Privacy

Last updated [DATE] · Operated by [OPERATOR NAME] · Questions: [CONTACT EMAIL]

The camera

The game needs your camera to see your hands. Your browser asks for permission first, and you can revoke it at any time in your browser's site settings.

Every frame is analysed on your own device by hand and face tracking models that are downloaded once and then run locally. Frames are held in memory only long enough to measure where your fingertip and mouth are, and are then discarded. Nothing is recorded, nothing is written to disk, and no image or measurement is transmitted anywhere. This is not a promise about intent — the game has no code that uploads video, and you can confirm that in your browser's network tools while playing.

What stays on your device

• Your display name, if you type one instead of signing in.
• Which objects you chose to play with.
• Your best scores per mode.

These live in your browser's local storage. We never receive them. Clearing site data for this domain removes them.

Counting visits and play

We count how many people arrive, how many actually play, and how far they get. Two mechanisms do it, both aggregate:

• Vercel Web Analytics records a page view with the page address, the referring site, an approximate country and a device type. It sets no cookies and stores nothing on your device.
• Our own counters add up a handful of events: a page view, a run started, a run ended by a bomb, the share sheet being opened, and a completed X sign-in. What is stored is a number per event per day — a tally, with no row, record or profile for any individual.

Two details worth stating plainly:

• One flag on your device. We store a single value in your browser's local storage, airkata-seen, so a visit can be counted as first-time or returning. It is a boolean — it holds nothing that distinguishes you from anyone else, and it never leaves your browser. Clearing site data removes it.
• Your IP address is never stored. To estimate unique visitors and to stop someone spamming the counter, your IP and browser version are combined into a one-way hash using a secret that changes every day. The hash is fed into a HyperLogLog — a structure that counts distinct items without keeping them — and the rate-limit key expires after a minute. Yesterday's hashes cannot be matched to today's, and neither can be turned back into an address.

What we deliberately do not collect: nothing from your camera, no scores, no run durations, no identifiers, no cross-site tracking, and no advertising data. "Share sheet opened" is counted when you press the button — whether you actually post is on X's site and is never reported back to us.

Where the GDPR applies, our basis is legitimate interest (Article 6(1)(f)) in knowing whether the site works and is being used, served by data that cannot identify you. Daily counts are kept for about thirteen months and lifetime totals indefinitely; neither can be traced to a person. If you would rather not be counted, any content blocker or your browser's tracking protection will stop the requests, and the game plays exactly the same.

If you sign in with X

Signing in is optional. It exists only to put your name on your own scorecard.

• What we receive from X: your user ID, display name, handle and profile picture URL. Nothing else — we request read-only profile access and never post on your behalf.
• Where it is kept: in a signed cookie on your device. We do not run a user database, so there is no server-side record of you.
• The access token X issues is used once, immediately, to read that profile, and is then discarded. It is never stored.
• Sharing a score opens X's own composer with text filled in. You decide whether to post it. Nothing is posted automatically, and sharing works without signing in.

Signing in means X also processes the interaction under X's privacy policy, which may involve transferring data outside your country. We have no control over that.

Cookies

We use cookies only to make sign-in work, never for tracking or advertising. Because they are strictly necessary for a feature you asked for, there is no consent banner.

• ak_session — remembers that you signed in. Expires after 30 days, or immediately when you sign out.
• ak_oauth_state, ak_oauth_verifier, ak_oauth_return — short-lived values that protect the sign-in round trip against cross-site request forgery. They expire within 10 minutes and are deleted as soon as you land back on the site.

All are marked HttpOnly, so page scripts cannot read them.

Server logs

Our hosting provider may record standard request information, including your IP address, for security and reliability. We do not build profiles from it or combine it with anything else. Retention follows the provider's own policy.

Why we are allowed to do this

Where the GDPR or UK GDPR applies: camera access and signing in both rest on your consent (Article 6(1)(a)), which you give through the browser permission prompt and by choosing to sign in, and which you can withdraw at any time. Keeping you signed in during a session rests on performance of the service you requested (Article 6(1)(b)). Where India's Digital Personal Data Protection Act, 2023 applies, the same activities rest on your consent for the specified purpose of labelling your scorecard.

Your choices

• Withdraw camera access in your browser's site settings.
• Sign out to delete the session cookie.
• Clear site data to remove your name, mode and best scores. Because we hold no server-side records, this leaves nothing behind on our side.
• Ask us at [CONTACT EMAIL] to access, correct or erase anything you believe we hold, or to complain. You may also complain to your local data protection authority.

Children

The game is not directed at children under 13, and signing in with X requires an X account (13+ under their terms). We do not knowingly collect personal data from children. If you believe a child has signed in, contact us and we will help remove it.

Changes

If this notice changes materially we will update the date above and, where the change affects how we handle personal data, say so on the home page.