Privacy and cookies
Effective date: 20 September 2026
Controller and contact
The controller is Marcin Junikiewicz, acting as a private individual in Poland. Snake AI is a personal, non-commercial project and is not operated as part of a registered business.
For privacy questions or to exercise your rights, email contact@snakeai.app.
Data kept on your device
Your simulation settings and privacy choice are stored in your browser. Population files are saved to and loaded from your device. They are not uploaded to or stored by the server. You can remove local settings through your browser's site-data controls.
The server may also set the essential __Host-snake-antiforgery session cookie to protect browser requests against cross-site request forgery. It is restricted to HTTPS, is not available to JavaScript, is not used for tracking, and expires when the browser session ends. This strictly necessary cookie does not require Analytics consent.
Security and access logs
The hosting system records limited request information to keep the service secure, diagnose failures, and prevent abuse. Logs may contain the time, requested path, response status, browser information such as the browser's user-agent string and accepted languages, and a masked IP address. URL query strings, Cookie headers and the referring address are removed before logging. IPv4 addresses are masked to /24 and IPv6 addresses to /48.
This processing is based on the controller's legitimate interests in operating and securing the service (Article 6(1)(f) GDPR). The active access-log files rotate at 10 MiB and no more than five rotated files are kept. The same sanitized entries are stored in a private logging system on the VPS for up to seven days and are then deleted automatically. Access to that system is restricted to the operator through an encrypted administrative tunnel. OVHcloud receives network and hosting data as the VPS provider.
Separately from those sanitized entries, the server software and the operating system write short-lived operational logs, including the failed connection attempts that the abuse-prevention system reads. These can contain an unmasked IP address. The operating system's journal is limited to 200 MiB and to seven days, after which entries are removed automatically. The web server's own runtime log is held by the container system and bounded by size, keeping at most five files of 10 MiB. Both are readable only by the operator on the server, and neither is used for tracking.
Optional Google Analytics
Google Analytics is off by default. No Google tag is loaded and no analytics request is sent unless you select Accept. If accepted, Google Analytics uses the _ga and _ga_* first-party cookies to distinguish a browser and maintain a session. This site limits their lifetime to 60 days.
The app sends a page view and coarse events concerning app readiness, training controls, save/load success, solved milestones, and limited error or training summaries. It does not send population files, filenames, free text, full error messages, account data, advertising identifiers, or an app-level user ID. Google Signals and ad-personalisation signals are disabled in the site's tag.
The purpose is to understand aggregate use and improve Snake AI. The legal basis is your consent (Article 6(1)(a) GDPR). You may reject analytics without losing any app feature and may later withdraw through Manage cookies. Withdrawal stops future app events and removes Analytics cookies accessible to this site; it does not affect processing that occurred before withdrawal.
Analytics recipient, retention, and transfers
Google Ireland Limited provides Google Analytics and may use other Google group companies and subprocessors. Analytics user-level and event-level data is retained for up to two months. Aggregated reports may remain available for longer. Browser blockers and rejected consent mean the reports are necessarily incomplete.
Google may process data outside the European Economic Area. Google describes its safeguards as including adequacy decisions, the EU–US Data Privacy Framework, and Standard Contractual Clauses. See Google's Privacy Policy and data-transfer frameworks.
Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw Analytics consent at any time. Because Snake AI has no accounts and does not send a name or app user ID, it may not always be possible to link Analytics or masked log records to a particular person.
You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or seek a judicial remedy.
Children
Snake AI is a general-audience educational project. It is not designed for or directed specifically at children, does not create user accounts, and does not knowingly collect a child's name or contact details. A child who is not able to give valid consent under applicable law should use the app without optional Analytics or ask a parent or guardian.
Other processing and changes
There are currently no accounts, contact forms, newsletters, advertisements, profiling, or decisions producing legal or similarly significant effects. Material changes to these practices will be reflected here with a new effective date. Any future advertising or materially different data use will require a separate review and, where required, a new consent choice.
The conditions for using the site are set out separately in the terms of use.