Privacy Policy

goliathstudios.net, the games it hosts, and the Goliath Rogue app · Last updated 16 October 2026

Goliath Studios is one developer. This policy covers everything that developer publishes: this website, the games you can play in the browser here under /play/, and the Goliath Rogue app on Steam, itch.io and Google Play. None of them has an account, a login or a sign-up, so there is no profile of you sitting in any of it. What differs between them is advertising, and that is most of what follows.

Where this stands today

As of 16 October 2026 the games hosted on this site are still the builds with no advertising code in them. Nothing under /play/ loads Google's ad script yet, because the site has not been approved for Google's H5 Games Ads programme. The advertising described below is what those pages will do when the ad-bearing builds replace them.

We are publishing this now rather than later because a privacy policy has to be right before the thing it describes goes live, not after. When the ad builds go up, the date at the top of this page changes and this section goes away.

The website itself

This site is a folder of static files on Cloudflare. There is no server-side code, no database, no session, no login and no analytics of any kind — no Google Analytics, no Plausible, no pixel, no counter. Nothing records that you were here.

Two third parties are nonetheless involved in loading a page, and both deserve naming:

• Cloudflare serves these files. Like any web host it sees the IP address requesting them, and keeps short-lived operational and security logs. We do not read those logs for anything, and no analytics product is built on them.
• Google Fonts supplies the typefaces. Your browser fetches them from fonts.googleapis.com and fonts.gstatic.com, which means Google sees your IP address and browser when the page loads. Google states it does not use these requests for advertising. We load fonts this way because this site has no build step to bundle them with — that is the honest cost of keeping it that simple, and we would rather write it down than leave you to find it in the network tab.

The games you play here

Each game under /play/ runs entirely in your browser. Once the files have downloaded, no server of ours is involved in playing it — there is nothing for your moves to be sent to.

Your progress is saved on your device, not with us. Each game keeps one key in your browser's localStorage — chomp_save, ricoshield_save, hdd_save, ppp_save, ums_save, depending on the game — holding your unlocks, coins, settings and local high scores. It stays in your browser, it is never uploaded, and we cannot read it. Clearing site data for goliathstudios.net deletes it, which is also the only way to wipe a save and start over.

These games have no account and no online leaderboard here. Some of them are also published on game portals that do run leaderboards; in the copies hosted on this site that feature is simply absent, and the game falls back to a local top ten kept in the same save. Nothing about your play is transmitted anywhere.

Advertising in the browser games

The browser games are free, and advertising is how they pay for themselves. Ads come from Google H5 Games Ads, through Google's Ad Placement API: a page that shows ads loads adsbygoogle.js from pagead2.googlesyndication.com with our publisher ID. There are exactly two kinds of break, and both are deliberate:

• An interstitial — a full-screen ad at a natural pause: after a run ends, between rooms, on a results screen. Never during play, and never in the middle of an attempt you are in the process of losing. We ask Google for no more than one ad per 90 seconds on average.
• A rewarded ad — shown only because you pressed a button that offered you something for it: a handful of coins, a second chance. If you never press it, you never see one.

Game sound is muted while an ad is on screen, and the game pauses underneath it.

What Google does, and what we get

To select, cap and measure an ad, Google's script sets and reads cookies and browser storage on this site, and receives your IP address, your browser and device type, an approximate location derived from that address, which page the ad appeared on, and whether you watched it. If you have a Google account and are signed in, Google may connect the request to it. Google does this as an independent controller under its own policies, not on our instructions:

• How Google uses information from sites or apps that use its services
• How Google uses cookies
• My Ad Center — your own controls over Google's ad personalisation

What reaches us is money and counts. The reports we can see say how many ads were requested, shown and clicked, what they earned, and roughly where in the world and in which game — by day, by country. There is no person in those numbers to drill down to, and no way for us to get from one of them to you.

If you block the script, the games still work. They notice the ad stack never answered and run without it; the rewarded buttons just do not appear. We would rather you saw the ads, but nothing in any game here is locked behind one.

Cookies and local storage

The word "cookie" covers three quite different things on this site, so here they are separately.

• Ours: none. No page of this site sets a cookie of its own. There is nothing to consent to on this page, on the front page, or anywhere that is not a game.
• The games': one localStorage key each, listed above, holding your progress. Not a cookie: it is not attached to requests, not sent to a server, and not visible to us.
• Google's, on game pages that show ads: cookies and storage written by Google's ad script for ad selection, frequency capping and measurement, plus a record of whatever consent choice you made. These are Google's, governed by the policies linked above, and they appear only once an ad script has actually loaded — not before.

Clearing site data for goliathstudios.net in your browser removes all of it at once: game saves and Google's storage together.

There is deliberately no cookie banner on the pages that set no cookies. Asking you to click "accept" on a page that stores nothing would be theatre, and we are not going to add it for the look of the thing.

If you are in the EEA, the UK or Switzerland

To change your mind later: Google's consent message carries its own link for reopening the choice from within the page. Failing that, clearing site data for goliathstudios.net clears the stored choice, and you will be asked again next time you load a game.

The legal basis for the advertising is your consent, which you give or withhold in that dialog. Everything else on this site — serving you a static page, your save file sitting in your own browser — involves no processing by us that needs one.

California and other US states

If you are in California, the CCPA as amended by the CPRA gives you the right to know what is collected about you, to have it deleted, to correct it, and to tell a business not to sell or share your personal information. Colorado, Connecticut, Virginia, Texas, Florida and a growing list of other states now have comparable laws.

We have never sold anyone's personal information for money. But the honest reading of that law is that letting Google set an advertising identifier on a game page so that ads can be personalised counts as sharing for cross-context behavioural advertising — and that is covered whether or not money changes hands for the data itself. So rather than claim an exemption, here is the control.

Do Not Sell or Share My Personal Information

Two routes, and the first one works today whatever we do:

• My Ad Center — turn off personalised advertising for your Google account, or for the browser you are using. This is Google's own control, it applies everywhere Google serves ads, and it does not depend on us having configured anything.
• The opt-out control in the privacy dialog on a game page. Choosing it puts your ad requests into restricted data processing: non-personalised ads only, the same state as refusing consent in Europe.

You can also email goliathstudiossp@gmail.com — but understand what that can and cannot achieve, because we would rather say it than accept a request we cannot act on. We hold nothing about you to delete. There is no account, no row with your name on it, nothing joined to your browser, no file of yours on our side at all. The advertising data that exists sits with Google, and the two controls above are the ones with real effect on it. We do not knowingly process sensitive personal information, and nothing here is used to infer anything about you.

We will not treat you differently for exercising any of this. There is no premium tier to withhold.

Children

These are small, bright, silly games, and we are not going to pretend that means no child will ever find them. So, plainly:

• This site and its games are for a general audience. They are not directed at children, not designed for children, and not listed as children's products anywhere they appear.
• We do not knowingly collect personal information from anyone, of any age, here. There is no account, no name field, no chat, no upload — nothing a player can type that reaches us. There is nothing for a child to hand over.
• Ad requests from this site are not tagged as child-directed. Where Google has consent, it may personalise the ads it serves.
• H5 Games Ads can be told otherwise. A single attribute on a game page — data-tag-for-child-directed-treatment — marks every ad request from it as child-directed, which switches off personalised and remarketing ads for that game entirely. We are not using it, because these games are not children's products and tagging them as such would misdescribe them to Google. If a game published here is ever made for children, it gets that tag before it goes up, and this paragraph changes with it.
• If you are a parent and would rather your child saw no personalised advertising, the Google controls in the two sections above apply to the browser they are playing in, and refusing the European consent dialog has the same effect.
• If you believe a child has given us personal information, email goliathstudiossp@gmail.com and we will delete whatever we have — which we expect, honestly, to be nothing at all.

Goliath Rogue — the app

Everything above is about this website. Goliath Rogue is a game you download and install, it is not one of the games playable on this site, and what it does is different enough to keep separate. It is single-player: no account, no login, no sign-up.

What the game sends

Only when the online leaderboard is active, and only after you have chosen a name for it, the game sends:

• A random player ID — 16 random bytes generated on your device the first time it is needed, stored in your local save. It is not derived from your device, your phone number, your Google account, or an advertising identifier, and it identifies nothing outside this game's leaderboard.
• The name you choose for the leaderboard. You pick it; it is not taken from your device or your Google account. Please do not use your real name — a nickname is the point.
• Run scores — the floor reached, kills, character level, run duration, the floor the run started from, and whether you survived.
• The platform and version of the build you are playing, so scores from different platforms can be told apart.

This is sent over HTTPS to a leaderboard service operated by Goliath Studios on Cloudflare Workers. It is used for one thing: showing the leaderboard and the number of players recently online.

Advertising — Google Play version only

The version of Goliath Rogue distributed on Google Play is free and supported by advertising. It shows occasional full-screen ads at natural breaks in play — after a run ends, or on returning to town — never during a fight and never when you are about to start a floor.

Ads there are supplied by Google AdMob. To select and measure them, Google's advertising SDK accesses your device's advertising ID (a resettable identifier Android provides for this purpose) together with technical information such as your device type, coarse region and language, and sends it to Google. That data is collected and shared with Google, and Google processes it as an independent controller under its own policies:

• How Google uses information from sites or apps that use its services
• AdMob and advertising ID

Because this uses the advertising ID, the Google Play build declares the com.google.android.gms.permission.AD_ID permission. Goliath Studios does not receive, store or see the advertising ID itself — it never reaches our leaderboard service, and it is never joined to your leaderboard name or player ID.

Only the Google Play build of the app shows ads. The Steam and itch.io downloads contain no advertising code and never touch an advertising ID, and neither do Goliath Rogue's browser builds on the portals that carry it.

What the game does not send

• The crash log stays on your device. The game keeps a local diagnostic log that can include technical details about your hardware. It is never uploaded, automatically or otherwise.
• No contacts, photos, location, microphone or camera. The game requests none of these permissions. It requests internet access, for the leaderboard and — on Google Play only — the advertising ID permission described above. Nothing else.
• No analytics SDK. There is no analytics, attribution, crash-reporting or telemetry SDK in any version of the app. Outside the Google Play build's advertising, nothing about your play is shared with any third party.
• Your leaderboard identity is never linked to advertising. The random player ID and the name you choose are used for the leaderboard and nothing else.

Seven counters, and nothing that points at you

Goliath Rogue's browser builds send a handful of anonymous counters to our own server — the same one that runs the leaderboard — so we can see where the game loses people. There are seven of them in total: the start screen was shown, it opened without our host's code loading, it was clicked, a floor was reached, a first run ended, the town was reached, floor 5 was reached.

Each one is a number, not an event about you. No player ID, no name, no session, no address and no device details are sent with them, and nothing is stored per player: the server keeps one running total per day, and a counter going up by one cannot be traced back to whose play moved it. Each is sent at most once per session. Nothing is shared with a third party, and the downloadable and Steam versions send none of it.

We added this because a bug that made the town unreachable after your first run was live for two weeks before a player told us. Counting how many people get back to town would have shown it the same day.

Playing without sending anything

The leaderboard prompt offers "Just looking". Choosing it means you can read the leaderboard forever and never write to it — no name, no scores, no ID are uploaded. Your runs are still recorded locally on your own device. The whole game is playable this way.

Data stored on your device

Your progress, settings, local score history and the diagnostic log are stored in the app's private storage. Uninstalling the game deletes all of it, and it is not backed up to your Google account.

Children, in the app

Goliath Rogue is not directed at children under 13 and we do not knowingly collect information from them. Its ad requests are not tagged as child-directed, and the game is rated accordingly on the stores that carry it.

Retention and deletion

The website and the browser games: we hold nothing to retain. No account, no identifier, no log we read, nothing joined to your browser. Your saves are in your own browser and you can delete them yourself by clearing site data for goliathstudios.net.

The app's leaderboard: entries are kept until they are removed. To have yours deleted, email goliathstudiossp@gmail.com with the name you used on the board and we will remove it. Because the game has no accounts, that name is the only way we can find your row — if you never set one, there is nothing of yours stored to delete.

Advertising data is a separate matter, because we never hold it. It sits with Google, and it is governed by their retention policies and your Google account controls — see My Ad Center, or reset the identifier entirely in Android Settings → Privacy → Ads. Emailing us cannot delete it, and we would rather say so than imply otherwise.

Changes

This policy is updated before a release that changes what is collected, not after. The date at the top is when it last changed. Advertising on this website was written into it on 16 October 2026, ahead of the ad-bearing game builds it describes; the app's advertising was added in the first Google Play release, and every earlier version of the app, and every version of it outside Google Play, contains none of it.

Contact

Goliath Studios — goliathstudiossp@gmail.com. One developer reads it. Questions about any of the above, including a request under any of the laws named here, go to the same address.