Plain-language policy
Privacy
Last updated: October 3, 2026
Scoring happens inside the active browser tab. Recordings stay local unless you explicitly choose to share a take with members of a private room.
Local scoring
Raw samples are held in the active tab for scoring and replay, then released when you change rounds or leave. Practice and solo recordings are not uploaded.
Local records
Mode names, numeric scores, timestamps and your selected outfit are stored in localStorage on this device.
Optional score sharing
Submitting a result shares your nickname, numeric scores, mode and date with the community board. It does not share your recording. A daily hash of your network address limits repeated submissions. The board is public; choose a nickname rather than personal information. Hosting providers may retain routine request logs.
Online rooms
New rooms default to public: their room name, code and player count appear in the lobby, and anyone can join while there is space. Choose Private before creating a room to hide it from the lobby; anyone you share its code or invitation with can still join. Do not put personal information in room names. Joining a room shares your nickname, readiness and numeric scores with its members. A fingerprint of the reference audio checks that everyone has the same sounds; it is not derived from your voice. Room state expires after two hours. This tab uses sessionStorage for your private player token and pending numeric result, so you can reconnect after refreshing. Keep your browser session private. Only choosing “Publish my multiplayer result” adds your name and score to the public multiplayer board; published scores remain after the room expires.
Optional first-party growth measurement
Separate from the player profile, a random first-party visit cookie lasts up to 90 days. Its hashed identifier lets us distinguish first visits and later sessions without creating a player just for viewing a page. A session ends after 30 minutes of inactivity. We record a cleaned page path, bounded campaign labels, referring domain, chosen interface language, coarse browser family and named gameplay milestones. We do not store complete referring URLs, arbitrary query strings, voice data or complete User-Agent strings in these growth tables. After gameplay begins, the session may link to your browser player profile. We honor Do Not Track and Global Privacy Control for this optional measurement. Local test events stay in the local development database, not the production database. Server records remain until removed by the operator; cookie expiry does not delete them.
Daily progress and friend challenges
Daily Streak stores completed UTC dates and numeric scores against your browser player profile. Clearing cookies loses access to that progress; it does not erase server records. A friend challenge is public to anyone with its link and contains a sound identifier and saved score, not your player secret, name or recording. Sharing, copying a link, opening it and starting a game are measured separately; a share button click does not prove that a friend played.
Optional private-room take sharing
After a round, you may explicitly agree and press Share this take with friends. This uploads up to 8 seconds as a small WAV to temporary memory in the room’s Cloudflare service. Only active members of that private room can retrieve it, after the round is scored. It is not written to our audio library, D1 database, R2 storage, public leaderboard or analytics. Access expires after five minutes, changing rounds, leaving the room or removing the clip; server restarts may expire it earlier. Cleanup runs on room activity and an expiry alarm. You can remove your own shared take, mute replays, or hide an unwanted take for the whole room. A hidden take cannot be shared again in that round. Playback is never automatic. Recipients may record audio themselves; removal cannot recall audio already received. Do not share personal information, other people’s recordings, or inappropriate material. Public rooms do not support recording uploads, and there is no continuous voice chat. Closing a tab does not itself send a removal request: use Remove or Leave first, or the clip expires automatically.
Browser player profiles and gameplay statistics
Checking a microphone, starting a game or requesting a supporter code creates a first-party browser profile with a random, HttpOnly cookie lasting up to one year. Our database stores a hash of its secret token, not the token itself. Microphone checks store only the game mode, result, day, retry count and a coarse client family such as iOS Safari or desktop Chrome. Repeated checks from the same browser profile, day, mode and result are combined. These statistics do not store a complete User-Agent, microphone recording or derived voice features. A scored run is created only after the microphone check succeeds. We then record run identifiers, modes, selected sound worlds, reference sound identifiers, sound source, start/completion/explicit-exit times, and whether a scored result was shown and its next-sound control was used. These bounded progress events help us distinguish interface friction from deliberate exits without storing voice data or clickstream details. These records help us count browser profiles that actually play, separate from page visits and optional public leaderboard submissions. A browser profile is not a verified person: shared devices, cleared cookies, blocked requests and different browsers affect counts. Local development events are excluded. Records are retained until removed by the operator; there is no automated retention or recovery system yet.
Share reviews and outfit rewards
If you submit a share, we store its URL, your public supporter code, review status, review note and reward entitlement. Only the operator can review submissions; URLs are not published on the game’s leaderboard or automatically fetched by our server. Include the supporter code and both game links in your own accessible post. Do not submit private messages or personal information. Approval unlocks one Supporter outfit on this browser profile. Clearing site data loses access to the profile and reward; it does not delete server-side records. Extra-life share bonuses are a future plan, not an active reward. Daily network-address hashes and counters limit profile creation and URL submissions; raw IP addresses are not stored in these tables. These first-party records are separate from Google Analytics and are not sent as custom GA events.
Website analytics
Our production site uses Google Analytics 4 to understand visits and how the website is used. Google may use cookies and collect page URLs, referring pages, browser and device information, and usage events. We do not add microphone recordings, derived audio features, player nicknames or game scores to our analytics events. Analytics is separate from the optional public leaderboards described above. See how Google uses information from sites that use its services and the Google Analytics browser opt-out add-on.
Advertising and Profit On
The site may show placements from Adsterra and Profit On. Profit On advertising can collect device and browser information, IP address, cookie identifiers and ad interactions to serve and measure ads. Profit On placements load according to the site operator’s advertising configuration. The retired local Profit On display preference is no longer read, and the site does not show a separate Profit On authorization prompt or display switch. This configuration is not stored as a visitor’s consent. Google privacy choices and any applicable Google consent messages remain separate. You can also use browser controls to manage cookies and third-party requests. See Profit On’s privacy policy. Adsterra placements are controlled separately by the site operator.
Third-party advertising cookies and identifiers
Third-party advertising providers, including Google when AdSense ads are enabled, may place and read cookies on your browser, use web beacons, and collect IP addresses or other identifiers as a result of serving ads on this website. These technologies can support ad delivery, frequency limits, fraud prevention and measurement. Google advertising cookies may be associated with Google or DoubleClick domains. Where personalized advertising is enabled with the required consent, Google and its partners may use information from visits to this and other sites to choose ads. Microphone recordings and derived voice features are not sent to advertisers.
You can manage Google ad personalization through My Ad Center, learn about Google advertising technologies, or review participating providers at YourAdChoices. Non-personalized ads can still use cookies for frequency limits and reporting. Browser cookie controls and provider choices have different scopes; neither removes a public leaderboard entry or a first-party gameplay record.
Consent choices and advertising
Google Analytics measurement uses regional defaults: analytics storage starts off for visitors in the European Economic Area, the UK and Switzerland until an applicable consent decision, and starts on in other regions unless an explicit saved choice or Google consent decision keeps it off. Advertising storage, advertising user data and ad personalization start off separately. The local analytics notice does not open automatically; use Privacy choices to keep Google Analytics storage off or allow measurement. Allowing measurement does not grant advertising consent. When a published Google Privacy & messaging dialog applies to a visitor, that Google-certified CMP manages the purposes configured in the dialog, and Privacy choices can reopen it. Its regional messages require publication in the AdSense account, including the relevant EEA, UK and Switzerland settings. If a message is unavailable, the local analytics choice remains available.
The existing Adsterra placements are a separate advertising service. A Google Analytics choice does not control every third-party provider or block all network requests, and denied Google storage can still allow cookieless Google measurement. Essential game storage and the first-party records described above have separate purposes. Choosing to allow microphone access never means that you consented to advertising.
Children and COPPA boundary
Mimic Party is a general-audience browser game and is not directed to children under 13. We do not knowingly ask children for an account, real name, contact details or a voice upload. A nickname entered for an optional public leaderboard should be a made-up label and must not contain personal information. Parents or guardians who believe a child has sent personal information can contact lijing123lll@gmail.com; please do not send a recording or unnecessary private data with the request. See the children, privacy and consent guide for the practical steps.