Keeping player data safe

Play this lesson

Data is a responsibility

Once a game sends data to a server, the studio looks after real people's information, and many of our players are your age. Collecting only what you need is called data minimisation.

Bolt says: Superintelligent Game Studios follows this rule too. It has no accounts at all, and your progress is stored only in your own browser on your own device.

Privacy pick

players/k3P9xQ2m
{  nickname: "SproutBoss",  wave: 12,  seeds: 340,  sprigHat: "acorn",  homeTown: "Riverside"}

Claude suggested this save card for Garden Defense. Which field should we NOT collect?

  1. Line 2: nickname
  2. Line 3: wave
  3. Line 5: sprigHat
  4. Line 6: homeTown
Show the answer

Line 6: homeTown

The game needs the nickname, wave and hat to load your garden. A home town says where a real child lives and does nothing for the game, so we leave it out.

COPPA: the US law for under-13s

In the US, COPPA (the Children's Online Privacy Protection Act) protects children under 13. Before an app collects their personal information, it must get verifiable parental consent: real proof that a parent agreed.

Personal information is wider than you might think: names, addresses, email, photos, voice recordings, exact location, and even device IDs used to track someone across apps. The US Federal Trade Commission (FTC) enforces it. In 2022, Epic Games agreed to pay US$275 million over COPPA problems in Fortnite.

The 2025 COPPA update

The FTC updated the COPPA rule in 2025. The changes took effect in June 2025, and apps had until April 2026 to follow them. The big ones for game makers:

Privacy pick

#studio-chat, Remy
Our ad partner wants Garden Defense players' device IDs for personalised ads. Parents already agreed to the game, so that covers it, right?

What is the best reply from the team?

  1. No. Since the 2025 update, sharing kids' data with advertisers needs separate parent consent. Let's use the ad network's child-directed setting and share nothing
  2. Yes, agreeing to the game covers everything
  3. Only if we store the IDs in local storage first
Show the answer

No. Since the 2025 update, sharing kids' data with advertisers needs separate parent consent. Let's use the ad network's child-directed setting and share nothing

Device IDs count as personal information under COPPA, and the 2025 update requires a separate consent to share children's data with advertisers. Ad networks like AdMob have a child-directed setting that turns off personalised ads.

Rules around the world

In Europe, the GDPR says a parent must agree for children under a set age, between 13 and 16 depending on the country. The UK's Children's Code asks for high privacy settings by default for under-18s.

Platforms add rules too. Google and Apple accounts for children under 13 are created and managed by a parent, and the age is higher in some countries. Google Play asks for a Data safety form and Apple for App Privacy details. Laws change, so you and a parent check the latest rules before launch.

Privacy policy and deleting data

A privacy policy is a public page that tells players and parents, in plain words, what data we collect, why, how long we keep it, and who helps us store it, like Firebase. Both stores ask for a link to one.

Parents can ask what we know about their child, and ask us to delete it. Both stores also expect apps that create accounts to offer a way to delete them. So we build it from day one: delete the player's Firestore document and their Firebase account.

Keep secrets out of public code

Some keys are not secret. The Firebase settings in our web game only say which project to talk to, as long as that key is limited to Firebase services. Security Rules, which check every read and write on Firebase's servers, are what protect the data.

But secret keys, like an admin key that can read every save, are passwords for our backend. They skip the Security Rules completely. They never go into the game's code or a GitHub repository, because bots scan public code for leaked keys all the time. Secrets go in a secret store, such as GitHub's secrets settings.

Secret leak

setup.js
const firebaseConfig = {  apiKey: "AIzaSyD4...",  projectId: "garden-defense",};const adminKey = "-----BEGIN PRIVATE KEY-----...";

Kai is about to push this file to our public GitHub repo. Which line leaks a real secret?

  1. Line 2: apiKey
  2. Line 3: projectId
  3. Line 5: adminKey
Show the answer

Line 5: adminKey

Lines 2 and 3 only tell the game which Firebase project to talk to, and Security Rules guard the data. The private admin key on line 5 skips every rule, so it belongs in a secret store.

Trust is part of the game

Collect little, explain it clearly in a privacy policy, ask parents before sharing anything, delete on request, and keep secrets out of public code. That's how players and parents learn to trust a studio.

Next, we protect the studio's own accounts: passwords, two-step logins, phishing and AI agents.

Bolt says: Before adding any new field to a save, ask the team: do we really need this?

Fact-checked 9 October 2026