Privacy policy
Last updated: 14 October 2026
The short version
- Your original photos are deleted as soon as your cartoon characters are made, and never kept longer than 24 hours.
- We use photos only to draw a cartoon. No facial recognition, no face templates, no identifying anyone.
- Games people make have no trackers and set no cookies. They are unlisted and hidden from search engines. Only our own demo games (the ones we link to from become.games) ask to use analytics.
- Analytics on our website (Google Analytics 4 and Microsoft Clarity) run only if you say yes, and you can change your mind any time.
- We never sell your data and we don’t use your photos to train AI.
- You can download your data, or delete your games, characters or whole account, at any time from your account page.
1. Who we are
become.games is a trading style of Polarize Ltd (company no. 12944077, registered in England and Wales, registered office 20-22 Wenlock Road, London, England, N1 7GU). Polarize Ltd is the controller of your personal data and is registered with the Information Commissioner’s Office under registration number ZA825619. Contact us about privacy at hello@become.games.
This policy covers become.games (our website), app.become.games (the game maker) and published games on *.become.games. It applies under the UK GDPR and the Data Protection Act 2018 and, for people in the European Union or European Economic Area, the EU GDPR.
2. What we collect, why, and our lawful basis
| Data | Why | Lawful basis |
|---|---|---|
| Account: Google account ID, email, name, year and month of birth (no day) | Sign you in, check you are 13+ (and 18+ for cheeky mode), contact you about your account | Contract; legitimate interests (keeping younger users safe) |
| Sign-in and security data: session records (a hashed token, sign-in and last-used times, browser type), a hashed id for each browser you sign in from, approximate location at sign-in (city and country from our hosting provider, used only in the alert email and not stored), rate-limit counters | Keep you signed in, let you sign out everywhere, email you when a new device signs in, stop abuse | Contract; legitimate interests (security) |
| Photos you upload, and the time you confirmed you have the right to use them and that everyone in them agreed | Moderate them, find the people and pets in them, and draw cartoon characters | Contract. For other people in the photo: legitimate interests (making the gift you asked for), relying on your confirmation that they agreed |
| A short text description of each person or pet in a photo (for example “short brown hair, glasses, blue T-shirt”, an estimated age group) and where they are in the photo | Draw and redraw a character without keeping the photo; stop characters of children being marked as adults | Contract; legitimate interests (as above, and child safety) |
| Cartoon characters, raw drawings, memory scenes, game settings and text | Build, host and show your games | Contract |
| Orders, credits, Stripe customer ID, the digital content confirmation you tick at checkout (the time, a hashed IP and the exact wording) | Take payment, manage plans and credits, handle refunds and disputes, keep accounts | Contract; legal obligation (tax and accounting); legitimate interests (defending disputes) |
| Partner programme: if you arrived through a partner’s link, which partner referred you, when, and what you later paid (partners only ever see anonymous totals, never who you are). If you ask to join on our affiliates page: your name, email address, where you post, the links you give us and what you tell us about your audience. If you are a partner: your name, contact details, channel, our notes, your link, clicks, referrals, commission and payouts, and your Stripe Connect account ID | Give referred customers their discount, consider applications, work out and pay partners’ commission, and run the programme | Contract (for partners and for your discount, and steps before one for applicants); legitimate interests (running the programme); legal obligation (accounting) |
| Leaderboard entries: nickname, score, time; anti-cheat records with a hashed IP (salted, rotated daily) | Run leaderboards and stop cheating and abuse | Legitimate interests |
| Moderation records: what our automated checks blocked and why, enforcement actions (such as a game being taken down, a warning or a ban, and the reason), and who on our team took them | Keep the service safe, enforce our acceptable use policy, spot repeated or deliberate attempts to get around our filters, review appeals, meet Online Safety Act duties, and establish or defend legal claims | Legal obligation; legitimate interests (keeping people safe and enforcing our terms) |
| If someone tries to make characters from our own pictures (the photo of our team on this site, or the cartoon characters made from it): their account, the time, and the IP address and browser they used. This is kept with the moderation records | Stop our own likenesses being misused, and follow it up if it happens | Legitimate interests (protecting our team and enforcing our terms) |
| Reports about games: the game, the reason, what the reporter wrote and, if they chose to give it, their email address | Review the report and act on it, and reply to the reporter if they asked | Legal obligation; legitimate interests (keeping people safe) |
| Messages you send us, including appeals against moderation decisions: your name, email, topic, message and (if you were signed in) your account | Reply to you, handle your request, and review appeals | Legitimate interests; legal obligation where the message is a data protection request |
| Analytics (GA4) and behaviour data (Clarity) on become.games, the game maker and our own demo games | Understand what works and fix what doesn’t, including which steps people get stuck on | Consent (only if you opt in) |
| Your cookie choices | Remember and prove your consent choices | Legal obligation |
The game maker (app.become.games) does not use analytics or advertising tools. If we ever add analytics there, they will only run if you opt in, just like on this website.
About photos and faces
Photos are used only to draw a cartoon of the people and pets in them. An automated step counts the people and pets in a photo, marks where they are and writes a short description (hair, clothes, glasses, an estimated age group) so you can name each one and we can draw them. We do not use facial recognition, we do not create face templates or any other biometric data that could identify a person, and we never compare faces with other photos or with any database. The photo itself is deleted as soon as the characters are made; what we keep is the cartoon and the short text description.
You may only upload a photo you have the right to use, and only if everyone in it has agreed to be turned into a game character (and, for children, with their parent’s or guardian’s permission). We record when you confirmed this.
3. Who we share data with
We use carefully chosen providers (processors) who act on our instructions under data processing agreements:
| Provider | What for | Data |
|---|---|---|
| Cloudflare | Hosting, storage, databases, email sending and routing, bot protection (Turnstile), security | All service data, including temporary photo uploads |
| OpenAI | Drawing characters; finding and describing the people and pets in a photo; checking the finished drawing; the safety check on uploaded photos. (Text you type is checked by our own filters, on our own servers, and is not sent to OpenAI.) | Photos (temporarily), prompts and the short description of each person or pet. OpenAI does not use API data to train its models by default and may keep it for up to 30 days for abuse monitoring before deleting it |
| Anthropic (not live yet) | Not used today. We may later add an optional helper for writing game text; we will update this policy before it goes live | None today. If launched: only the game text you choose to send |
| Stripe | Payments and subscriptions | Email, payment details (handled by Stripe, never by us), purchase records |
| Stripe (Connect) | Paying partners in our partner programme | Partners only: name, email and the identity and bank details partners give Stripe directly (we never see bank details) |
| Sign-in; Google Tag Manager and Google Analytics 4 on become.games (only with consent) | Sign-in token; analytics data if you opt in | |
| Microsoft | Clarity behaviour analytics (only with consent) | Anonymised interaction data if you opt in |
We may also share data as part of a sale or restructuring of our business, in which case the new owner would have to keep protecting it as this policy describes.
Law enforcement, authorities and safety
Every uploaded photo is checked automatically. If the check flags a photo as possible child sexual exploitation or abuse material, we do not use or show it anywhere and the account is suspended straight away, with its published games taken down. So that we can report it, we keep a fingerprint of the file (a SHA-256 hash), the account and upload details and the result of the check, and we may keep the file itself, encrypted, in separate private storage. Nobody views it, including our own team; only our company’s directors can retrieve it, and only to hand it to the authorities where the law requires. A person on our team then reviews the case and, where the law requires it, reports it to the relevant authorities, such as the UK National Crime Agency or the Internet Watch Foundation, together with the information about the account and upload that the law requires. The encrypted file is deleted 90 days after the case has been reported or closed (sooner if the authorities tell us they no longer need it), and never while the case is still open. The record of the case (fingerprint, account and upload details, report reference) is kept for as long as the law requires.
We may also preserve information and disclose it to law enforcement, regulators or other authorities where we are legally required to do so (for example to comply with a court order or another request we must legally comply with), or where it is necessary to protect someone from serious harm. Our lawful basis is legal obligation or, where it is needed to protect someone’s life or safety, vital interests. When we preserve information for one of these reasons we may keep it for longer than the periods in section 5, for as long as the report, investigation or legal process requires. While a case like this is open, we may not be able to delete the account on request, and we may not be able to tell the account holder about it where the law or the investigation does not allow it.
4. International transfers
Some providers process data outside the UK and the EU, mainly in the USA. Where they do, we use these safeguards:
- UK data: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), or the ICO’s International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.
- EU/EEA data: European Commission adequacy decisions (including the EU-US Data Privacy Framework, where the provider is certified), or the EU Standard Contractual Clauses (SCCs).
You can ask us for a copy of the relevant safeguards.
5. How long we keep it
An automatic clean-up job runs every hour to enforce these limits.
| Data | How long |
|---|---|
| Original photos | Deleted as soon as the characters from the photo are made, and never kept longer than 24 hours (the hourly clean-up deletes any that are left). The only exception is a photo flagged as possible child sexual abuse material, see below |
| Descriptions of the people and pets in a photo, and raw drawings | With the character; deleted when the character is deleted |
| Cartoon characters | Until you delete them or close your account (a plan ending doesn’t delete them) |
| Games (settings and text) | Until you delete the game or close your account; published games stay live on their permanent link whether or not you have a plan. When you delete a game its text is erased straight away; its old addresses stay locked for 90 days so nobody can take them over |
| Account details | Until you delete your account |
| Sign-in sessions | Until you sign out, or 30 days without use |
| Recognised browsers (for new-device sign-in alerts) | 12 months after last use, or when you delete your account |
| Partner referral and commission records | 6 years after the end of the financial year of the last payment they relate to (UK accounting rules). Partners’ CRM notes: until 12 months after the partnership ends. Applications we don’t take up: deleted after 12 months |
| Orders and credit records | 6 years after the end of the financial year they relate to (UK accounting rules); orders are deleted after 7 years |
| Leaderboard entries | For the life of the game; deleted with it |
| Anti-cheat records (hashed IP, single-use run tokens) and rate-limit counters | 24 hours |
| Moderation records (automated blocks and enforcement actions) | 12 months. Records of bans are kept for as long as we need them to stop banned users coming back |
| Warnings and strikes on an account | 12 months from when they were given (they stop counting and are deleted then) |
| Feature restrictions and temporary suspensions | Until they end or are lifted (the record of the action is kept with the moderation records above) |
| A photo flagged as possible child sexual abuse material (encrypted, never shown) | Until the case is reported to the authorities or closed, then 90 days; never deleted while the case is open |
| The record of such a case (file fingerprint, account and upload details, report reference) | As long as the law requires |
| Reports about games | Until the report has been handled, then deleted 12 months after it was made |
| Messages you send us, including appeals | In our email inbox for as long as we need them to deal with your message and any follow-up |
| Information preserved for a legal report or a request from the authorities | As long as the law, the investigation or the legal process requires |
| Analytics | As set with each provider (GA4: 14 months; Clarity: up to 13 months) |
| Your cookie choice | In your browser until you change it or clear your browser storage |
Deleting your account deletes your games, leaderboards, characters (including their cartoon images), any photo still being processed, the descriptions of people in your photos, your sessions and your account details (name, email, Google account ID and birth date). We keep only the order and credit records we must keep by law, with your name and email removed.
6. Games and players
Games people make on *.become.games contain no analytics, no trackers and no cookies, and show no consent banner because there is nothing to consent to. (Our own demo games (the ones we link to from become.games) are the exception: they ask first, exactly like this site.) A game stores the player’s nickname, best score and mute setting in the browser’s local storage on their own device, only because the player asked for it. Leaderboard entries are described above. We count plays anonymously so the game owner can see how popular it is.
When a player saves a new nickname on a leaderboard, the game runs a quick bot check from Cloudflare Turnstile (loaded from challenges.cloudflare.com only at that moment, never during normal play). Turnstile is designed to be privacy-preserving: it looks at technical signals from the browser to tell people from bots, does not use tracking or advertising cookies, and Cloudflare does not use the data to profile or advertise to players. We only receive a yes/no answer.
7. Children
You must be 13 or over to create an account. We do not knowingly create accounts for under-13s: if someone under 13 tries, we store nothing, and if we learn that we have an account for an under-13 we will delete it. Photos of children must only be uploaded by their parent or guardian, or with their parent’s or guardian’s permission. Characters drawn from a photo of a child or teenager can never be marked as adults, and games involving children are always in family mode.
8. Automated decisions and moderation
Our automated checks can block a photo, a line of text or a game address before it is used. Text is checked by our own filters; photos by an automated image-safety check, which also compares the photo with our own pictures (the ones of our team on this site) so that nobody else can make a game from them. It only compares pictures; it does not identify anyone. During our launch period a person on our team also looks at every new character (the cartoon, not your photo, which is already deleted) before a game using it can be published. Taking a game down, giving a warning or strike, restricting or suspending an account, or banning it is decided by a person on our team, using the moderation records described above, with two automatic exceptions: an account is suspended straight away if a photo is flagged as possible child sexual abuse material (a person then reviews the case), and an account that receives a third strike from our team within 12 months is suspended for 14 days. If you think a decision was wrong, you can appeal through our contact form or by emailing us. Where appropriate, a person who was not involved in the original decision will review it.
9. Your rights
Under the UK GDPR (and the EU GDPR if you are in the EU/EEA) you have the right to:
- access a copy of your personal data (use “Download my data” on your account page, or email us);
- have inaccurate data corrected;
- have your data erased (use “Delete my account” on your account page, or email us);
- restrict or object to how we use it (including objecting to processing based on legitimate interests);
- receive your data in a portable format (the download is a machine-readable JSON file);
- withdraw consent at any time (for analytics, use the “Cookie settings” link in the footer);
- not be subject to solely automated decisions with legal or similarly significant effects without human review.
Or email hello@become.games from the address on your account. We reply within one month. It’s free, unless a request is manifestly unfounded or excessive. If you were in a photo someone else uploaded without your agreement, or want your character removed, email us or use the “Report this game” link on the game and we will take it down.
10. Complaints
Please talk to us first. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or call 0303 123 1113. If you live in the EU/EEA you can also complain to the data protection authority in your country.
11. Security
We use encryption in transit, hashed session tokens, strict access controls, signed short-lived upload links, automated security testing and an external penetration test before launch. No system is perfect; if we ever have a breach that puts you at risk we will tell you and the ICO as the law requires.
12. Changes
We will post any changes here and, if they are significant, tell you by email or in the app.