jellyballTerms of Service

Jelly Ball Privacy Policy

Last Updated: October 31, 2026
Version: 1.2

This Privacy Policy explains how Jellyball LLC (“Company,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use Jelly Ball at jellyball.io (the “Service”). Jelly Ball is open to players of all ages, so this Policy includes a section for parents about children under 13 (Section 3). It is designed to comply with the Children’s Online Privacy Protection Act (COPPA) and applicable US state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), and the Maryland Online Data Privacy Act (MODPA), and, where applicable, the General Data Protection Regulation (GDPR).

Jelly Ball shares accounts and servers with our adults-only site Chideout (chideout.com). When you use chideout.com, the Chideout Privacy Policy applies instead.

1. Information We Collect

A. Playing Without an Account (Guest Players)

  • When you start or join a match or race without signing in, we create a temporary guest player with a random name (such as “Guest 48213”) and a random username. We do not ask guest players for their name, email address, age, or any other contact information.
  • A guest player gets the same session and security cookies and technical data as any visitor (see Sections 1F and 6). We treat every guest player as under 18.
  • A guest player and its data are deleted automatically after 7 days without use.

B. Account & Sign-In Data

  • Email & Password: We confirm your email address with a 6-digit code. We store it encrypted (AES-256-GCM) so we can send account emails (sign-up and password-reset codes and security notices), plus a keyed hash (HMAC-SHA256) to find your account when you sign in. It is never shown to other players. Your password is never stored, only a salted scrypt hash of it. We don’t send marketing email. Emails are delivered by Amazon Web Services (Amazon SES).
  • Date of Birth: We ask for your date of birth when you create an account so we can apply the right protections. If you are 18 or older, we don’t store the date, only that you confirmed you are an adult. If you are under 18, we store your date of birth so the under-18 protections in Section 4 apply automatically. It is never shown to other players.
  • Parent’s Email Address (Under 13): If you are under 13, we ask for a parent or guardian’s email address so we can ask for their permission (see Section 3). We store it encrypted, and only use it to contact your parent about your account.
  • Profile: Your display name, @username, and optional profile photo, banner, and bio. Players under 18 are shown only to their friends (see Section 4).
  • Two-Step Sign-In (Optional): If you turn it on, we store an encrypted secret shared with your authenticator app and hashes of your backup codes.
  • Other Sign-In Methods: If you sign in with or connect another service we offer (such as Snapchat, Reddit, or X), we receive and store that service’s account identifier and display name, and any access tokens are stored encrypted. If you sign in with a phone number, we send a code to that number through Twilio and store only a keyed hash of the number.

C. Gameplay Data

  • Jelly Fights (Matches): the two players, the arena (picture, hoops, and boundaries), the ball or emoji each player throws, match settings (such as weather, weight, point goal, and time limits), every throw (angle, power, direction, and the game’s result), the score, and the winner.
  • Levels & Races: the levels you create (pictures, hazards, checkpoints, title, and finish rule), your runs and race inputs, your best times, and leaderboard positions. Runs are saved as a recording of the buttons you pressed, not as video, so they can be checked for cheating and replayed as “ghosts.”
  • Cred & Bets: your Cred balance and history, and the bets and predictions you make (amount, side, and outcome).
  • Your Ball: if you choose an uploaded picture or your profile photo as your ball, we save that choice.
  • Posts, Comments, Chats & Friends: if you have an account, the posts, comments, and chat messages you send, and your friend list and friend requests.

D. Pictures You Upload

When you upload a picture (for a level, arena, ball, post, chat, or profile), it is re-encoded on your device, and we strip all embedded metadata (including GPS location, camera details, and text comments) again on our server. Before a picture can be used, an AI model (Anthropic’s Claude) checks it for nudity, sexual content involving minors, graphic violence, and readable personal information such as addresses, phone numbers, license plates, or ID cards. The check does not identify people from their faces. When a picture is deleted or removed, a copy is kept for up to 90 days, visible only to our moderators, and then permanently deleted.

E. No Camera, Microphone, or Location

Jelly Ball does not access your camera, microphone, or device location.

F. Technical & Security Data

  • Devices: We record your browser’s user-agent and session times so you can see and sign out of your devices in Account Settings.
  • Network: To protect the game from spam, bots, cheating, and attacks, we use your IP address, but we never store it in readable form. We store only a keyed hash of your network (for IPv6, of the /64 network), and delete it after 30 days. When someone signs up, signs in, or starts playing as a guest, we may check the IP address with a VPN/proxy detection service (proxycheck.io), which receives only the IP address.
  • Browser Token: We set a random identifier for your browser (ch_dev) and store only a keyed hash of it. It is used only to stop banned players from coming back and to spot one person running several accounts, never for advertising.

2. What Other People Can See

  • Public by Design: Published levels, public matches, leaderboards, ghost replays, and live races can be viewed by anyone, including people without an account. Pages and share images for public matches show players’ display names, usernames, and scores, and may appear in search engines.
  • Players Under 18 and Guests: Players under 18 appear only as “Jelly player,” with no username or profile photo, on matches, leaderboards, ghosts, and races. Guest players appear under their random guest name.
  • Private Matches: Matches played inside a private chat can be seen only by the people in that chat. A match you start as private is kept out of public lists, but anyone you share its link with can open it.
  • Level Creators: When you post a level, you are shown by the post’s anonymous label, not by your name.
  • Uploaded Pictures: Pictures used in public levels, arenas, posts, and balls can be viewed by anyone who can see that level, match, or post.

3. Children Under 13 (For Parents)

We take children’s privacy seriously and follow COPPA.

  1. Playing Without an Account: Children can play as guest players without giving us any personal information (see Section 1A).
  2. Parental Permission: When a child under 13 signs up, we ask for a parent or guardian’s email address and send the parent a link explaining what we collect and how it is used. The account stays locked and can’t be used until the parent approves. If the parent declines, or does not answer within 14 days, the account and everything in it are deleted.
  3. What We Collect From Children: the child’s email address, password hash, date of birth, display name, @username, optional profile photo, and the parent’s email address; gameplay data (Section 1C); pictures and messages the child chooses to send; and the technical data in Section 1F. We collect only what is reasonably necessary for the child to play, and we don’t require a child to share more to take part.
  4. How We Use It: only to run the game, keep the account secure, protect players, and meet our legal obligations. We do not sell children’s information, do not show children personalized ads, and do not use it to build advertising profiles.
  5. Protections: Children get all of the under-18 protections in Section 4.
  6. Parents’ Rights: A parent can at any time:
    • ask to review the personal information we hold about their child;
    • withdraw permission and have the account and its information deleted, using the link in the approval email or by emailing us; or
    • ask us to stop collecting their child’s information (which requires deleting the account).
    Email [email protected] from the parent email address on file. We may ask you to confirm you are the child’s parent before we share any information.
  7. Operator Contact: Jellyball LLC, 8700 Baltimore Avenue, Apt 422-A, College Park, MD 20740 · +1 (667) 301-0328 · [email protected].

If you believe a child under 13 has given us personal information without a parent’s permission, please contact us and we will delete it.

4. Protections for Players Under 18

  • Cannot bet Cred or stake Cred in Odds & Bets.
  • Can chat and send direct messages only with friends, and cannot start or join public chats.
  • Hidden from people search, friend suggestions, and contact matching, except to friends or someone who types their exact @username.
  • Profile shown only to friends, people they have a pending friend request with, and people in their private chats.
  • Shown as “Jelly player,” with no username or photo, on matches, leaderboards, ghosts, and races.
  • Cannot use chideout.com.
  • Ads are always non-personalized (see Section 6).

5. How We Use Information

  • to run the game: matches, levels, races, ghosts, leaderboards, Cred, bets, chats, and friends;
  • to check runs and throws on our server so nobody can cheat;
  • to apply age-based protections and parental permission;
  • to keep the Service safe: checking pictures, moderating content, reviewing reports, and preventing spam, cheating, ban evasion, and attacks;
  • to send account emails (sign-up and password-reset codes, security notices, and parent permission requests); and
  • to meet our legal obligations.

For players in places covered by the GDPR, we rely on performance of our contract with you (running the game), our legitimate interest in keeping the Service secure (GDPR Art. 6(1)(f)), consent where we ask for it, and our legal obligations.

6. Cookies & Advertising

We use these first-party cookies to run and secure the Service:

  • ch_sid (HttpOnly, Secure, 30-day rolling expiration): keeps you signed in (or keeps your guest player). Only a hash of it is stored on our server.
  • ch_csrf (30 days): protects against cross-site request forgery.
  • ch_dev (HttpOnly, up to 400 days): the security browser token described in Section 1F.
  • ch_signup (30 minutes), ch_oauth_state (10 minutes), and ch_2fa (5 minutes): used only while you sign up or sign in.
  • ch_appeal (encrypted, 2 hours): set only when a ban stops a sign-in, so you can appeal.

Advertising: Jelly Ball is supported by ads from Google AdSense. An ad labeled “Advertisement” may appear below some screens (such as Explore, Play, and Create, and after a match), and every few games Google may show a short full-screen ad, which can be a video, before you go back to the game menus. Ads never appear on the home screen, inside chats, or while you are playing. On Jelly Ball, we ask Google for non-personalized ads for every player, whatever their age. These ads are not based on your browsing history or profile, but Google may still use cookies, your IP address, and device information to deliver ads, limit how often you see the same ad, measure them, and prevent fraud. Google acts under its own privacy terms. We never give Google your name, email address, age, account details, or what you post. Where the law requires your consent for advertising cookies, we ask for it first.

7. Who We Share Information With

We do not sell personal information or share it for cross-context behavioral advertising. We share information only with service providers that help us run Jelly Ball, each under its own terms:

  • our hosting and database providers (all account, game, and content data);
  • Amazon Web Services (email addresses and the content of account and parent emails, to deliver them through Amazon SES);
  • Anthropic (every uploaded picture, for the safety check in Section 1D, and the text of public posts, comments, and predictions, to find names and identifying details before they are published);
  • proxycheck.io (IP addresses only, for VPN/proxy detection);
  • Google AdSense (device and cookie data, only where ads are shown, as described in Section 6);
  • Twilio (a phone number, only if you sign in with one); and
  • Snapchat, Reddit, X, Twitch, or YouTube, only when you choose to sign in with or connect them, and Stripe, only if you buy a paid feature such as a Reward.

We may also disclose information if required by a valid subpoena, court order, search warrant, or preservation request (18 U.S.C. § 2703(f)), to report suspected child sexual abuse material to the National Center for Missing & Exploited Children (18 U.S.C. § 2258A), or to prevent an imminent threat of death or serious bodily harm.

8. How Long We Keep Information

  • Guest players: deleted after 7 days without use.
  • Accounts of children under 13 that a parent hasn’t approved: deleted after 14 days.
  • Sessions: expire after 30 days without use.
  • Network hashes: deleted after 30 days.
  • Deleted or removed content and pictures: kept in an encrypted safety log, visible only to moderators, for up to 90 days, then permanently deleted.
  • Bans: if an account is banned for serious or repeated violations, we keep keyed hashes (never the readable values) of its email address, phone number, sign-in accounts, and, if a moderator chooses, the browsers and networks it used, so they can’t be used to create a new account. Network blocks expire after at most one year; the rest last as long as the ban.
  • Suspected child sexual abuse material: kept encrypted and accessible only to our safety team for one year, as US law requires of providers that report to NCMEC.
  • Everything else: kept for as long as your account exists.

Deleting your account: When you delete your account (Account Settings → Delete Account), your profile, email address, date of birth, parent’s email address, and sign-in details are deleted, and you can choose to delete your posts or leave them anonymized. Match results, runs, and ghosts that other players took part in or race against may remain, but they are no longer linked to your name.

9. Your Privacy Rights

Depending on where you live, you have the right to:

  • Access: get a copy of the personal information we hold about you. Use Download my data in Account Settings, or email us for a copy that includes your Jelly Ball game data.
  • Correct: fix your profile details in Account Settings, or ask us to correct anything else.
  • Delete: delete your account from Account Settings, or ask us by email.
  • Opt out: we do not sell or share personal information for targeted advertising, so there is nothing to opt out of.

To use any of these rights, use Account Settings or email [email protected]. Parents can use these rights for their children (Section 3). We will not treat you differently for using your rights.

10. Security

We protect information with encryption, keyed hashing, secure cookies, rate limits, and access controls. No system is perfectly secure, so please use a strong, unique password and turn on two-step sign-in.

11. Changes to This Policy

When we change this Policy, we will update the version number and date above, and account holders will be asked to review and accept the new version before they continue. If a change affects how we handle children’s information, we will ask parents for permission again where COPPA requires it.

12. Contact Us

Jellyball LLC
8700 Baltimore Avenue, Apt 422-A, College Park, MD 20740
Phone: +1 (667) 301-0328
Email: [email protected]