External resources policy

To reduce privacy risk and overhead, Poki blocks all external requests by default. Your game may not call any third-party URLs unless they've been explicitly approved.

Not allowed

  • External assets. No runtime requests to Google Fonts, externally hosted images or audio, or code libraries on external CDNs like jsDelivr. Download and bundle these assets into your build instead.
  • In-game chat systems. Chat can expose players, especially younger ones, to inappropriate language, bullying, and worse. Chat systems aren't allowed. An emoji system is a great alternative for player expression.
  • External account systems. Games must not collect personal information. No email-based logins, no Google or Facebook sign-in. Any system that asks for identifiable personal data has to go.

Possible exceptions

These still need approval through the same process below, they’re not a separate informal track.

  • Multiplayer servers: externally hosted game servers are fine once approved by Poki.
  • Analytics: providers like GameAnalytics, ByteBrew, or an in-house solution are reviewed case by case. Google products (including Google Analytics) cannot be approved.
  • Leaderboards: externally hosted leaderboard services are reviewed case by case.

Getting a resource approved

  1. Go to Settings → CSP on your game in Poki for Developers and request the resource update yourself: the exact link(s) and a short explanation of how they're used.
  2. If approved, the Content Security Policy (CSP) for your game is updated accordingly.
  3. Provide an up-to-date privacy policy: hosted on a live webpage accessible to all players, linked inside the game, and clearly describing how the external service handles user data.
  4. Once your requested services are reviewed, please re-uploaded your latest version. This makes sure the cache resets and should unblock your requests.
Note Poki can't review or provide example privacy policies due to a conflict of interest. Make sure yours covers everything it needs to.