About tinyfiles.tv.

The Core Idea

tinyfiles.tv is a curated feed and distribution pipeline for creators with lightweight media files. It exists to collect, organize, and make available the source code for audio-visual media and computer software.

We offer creators a limited, focused space to express themselves and place outbound links—whether to a marketplace or a donate button to an external service.

Primary offering: Self-contained HTML5 WebAudio games, songs, and moving pictures/automatic television.

What This Isn't

• A live streaming platform.
• A donation service or money handler.
• A dumping ground for every game.
• A place for ads that take over the device or advance gameplay.

The Rules & Constraints

Because we are focused on lightweight, web works, there are hard limits. These keep the site fast, the code readable, and the environment safe.

Content Guidelines

• PG-13 Rating: All content must be rated appropriate for PG-13. No politics. No abusive content.
• Licensing: All files must have an express license. All code must be downloadable and fully inspectable. (See our submission criteria).

Technical Constraints

• Hard Cap: No media over ~5MB (preferably under 1MB). The only exception is sequenced JavaScript choreography videos.
• Accepted Formats: Vanilla, unminified JavaScript; self-contained Python backends, always paired with an HTML work — Python alone is not accepted (see the Python page); and WebAssembly (with original source ZIPs and a public GitHub repository).
• No Video Hosting: This is primarily a JavaScript project. We don't generally host video files. "Moving pictures" means Canvas/WebGL.
• Self-Contained: No outbound links within the game itself. No calls to third-party servers, APIs, or remote assets. Calls to the platform's own Save API and Python backend are permitted (they route through the parent page). Everything else must be inline.
• The Information Sheet: All files must have an index file and a JSON sidecar (we call it an "information sheet").
• Desktop First: Pieces are built for desktop first. Mobile ports happen if necessary, and some pieces are filmed for archival.

No Player Logins. Just Hash Codes.

You might notice there is no "Sign Up" button for players, no forced login screens, and no cookies. This is entirely by design. Automated account systems invite bots, spam, and massive privacy headaches.

Instead, we went back to basics with a Retro Save System (inspired by the classic password screens of the NES era). When a game needs to save data, it doesn't ask for your email. Your browser generates a unique 12-character Hash Code (e.g., TF-8X2P-99KM) when you first save. Your game state is encrypted in your browser — PBKDF2 derives an AES-GCM key from the code, and the ciphertext is what leaves the page. The browser sends the ciphertext and a one-way hash of the code to the server; the server stores the encrypted block keyed by that hash. It never sees your state, and never sees the code itself. Type the code on any device and your browser decrypts it locally.

Twelve characters is the standard. If a game needs more than one code's worth of anchor — multiple save slots, a long-running world — the player can chain additional codes onto the first. The number is not a ceiling.

Because your Hash Code acts as an anchor in our database, that single string of numbers unlocks a whole suite of backend features for creators without them having to build a server:

• Cloud Saves: Type your code into a game, and your inventory, level, or high score is pulled instantly from the database.
• Global Leaderboards: Post your score to a shared table for everyone to see.
• Multiplayer Rooms: Create a room, get a code, and send it to a friend. They type it in to join your session.

If you lose the code, the save is gone forever. That is the trade-off for absolute privacy, zero tracking, and a frictionless experience.

Privacy & Analytics

When you completely strip out cookies, tracking pixels, and user surveillance, your focus shifts away from who the visitor is and focuses entirely on what the work is doing. We use a few privacy-respecting metrics to keep the site healthy without violating your trust:

1. Aggregate Play & View Counts

A simple counter increments every time a game's page or file is loaded. It tells us what art or games are getting organic traction on the platform, without needing to tie that play count to a specific human being's identity or browsing history.

2. Client-Side Error & Crash Reporting

A lightweight global JavaScript error listener (window.onerror) quietly pings our server if a game throws an uncaught exception. Because we manually curate files, knowing that a specific game is throwing a TypeError on Safari or mobile helps us (or the creator) patch a bug before complaints roll into Discord. It tracks the bug, not the user.

3. Outbound Donation & Marketplace Click-Throughs

We track anonymous, aggregate click events on outbound links (e.g., how many people clicked a creator's Ko-fi or itch.io link). It lets us measure whether tinyfiles.tv is actually succeeding at its primary mission: driving real financial and community support to independent creators.

4. Raw Infrastructure & Bandwidth Stats

We monitor disk I/O, memory usage, and total gigabytes transferred per day on our Linux VPS. When your file sizes are tiny (sub-5MB), keeping an eye on aggregate bandwidth ensures our server isn't getting choked out by an unexpected traffic spike, letting us scale or optimize proactively.

And the absolute basics:

• Request Logs: What page was requested and when.
• IP Address: Used to block malicious bots, prevent DDoS attacks, and rate-limit API spam.
• User Agent: What browser and operating system you are using (so we know if we need to fix a layout bug on mobile).
• Newsletter Emails: If you explicitly opt-in, we store your email address on our secure server to send you updates. We do not sell or share this list, and you can unsubscribe at any time.

That's it. We don't use Google Analytics, we don't sell this data, we don't share it, and we don't build shadow profiles.

Submissions & Curation

Because we have no automated uploads or player login systems, every single submission is handled manually. The only way to submit is to join our Discord and drop your files in the submission channel. Bring your file, your information sheet, and your links.

The Curation Process

Before anything goes live, it undergoes a rigorous automated and human check:

• Antivirus Scanning: Every file is passed through deep malware and virus scans.
• Semantic AI Screening: Files are evaluated by advanced language models to ensure they comply with our PG-13 and no-politics guidelines.
• Manual Review: A human curator inspects the source code and plays the piece to ensure it meets our technical constraints.

For what runs where, what the scanning covers (and what it doesn't), and how to report a platform vulnerability, see the Security page.

Raters & Ranking

We don't use a public upvote system. Instead, pieces are ranked by a trusted group of Raters. Raters are given a secret key to input to vote.

Who can be a Rater? Anyone who has a program hosted on the website is automatically eligible to be a Rater. Additionally, people who don't have a program on the site can apply to join strictly as a Rater.

The Annual Competitions

The collection runs two competitions a year. tinyjam is the JavaScript-and-WebAssembly jam, in spring — opens May 6, 2027, closes June 6, 64KB hard limit, theme-driven. python-classic is the Python jam, in fall — opens November 11, 2027, closes December 11, 32KB total across the HTML + Python pair, two files maximum.

Both are judged by the same Rater jury that scores everything else on the site. Winning works are enshrined permanently with a badge that never comes off. The two don't share entries, themes, or badges — a submission to one is not a submission to the other.

Support the Project

tinyfiles.tv is a passion project, but it isn't free to run. We have ongoing server costs, domain renewals, and infrastructure bills that we pay out of pocket.

Right now, the site is running on a modest VPS. Our immediate goal is to upgrade to a larger VPS so we can serve more files faster, handle higher traffic, and keep the Save API and Python containers running smoothly.

If you enjoy the collection and want to help keep the lights on (and keep the site ad-free), consider chipping in.

Legal & DMCA

If you believe your copyrighted work has been used in a way that constitutes copyright infringement, you must contact us via email. We do not process DMCA requests through Discord, Twitter, or any other platform.

For everything else — general questions, bug reports, creator support, security disclosures — the Contact page lists every channel and what each one is for.