Permissions and safety

The permissions

You see these when you connect an app. You can turn off any of the first three, as long as one stays on. offline_access is not a choice: it comes with the connection when the app asks for it, and the page tells you so.

Permission	What it allows
games:read	See your games, their settings and how to verify them
stats:read	See your games’ audience and results: totals only, never individual players
games:write	Add and edit your games, and send them for review
offline_access	Stay connected without asking you to sign in each time

Which tool needs which permission is listed in the reference. For an assistant that only reports on your numbers, turn off games:write.

To change your choice later, disconnect the app and connect it again.

What keeps your account safe

• It reaches your own games and those of your studios. Nothing else. Asking to read or change someone else’s game gets the same “not found” as a game that does not exist.
• It has no staff powers. Even on an admin or moderator account, it acts as a plain creator and goes through review.
• Changes to a live game wait for review, as they do from the dashboard.
• Stats are totals. No individual player appears in them.
• You get an email when an app connects, and you can disconnect it at any time. Access ends at once.
• It has no key to leak. Sign-in uses OAuth, access tokens expire after 15 minutes, and the app renews them for as long as you leave it connected.
• It cannot manage your account. It has no way to change your email or password, or your studio’s team.

Actions that need your attention

Assistants usually ask before they do something that has an effect, and your app may have its own settings for that. Two tools in particular are worth watching:

Tool	Effect	Safeguard
verify_domain_and_submit	Sends a draft to the review queue and emails you	Does nothing unless your site carries the proof
delete_game	Permanently deletes a draft or a game in review	Requires the game’s exact name. A live game cannot be deleted

resubmit_game also spends one of your limited review attempts.

Text in your stats comes from strangers

Some of what an assistant reads was written by other people: referrers and utm_source values from visitors’ browsers, and mode names and puzzle ids from anyone able to send results. Someone could put an instruction in there, hoping an assistant will follow it. This is known as prompt injection.

Alldle reduces this in three ways. It strips invisible characters from most of this text and shortens it, it tells the assistant that everything in a result is data and never instructions, and it marks fields that can be forged. That reduces the risk but cannot remove it, so:

Keep an eye on what it does

If your assistant reads your stats and then proposes to change, delete or send something you did not ask for, say no and look at why. Keep its approval prompts on for anything that writes.

Where your data goes

What the assistant reads goes to the company behind it, under its own privacy policy. That covers your game’s settings and your audience totals. See Alldle’s privacy policy.

On Alldle’s side, each tool call is noted with the tool’s name and the game it concerns, without its other arguments.