Repeated wrong-password attempts are temporarily blocked.

No method of storing or sending data online is completely secure, so I cannot guarantee absolute security. If a breach affects your personal data, I will tell you and the Data Protection Board of India as the DPDP Act requires.

11. Your rights

You have the right to:

• Access a summary of the personal data I hold about you and how it is used.
• Correct or update inaccurate or incomplete data.
• Erase your data and account.
• Withdraw consent at any time (Section 6).
• Nominate another person to exercise these rights for you if you die or become unable to do so.
• Raise a grievance with me, and if you are not satisfied with my response, complain to the Data Protection Board of India.

To use any of these rights, email me from the address linked to your account, or include your username. Guests should include the random ID shown in their browser's local storage under gt-visitor, if possible. I will reply within 30 days and will not charge a fee.

12. Children

Player accounts are only for people aged 18 or older. Under the DPDP Act, anyone under 18 is a child, and their data needs a parent's or guardian's consent.

Anyone may play the games as a guest. Guests are not asked for any personal details. If you are under 18, please play as a guest and do not create an account. A parent or guardian may create an account for their child and play together.

I do not knowingly create accounts for children, track them or use their data for advertising. If I learn that a child has created an account, I will delete it and its data. Parents can contact me (Section 14) to ask for this.

13. Where your data is stored

The game database is hosted by Cloudflare in its Asia-Pacific region. Because Cloudflare, Vercel and Google run global networks, your data may pass through or be processed in other countries, including the United States. These providers protect data under their own security and privacy commitments. I will not transfer your data to any country that the Government of India restricts under the DPDP Act.

14. Changes and contact

I may update this policy when the games or the law change. The effective date at the top shows the latest version. If a change significantly affects how your data is used, I will show a notice in the games before it takes effect and ask for your consent again where needed.

Contact and Grievance Officer
Yash Karanjavkar
Email: yashgk.iitb@gmail.com
Location: India

I will acknowledge grievances within 7 days and resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.