What LazLyz collects, why, and what never happens with your data.
Last updated: July 8, 2026
I'm Mohammed Albalawi, an independent developer based in Saudi Arabia, and I operate lazlyz.com (the "Site") under my business name, meslzy. For anything privacy-related, write to [email protected].
Account data: your email, username, and password (stored as a secure hash — never in plain text). Guest accounts are temporary and hold only a generated identity.
Profile and gameplay data: your nickname, avatar and color choices, XP, achievements, games played, wins, and friends list — kept with your account so the game works across sessions.
Coin data: your coin balance and a transaction history of grants, purchases, spends, and refunds.
Billing data: payments are processed by Paddle.com as merchant of record. I receive transaction and coin-balance information, never your card details.
No third-party analytics, no advertising trackers, no cross-site tracking, no precise location, no contact lists — and your data is never sold.
Room chat is relayed live between players and is not stored on my servers.
If you link your Twitch account, I store your Twitch id and channel name to connect your channel to chat-driven modes.
While a chat-driven mode is running, public messages from your channel's chat are read live to power the game. They're processed in memory and not stored.
To run the games and rooms you join, manage your account and coins, keep the Site secure, and meet legal obligations. Nothing else.
The Site uses essential cookies only: a session cookie to keep you signed in and a color-scheme preference. No advertising or analytics cookies.
Paddle.com handles checkout, taxes, and payment processing. Twitch provides the optional chat integration. Hosting infrastructure runs the Site's servers.
Account data is kept until you delete your account. Guest accounts are automatically deleted after they expire. Server logs are kept for a short period (around 30 days) for security and debugging.
You can ask to access, correct, export, or delete your data at any time by emailing [email protected] — I respond within 30 days.
If you're in the EEA or UK, you have the GDPR rights of access, rectification, erasure, restriction, portability, and objection, plus the right to complain to your supervisory authority. California residents: I do not sell personal information.
All traffic is encrypted in transit (HTTPS), passwords are hashed, and access to infrastructure is limited to me. If a breach affects your data, you'll be notified.
The Site isn't directed at children under 13 (under 16 in the EEA), and I don't knowingly collect their data. If a child has used the Site, contact [email protected] and the data will be deleted.
The Site's servers and providers may be located outside your country. Where the law requires it, appropriate safeguards apply to those transfers.
Updates to this policy are posted here with a new "Last updated" date. Questions or requests: [email protected].