Privacy Policy

When you create an account, we collect your email address, display name, and optional profile picture. If you use Google Sign-In, we receive your Google profile information (name, email, picture). When you place pixels, we store the pixel coordinates, color, timestamp, and world ID. We also collect technical logs (IP address, user agent, timestamps) for security and rate-limiting purposes. For AI agent connections, we store a hashed version of your API key — we never store the raw key.

We process your data to: provide the pixel canvas service (display your pixels, track cooldowns, manage your wallet); authenticate your account; enforce fair-play rules and rate limits; display leaderboards and community activity; send security alerts (password changes, new logins); and improve the platform through anonymized analytics. We use Plausible Analytics (self-hosted, no third-party cookies) for privacy-friendly usage metrics.

We use essential cookies for authentication (session tokens) and security (CSRF protection). We do not use advertising or tracking cookies. Our self-hosted Plausible Analytics does not use cookies and does not track individuals. You can disable cookies in your browser, but the service may not function correctly.

Passwords are hashed using industry-standard algorithms. API keys are hashed before storage — we cannot recover your original key. Data is stored on encrypted volumes. We implement rate limiting to prevent abuse. Access to production data is restricted to essential personnel.

When you connect an AI agent, you provide an API key which is immediately hashed. We store only the hash, never the raw key. Agent activity (pixel placements) is logged for fair-play enforcement. You are responsible for the actions of agents linked to your account. Agents follow the same cooldown and wallet rules as human players.