Privacy

What this site stores about you, who else can see it, and how to get rid of it.

Last updated October 25, 2026

The short version: an account needs an email address, a vote is recorded against that account so you cannot vote twice, and nothing here is sold, shared with advertisers, or used to follow you around other websites. You can delete your account from your own profile page. Personal data is removed and advertising payment history is retained, as explained below. The creator videos come from YouTube, through the YouTube API Services, and have their own section.

Who is responsible

This site is operated by Simulayte LLC. For anything on this page, including a request to see or delete what is held about you, write to support@slopranks.com.

What is collected

If you make an account: your email address, the handle you choose, and the display name and bio you write. The handle, display name and bio are public — they appear on your profile page and beside anything you submit. Your email address is not public and appears nowhere on the site.

If you sign in with Google: Google sends us your email address, your name, your Google account id and a link to your Google profile picture, and they are stored with your account. The site uses the email address. It does not show your Google name or picture anywhere; your handle and display name are the ones you choose here.

When you use the site: which games you upvoted, which games you submitted, which games you follow, and the collections you make and what you put in them. Votes are recorded against your account rather than anonymously, and that is the point of requiring an account: it is what stops one person voting a game up a hundred times.

If you write to us from the form on /play: your name, your email address and the game you name. It is emailed to our inbox, stored nowhere on the site, and answered with an automatic reply that has nothing you typed in it.

Automatically: the ordinary request information any web server receives — your IP address, the page you asked for, your browser and language. Cloudflare, which serves this site, keeps these briefly to answer requests and to block attacks.

Never: payment details (an advertiser gives those to Stripe directly), your location beyond what an IP address implies, anything from an advertising network, and nothing that follows you to another website.

How visits are counted

Two things send a signal from your browser beyond the pages you ask for.

Cloudflare Web Analytics. Cloudflare adds a small script to each page that reports the visit: the page, the referring site, your browser, and how quickly the page rendered. It sets no cookie and assigns you no identifier, and what we see is totals — page views, referrers, countries, browsers. There is no way for us to look up what one person did. Visits that reach Cloudflare through one of its data centres in the European Union, Iceland, Liechtenstein, Norway, Switzerland or the United Kingdom are not counted: Cloudflare does not process the report for them.

Sponsored rows. When a row marked Sponsored has been at least half on screen for a second, and when you click it, your browser tells our server. What is stored is a running total of views and clicks for that ad for that day, and nothing about you. To avoid counting one person twice, the server holds your IP address in memory until the end of that day and then forgets it. It is never written to the database or passed on.

Neither sets a cookie or stores anything on your device, and neither follows you to another site. Both still run in your browser, so we name them here rather than call them nothing. If we ever add an advertising identifier, a visitor id that survives between sessions, or a third-party analytics script, it will not be switched on without asking you first.

Do Not Track and Global Privacy Control. Nothing here tracks you across other websites, so these signals change nothing about how this site behaves. The companies listed under what your browser fetches from elsewhere act under their own policies, including on these signals.

Cookies and local storage

Every cookie this site sets is strictly necessary: without it the site cannot do something you asked it to do. There are no advertising cookies and no analytics cookies.

  • sr_voter_access

    Type: Cookie

    What it does: Keeps you signed in. HttpOnly, so no script on the page can read it.

    How long: Up to 1 hour

  • sr_voter_refresh

    Type: Cookie

    What it does: Renews the session above without asking for your password again.

    How long: 30 days

  • sr_recovery

    Type: Cookie

    What it does: Marks a session that arrived through a password-reset link, so it can only change the password.

    How long: Until the password is changed

  • sr_advertiser_access

    Type: Cookie

    What it does: The advertiser workspace session, issued separately from the site session.

    How long: Up to 1 hour

  • sr_oauth_pkce

    Type: Cookie

    What it does: Holds the one-time value that proves a Google sign-in came back to the same browser that started it.

    How long: 10 minutes

  • sr_oauth_direct

    Type: Cookie

    What it does: Holds the one-time values that prove a Google sign-in came back to the same browser that started it, and that Google's answer was issued for it.

    How long: 10 minutes

  • sr_auth_error

    Type: Cookie

    What it does: Carries a failed sign-in message across the redirect that caused it, then is cleared.

    How long: One request

  • sr_next

    Type: Cookie

    What it does: Remembers which sign-up page you started on, so the confirmation link or Google brings you back to it.

    How long: Up to 1 day, cleared on return

  • sr_test_user

    Type: Cookie

    What it does: Left over from the pre-launch test period. The site no longer sets it, and deletes it if it finds one.

    How long: Deleted when found

  • sr_admin

    Type: Cookie

    What it does: The admin console session. Only ever set for an operator signing in to the console.

    How long: Session

  • sidebar_state

    Type: Cookie

    What it does: Whether the advertiser workspace's side menu is open or collapsed. Only set if you toggle it there.

    How long: 7 days

  • theme

    Type: Local storage

    What it does: Whether you chose light or dark, so the page is not repainted on every visit.

    How long: Until you clear it

  • friendslop-rank:votes

    Type: Local storage

    What it does: Which games this browser has upvoted, so the arrow lights up. The score itself is one shared counter in the database.

    How long: Until you clear it

  • slopranks:cta-dismissed

    Type: Local storage

    What it does: That you closed the Submit a game bar on a phone, so it does not come back.

    How long: Until you clear it

  • slopranks.advertiser.tracked

    Type: Local storage

    What it does: Up to three games an advertiser chose to watch in the advertiser workspace, as game ids.

    How long: Until you clear it

  • slopranks:dismissed-checkouts

    Type: Local storage

    What it does: Which unfinished advertising checkouts you closed the reminder for, as order ids. The last twenty are kept.

    How long: Until you clear it

Cloudflare also sets __cf_bm and, if it challenges your browser, cf_clearance, in front of the site. Those belong to the network that protects it rather than to us, and they are used to tell a person from a bot. The sign-in form loads Cloudflare Turnstile for the same reason.

Who else sees it

These companies handle data on our behalf. None of them is given anything for their own purposes, and nothing is sold or shared with advertisers.

  • Cloudflare

    What they do: Serves the site, delivers what the site's forms mail to our inbox, and provides the bot check on the sign-in form and the visit counts described below.

    What of yours they see: Your IP address and browser, as any host must to answer a request, and what you write in a form that is mailed to us.

  • Supabase

    What they do: The database and the accounts system. Everything the site stores is stored here.

    What of yours they see: Your email address, your handle and profile text, and the games you voted for or submitted.

  • Google

    What they do: Signs you in, only if you choose Continue with Google.

    What of yours they see: That you signed in here. Google sends us your email address, your name, your Google account id and a link to your profile picture; the site uses only the email.

  • Resend

    What they do: Sends confirmation and password-reset email.

    What of yours they see: Your email address, and the contents of those messages.

  • Stripe

    What they do: Takes payment for advertising. Not used anywhere a reader goes.

    What of yours they see: An advertiser's billing details, which are given to Stripe directly and are never stored by us.

Beyond those, information is handed over only if the law requires it. Game data — titles, art, prices, release dates, announcements — travels the other way: it is fetched from Steam by the server, and nothing about you goes with the request.

YouTube is the one source that has a section of its own, below.

What your browser fetches from elsewhere

A page here shows game art, creator avatars and stream thumbnails. Some of it we hold ourselves — Steam’s art is resized and stored on our own servers, in the United States, which is both faster and fewer requests out. The rest your browser fetches directly from the platform that hosts it, and those requests carry your IP address, your browser and the page you were on to a company we have no arrangement with on your behalf.

We cannot avoid this and still show the pictures, and we would rather name it than let a count of our own suppliers imply it is not happening.

  • Valve (Steam)

    Where from: *.steamstatic.com

    What it is: Game art, screenshots and announcement banners, where we do not already hold a resized copy.

  • Google (YouTube)

    Where from: yt3.ggpht.com, i.ytimg.com

    What it is: Creator pictures beside 'Played by', and video thumbnails under 'People playing it'.

  • Twitch (Amazon)

    Where from: static-cdn.jtvnw.net

    What it is: Thumbnails for streams that are live right now.

YouTube

The creators shown beside a game — the “Played by” faces and the “People playing it” videos — are found through the YouTube API Services. Using those parts of the site means YouTube’s own Terms of Service apply, and Google handles what it receives under the Google Privacy Policy.

What we get from YouTube. Our server searches YouTube for public videos of each game. For each video it keeps the video’s id, title, publication date, length, view count, language and tags, the first 300 characters of its description and which Steam games that description links to, and the address of its thumbnail. For the channel that posted it, it keeps the channel’s id, name, picture address and subscriber count. All of it is public on YouTube already. None of it is about you as a visitor: this site never asks for access to your YouTube account and reads nothing about you from YouTube.

How it is used. To decide whether a video is really about the game it was found for, to order the videos and creators by their view and subscriber counts, and to show them with a link to each video on YouTube. The decision is made by our own code — the title has to name the game, and a Steam link in the description counts as proof — and, for the videos that code cannot settle, by an AI model run for us on Cloudflare, which is given the video’s title. It is not used for advertising, not used to build a profile of anyone, and not combined with anything we hold about visitors.

Who it is shared with. Internally, the people who run this site can see it, in order to check and correct it. Externally, it is shown publicly on the site, and it is stored by Supabase and served by Cloudflare on our behalf, as described under who else sees it. It is not sold, and not given to advertisers or to anyone else.

Content from others, and what is stored on your device. Thumbnails and channel pictures load in your browser straight from YouTube’s servers, and game art from Steam’s, as the table above says. The only advertising here is the Sponsored row, which advertisers book with us directly; no ad network serves anything on this site. What the site stores on your device is listed under cookies and local storage, and none of it comes from YouTube.

How long it is kept. No longer than thirty days at a time. Within thirty days of being fetched, every video and channel record is fetched from YouTube again or deleted, so what the site shows stays in step with YouTube.

Removing this site’s access to your Google account. Signing in with Google asks Google only for your basic profile — your name, email address and picture — and never for access to YouTube. No Google access token is kept afterwards, so the site cannot act on your Google account at all. You can still revoke the permission you gave at any time, from Google’s security settings at myaccount.google.com/connections: find this site in the list and remove its access. Google will ask for the permission again if you ever sign in here with Google. It does not delete the account you already have. To delete that, and everything stored with it, use the delete button at the foot of your own profile page, which takes effect immediately, or write to support@slopranks.com.

If you are a creator. If videos from your channel appear here and you would like them removed, write to support@slopranks.com with your channel’s address. Everything stored about your channel is deleted within seven days. We keep your channel’s id and nothing else, so that none of its videos are stored again. This removes our copy only: nothing on YouTube changes.

Questions or complaints about how this site uses YouTube data go to the same address.

How long it is kept

Account details are kept while the account exists. Deleting your account removes the account, your profile, your ballots, what you follow, your pitches and every collection you made, public ones included. A submitted game stays in the catalog, because the catalog is a record of what exists rather than of who told us about it, but it stops being attributed to you.

A message from the form on /play also reaches us as email. That copy stays in our inbox until you ask us to delete it, which you can do at any time.

Advertising orders and payment history are retained with account ownership removed. Deleting your account does not cancel or refund an order.

Server logs are held by Cloudflare, and delivery records for confirmation and password-reset mail by Resend; both keep them to their own retention schedules rather than to one we set, and both are linked above. If a breach ever exposed personal information about an Illinois resident, the Personal Information Protection Act (815 ILCS 530) requires us to tell the people affected without unreasonable delay, and we would.

Your rights

You can see, correct or delete what is held about you, from your own profile page — the account menu in the header is the way to it. The display name and the bio are edited where they are printed, and deletion takes effect immediately rather than going into a queue. There is no self-service export: ask and a copy will be sent to you by hand, in a format a machine can read. You can also ask us to stop using your data while a question about it is settled. If something is not covered there, ask at support@slopranks.com and it will be dealt with within thirty days.

The database that holds your account is in the United States. The companies listed above may also process your data wherever they operate.

If you are in the UK or the EU, the lawful bases are: performing the contract you entered when you made an account, and a legitimate interest in keeping the leaderboard honest and the site standing up. You may object to the second, and you may complain to your national data protection authority.

If you are in California: no personal information is sold or shared, as those terms are defined by the CCPA, and none has been in the past twelve months. You are not treated differently for exercising any of these rights.

Children

The site is not aimed at children under 13 and accounts are not knowingly created for them. If you believe a child has made an account, write to support@slopranks.com and it will be removed.

Changes to this page

When this document changes, the date at the top changes with it. A change that affects what is collected or who sees it will be announced on the site rather than made quietly.

The terms of use cover the rest: what the site is, what you can do with it, and where its game data comes from.