Submission Criteria — tinyfiles.tv

How to Submit

Because we manually review and vet every single file for security and quality, there is no automated upload button. The only way to submit is to join our Discord (18+ only) and drop your files in the submission channel.

Join the Discord to Submit →

Part 1: The Creator Information Sheet

If this is your first time submitting a piece to tinyfiles.tv, you need to fill out a Creator Information Sheet. We build your creator page manually based on this info.

Creator Specs

Name / Studio: Your name or the name of your game studio.
Bio: 3 paragraphs maximum. Keep it focused on what you make.
Avatar: Exactly creator.png, strictly 512x512 pixels.
Donate Links: Up to 3 outbound links to Ko-fi, PayPal, Patreon, etc. We do not handle money.
Marketplace Links: Up to 3 outbound links to itch.io, Steam, GitHub, etc.

Self-rating (1–10, required). Every creator rates their own work in the sidecar as self_rating. If it's below 6, the work starts outside the browse feeds — still published at its direct URL, still playable, still votable. The moment three raters have voted and the average is above 50%, it enters the feeds. A high self-rating does not protect a work either: if three raters give it an average of 50% or below, it moves to the graveyard regardless of what the creator thought. The creator's self-rating is a starting state, not a permanent verdict.

Strict Rule: We do not allow social media links (Twitter, Instagram, TikTok, etc.) on creator pages. This site is for the work, not the influencer.

Part 2: Game Submission

Every piece requires your runnable files and a JSON sidecar (the information sheet).

Technical Specs

JavaScript: Must be vanilla JavaScript, unminified, and readable. Entry point is index.html.
Python: Always an HTML + Python pair — never Python alone. The Python is a pure function capped at 16KB. Full rules on the Python page.
WebAssembly: Accepted for low-end performance. (Strict ZIP + GitHub rule below).
Sidecar JSON: Required for all formats. Contains title, description, tags, and license.

The WebAssembly & Compiled Code Rule

We want tinyfiles.tv to run smoothly on low-end hardware, which means we accept WebAssembly (WASM). However, because WASM is a compiled binary, it is not human-readable. We are a source-available site, so you cannot just drop a binary and run.

If you submit WASM (or any compiled language like C, C++, or Rust):

You must upload a .zip file containing the original, human-readable source code alongside your compiled submission.
You must provide a link to the public GitHub repository (as a secondary backup).

If we can't read the original code, we don't accept the submission.

Python Works — HTML + Python Pair

A Python submission is never a Python file alone. It is always two files: an HTML work, subject to every rule that applies to any browser work, and a Python function that the HTML calls. The HTML is the submission; the Python is a backend function. A Python-only submission is not accepted.

The full technical rules live on the Python page. What you need to know before you start:

The pair. The HTML is the artifact — it follows every browser-work rule in this document (sandbox, offline, self-contained, 5MB cap). The Python is a pure function called by the HTML. It has no UI, no server, and no port. If the Python backend is unavailable, the HTML still loads.
16KB Python cap. The Python file is capped at 16,384 bytes uncompressed. The HTML is subject to the normal 5MB cap (or 64KB for tinyjam).
Single entry point, pure data. def run(inputs): or equivalent. The script does nothing at module level. Inputs and outputs are JSON-serializable. No file handles, no sockets, no objects that reach outside the process.
No obfuscation. No eval, exec, compile, __import__, base64-encoded strings, byte-shifting, minified source, or hashed code/strings. If a string in the source isn't readable as a string, the submission is rejected.
No forbidden imports. No os, sys, subprocess, shutil, ctypes, platform, builtins, socket, urllib, requests, http, ftplib, asyncio, importlib, inspect, pickle, marshal. The safe list is pure computation: math, random, json (for data), itertools, functools, collections, re, datetime, string.
No filesystem, no network. The container has a read-only root and no network namespace. Enforced at the OS level, not by inspection.
Persistence through the Save API. The container is ephemeral — no writable disk, no in-memory state between calls. State lives on the server, keyed by the player's hash code. See the Save API below.
bandit is the first gate. Every Python submission runs through bandit (the standard Python security linter) before a human sees it. Any finding at any severity is a rejection. Run it yourself first: bandit -r your_file.py -lll.
Container isolation. No network, read-only root, non-root UID, all capabilities dropped, no new privileges, seccomp syscall allowlist, 128MB RAM, 0.5 CPU, 32-process limit, 3-second timeout. The container is the trust boundary, and the Python is untrusted inside it.
The backstop. If the container fails a single test in the public adversarial test suite, Python closes until it's fixed. If we can't run it safely, we don't run it.

The container flags, the bandit invocation, the test suite, and the pair model are all documented in detail on the Python page. Read it before you write a submission.

Image Assets

Provide these specific image sizes. If you don't provide them, the system will auto-generate a clean, typographic cover based on your accent color.

1. Perfect Square: app-icon.png — 512x512 pixels.
Used for the "Tiny Grid" feed view and the mobile game page header.
2. Widescreen: cover-wide.jpg — 1280x720 pixels.
Used for the main card feed on desktop, the desktop game page header, and social link previews.
3. Cinematic Widescreen: banner.png — 1024x500 pixels.
Used for featured slots at the top of the homepage.

File Size Limit: Hard cap of 5MB per file. We strongly prefer files under 1MB. The only exception to this cap is sequenced JavaScript choreography videos.

No Third-Party Calls: Your code cannot call third-party servers, fetch remote assets, or load external stylesheets. Everything must be inline or self-contained. The two exceptions are the platform's own services: the Save API (Part 3) and the Python backend (if the work uses one). Both route through the platform's parent page, not through your code directly.

No Outbound Links: Do not put links to external sites inside the game itself. (Creator-page metadata is governed separately — see Friendly Links.)

Part 3: The Unified Save API

You don't need to build a backend to save player progress, post high scores, or create multiplayer rooms. We handle it for you via a centralized PHP/MySQL API using a Retro Save System (inspired by the classic password screens of the NES era).

Players don't create accounts or use cookies. They generate a 12-character Hash Code (e.g., TF-8X2P-99KM) when they first save. Your game state is encrypted in their browser with a key derived from the code, and the server stores only the ciphertext, keyed by a one-way hash of the code. They write the code down. When they return, they type it in, and their browser decrypts the save locally. The server never sees the plaintext.

What the API can do for your game:

Cloud Saves: Save a player's inventory, level, or state as a JSON object. (Max 50KB per save).
Leaderboards: Post a player's score to a global, sortable table for your specific game.
Multiplayer Rooms: Generate a temporary room code that a second player can type in to join the session.

We provide lightweight JavaScript snippets that you drop into your HTML file to instantly connect to these endpoints.

Content Rules

Age Requirement: You must be 18 years or older to join our Discord or submit a game. If you are under 18, your parent or legal guardian must submit the game on your behalf.
Rating (PG-13): The site must be safe enough to send kids to play. Zero curse words. Violence (fighting, action, explosions) is totally fine. Zero suggestive or sexual content.
Multiplayer Communication: Live text chat is strictly forbidden. Multiplayer games must use our standardized set of "64" preset phrases and emotions (similar to Rocket League or Hearthstone). You may request to add custom commands on a case-by-case basis. There is absolutely no uncontrolled talking allowed.
No Politics: We are here for art and code, not political debate.
No Abuse: No hate speech, harassment, or abusive content.

The Curation Process

Once you submit your file in Discord, it goes through a strict pipeline before it goes live:

Antivirus Scan: Every file is deep-scanned for malware.
Semantic AI Screening: We use advanced language models to verify your code doesn't violate the PG-13 or no-politics rules.
Manual Playtest: A human curator opens the file, plays it, and checks the code to ensure it meets the technical constraints.

Python submissions pass through two additional gates before this pipeline. bandit (a deterministic security linter) and the public adversarial container test suite. Both must pass, or the submission never reaches stage 1. The full process is on the Python page.

For what runs where (browser vs. isolated Docker container), what the scanning pipeline actually covers — and what it doesn't — and how to report a platform-level vulnerability, see the Security page.