Privacy Policy

1. The Short Version

This arcade does talk to a server. The moment you land, it quietly makes you a guest account with a silly random name, and from then on your wins, losses, best scores and streaks are saved to a database so the leaderboards mean something. There is no email, no phone number, no address book, no ad network. If you want all of it gone, there is a button for that, and it really does delete the rows.

2. The Guest Account You Did Not Ask For

On your first visit the site calls our API and creates a guest account for you. That account is a row in our database holding a random id, a generated username along the lines of "Sleepy Otter 4821", a flag saying you are a guest, and the time it was created. You never typed anything, and nothing about you was collected to build it.

In return the server hands back a signed session token (a JWT, valid for 30 days) which your browser keeps in localStorage under the key pixel-playground-session. The token carries your account id, your display name and the guest flag. Nothing else.

3. If You Make A Real Account

Upgrading a guest into a proper account asks for a username and a password, and that is the complete list. The password is never stored as you typed it: it is run through PBKDF2 with SHA-256, a random salt and 100,000 iterations, and only that hash is written down. Nobody, including us, can read it back out.

4. What Your Play Sends To The Server

When a game ends, it posts the result of that round. For every finished game we store:

• which game it was, and whether it was a win, a loss, a draw or simply completed
• the score, the time in seconds, the number of moves and the difficulty, where the game has those
• the timestamp of the round

Alongside that we keep a running tally per game:

• plays, wins, losses and draws
• your best score, best time and fewest moves
• your current streak, your best streak and the last day you played

That is the whole picture. No mouse tracking, no keystroke logging, no reading of the board while you think.

5. Where It All Lives

The API is a Cloudflare Worker and the data sits in Cloudflare D1, a SQLite database, in three tables: accounts, individual scores and per game stats. The site itself is served from Vercel. Both of them see ordinary web traffic on our behalf, which includes your IP address at the moment of the request. We do not copy IP addresses into the database. The Worker holds one in memory only long enough to rate limit the account and score endpoints, and it is dropped within the minute.

6. Leaderboards Are Public

This is the one genuinely public thing here: if you place on a leaderboard, your display name and your best result for that game are visible to everyone who opens it. Guests are marked as guests. Rename yourself from the profile menu at any time if you would rather not be identifiable.

7. What Stays On Your Device

A handful of small things never leave your browser: your session token, your light or dark theme choice, your music volume and track position, your chosen chill wallpaper, and your in progress 2048 board. These use localStorage, not cookies. Clearing your site data wipes them and logs you out, but it does not delete your account from the server.

8. Measurement And Third Parties

We run Vercel Web Analytics and Vercel Speed Insights. They are cookieless and count page views, referrer, country, and coarse device, browser and operating system, plus loading speed figures. They do not build a cross site profile of you and they are not tied to your arcade account.

Fonts are served from this site rather than fetched from Google. Album art for the lofi player comes from Unsplash through our own image endpoint. There are no advertising networks, no marketing pixels, no data brokers, and nothing here is sold or shared for money.

9. Deleting Everything

Scroll to the bottom of the home page and press Delete account. It calls DELETE /api/v1/users/me, which removes your account row along with every score and every stats row attached to it, including your leaderboard entries. Registered accounts have to re-enter their password first so that a stolen session token cannot do it for you. There is no soft delete and no recycle bin, so please be sure.

We keep your data until you do that. There is no scheduled purge of idle accounts, because a Wordle streak you abandoned for six months is still yours.

10. Changes, And Saying Hello

PixelPlayground is a personal portfolio project, not a company, and it changes when its author feels like building something. If what is stored ever changes, this page changes with it and the date at the top moves. Questions, corrections or a request to delete something by hand: shaikhaman.0020@gmail.com.