Privacy
The short version. Your camera feed is processed entirely inside your browser and is never uploaded, recorded, or seen by us. We count visits in aggregate so we know whether anyone is playing — no cookies for it, no advertising, no profiles, and nothing that identifies you. The only personal data we ever receive is your X profile name, handle and picture, and only if you choose to sign in.
The camera
The game needs your camera to see your hands. Your browser asks for permission first, and you can revoke it at any time in your browser's site settings.
Every frame is analysed on your own device by hand and face tracking models that are downloaded once and then run locally. Frames are held in memory only long enough to measure where your fingertip and mouth are, and are then discarded. Nothing is recorded, nothing is written to disk, and no image or measurement is transmitted anywhere. This is not a promise about intent — the game has no code that uploads video, and you can confirm that in your browser's network tools while playing.
What stays on your device
- Your display name, if you type one instead of signing in.
- Which objects you chose to play with.
- Your best scores per mode.
These live in your browser's local storage. We never receive them. Clearing site data for this domain removes them.
Counting visits
We use Vercel Web Analytics to see how many people play. It records a page view with the page address, the referring site, an approximate country, and a device type (desktop, tablet or mobile). That is the whole list.
- No cookies and no device storage are used for analytics, and nothing is written to your browser to recognise you later.
- No cross-site tracking, advertising, or profiles. The data is reported to us only as aggregate counts and charts — we cannot single out a visitor, and there is no way for us to tie a visit to you.
- Your IP address is not stored. Vercel uses it in transit to derive the country and to de-duplicate page views, and discards it.
- Nothing about your gameplay is sent: not your score, not your camera, not how long you played.
Vercel acts as our processor for this. Their description of what the product collects is in Vercel's Web Analytics privacy documentation. Where the GDPR applies, our basis is legitimate interest (Article 6(1)(f)) in knowing whether the site works and is being used — a narrow interest served by data that cannot identify you. Because no cookies or device storage are involved, no consent banner is required. If you would rather not be counted at all, any content blocker or your browser's tracking protection will stop the request, and the game plays exactly the same.
If you sign in with X
Signing in is optional. It exists only to put your name on your own scorecard.
- What we receive from X: your user ID, display name, handle and profile picture URL. Nothing else — we request read-only profile access and never post on your behalf.
- Where it is kept: in a signed cookie on your device. We do not run a user database, so there is no server-side record of you.
- The access token X issues is used once, immediately, to read that profile, and is then discarded. It is never stored.
- Sharing a score opens X's own composer with text filled in. You decide whether to post it. Nothing is posted automatically, and sharing works without signing in.
Signing in means X also processes the interaction under X's privacy policy, which may involve transferring data outside your country. We have no control over that.
Cookies
We use cookies only to make sign-in work, never for tracking or advertising. Because they are strictly necessary for a feature you asked for, there is no consent banner.
- ak_session — remembers that you signed in. Expires after 30 days, or immediately when you sign out.
- ak_oauth_state, ak_oauth_verifier, ak_oauth_return — short-lived values that protect the sign-in round trip against cross-site request forgery. They expire within 10 minutes and are deleted as soon as you land back on the site.
All are marked HttpOnly, so page scripts cannot read them.
Server logs
Our hosting provider may record standard request information, including your IP address, for security and reliability. We do not build profiles from it or combine it with anything else. Retention follows the provider's own policy.
Why we are allowed to do this
Where the GDPR or UK GDPR applies: camera access and signing in both rest on your consent (Article 6(1)(a)), which you give through the browser permission prompt and by choosing to sign in, and which you can withdraw at any time. Keeping you signed in during a session rests on performance of the service you requested (Article 6(1)(b)). Where India's Digital Personal Data Protection Act, 2023 applies, the same activities rest on your consent for the specified purpose of labelling your scorecard.
Your choices
- Withdraw camera access in your browser's site settings.
- Sign out to delete the session cookie.
- Clear site data to remove your name, mode and best scores. Because we hold no server-side records, this leaves nothing behind on our side.
- Ask us at [CONTACT EMAIL] to access, correct or erase anything you believe we hold, or to complain. You may also complain to your local data protection authority.
Children
The game is not directed at children under 13, and signing in with X requires an X account (13+ under their terms). We do not knowingly collect personal data from children. If you believe a child has signed in, contact us and we will help remove it.
Changes
If this notice changes materially we will update the date above and, where the change affects how we handle personal data, say so on the home page.
Draft notice. This document was prepared to match exactly what the code does, but it has not been reviewed by a lawyer. Have it checked before launch, and fill in every bracketed placeholder.